{"type": "bundle", "id": "bundle--60fd2148-1a88-4de6-8893-098ec558e32d", "objects": [{"type": "identity", "spec_version": "2.1", "id": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "name": "James Brine", "identity_class": "individual", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "location", "spec_version": "2.1", "id": "location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb", "name": "DigitalOcean London", "latitude": 51.5177, "longitude": -0.6215, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "GB"}, {"type": "location", "spec_version": "2.1", "id": "location--d2dd1298-fd76-4201-a824-6cca2f847e1d", "name": "DigitalOcean Toronto", "latitude": 43.6547, "longitude": -79.3623, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "CA"}, {"type": "location", "spec_version": "2.1", "id": "location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7", "name": "Vultr Melbourne", "latitude": -37.8136, "longitude": 144.9631, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "AU"}, {"type": "location", "spec_version": "2.1", "id": "location--b0a7046e-9b88-4166-a5db-af87255aef39", "name": "Vultr Paris", "latitude": 48.8566, "longitude": 2.3522, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "FR"}, {"type": "location", "spec_version": "2.1", "id": "location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f", "name": "Vultr Tokyo", "latitude": 35.6762, "longitude": 139.6503, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "JP"}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--a68ade1d-4fc9-4f6e-9c95-7e007321a362", "name": "Cloudflare Global Edge", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--de27a6dc-10b6-49c6-884b-b196a4ac489a", "name": "DigitalOcean London", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--82d09174-6769-46ac-aa94-07ae3a64b365", "relationship_type": "located-at", "source_ref": "infrastructure--de27a6dc-10b6-49c6-884b-b196a4ac489a", "target_ref": "location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--e5f25f56-5504-44f2-adea-aaee542dbcb5", "name": "DigitalOcean Toronto", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2eca798f-9a58-4b52-b405-a55bd2ff0ff8", "relationship_type": "located-at", "source_ref": "infrastructure--e5f25f56-5504-44f2-adea-aaee542dbcb5", "target_ref": "location--d2dd1298-fd76-4201-a824-6cca2f847e1d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--4c20bac0-5cb9-4b40-a3ed-273814613093", "name": "OpenCLAW Dashboard Decoy", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--fa25dcfe-5666-4856-a1a7-9d9283764e9d", "name": "Vultr Melbourne", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--83406b83-376b-426f-9935-a3e4fd404f9b", "relationship_type": "located-at", "source_ref": "infrastructure--fa25dcfe-5666-4856-a1a7-9d9283764e9d", "target_ref": "location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--8a5fb27f-e9f6-49b7-abda-863605730ec1", "name": "Vultr Paris", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--788de50b-61d6-4ec6-a1c5-1b0c7e3a7e07", "relationship_type": "located-at", "source_ref": "infrastructure--8a5fb27f-e9f6-49b7-abda-863605730ec1", "target_ref": "location--b0a7046e-9b88-4166-a5db-af87255aef39", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--97dc842e-f94e-44dd-af04-6d2c407dea8d", "name": "Vultr Tokyo", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--57379da9-3719-4620-a070-2195bea5f174", "relationship_type": "located-at", "source_ref": "infrastructure--97dc842e-f94e-44dd-af04-6d2c407dea8d", "target_ref": "location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--18b00767-6fe4-4c52-aff9-317d315ef022", "name": "CVE-2019-5418", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--2fb7ed1f-1a69-43c5-ab5f-193d13a7f598", "name": "CVE-2021-26855", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--46662d17-7108-4a7d-8b83-36f90f7e9762", "name": "CVE-2021-31207", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31207", "external_id": "CVE-2021-31207"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--3384f172-ff60-42fc-bb04-7abc79e498e6", "name": "CVE-2021-41773", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41773", "external_id": "CVE-2021-41773"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--eb1503a6-965f-4d2c-bd28-e1f287172aa7", "name": "CVE-2021-42013", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42013", "external_id": "CVE-2021-42013"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c22fb853-0cfb-425b-85cc-f4ffc77e64d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.1.220.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c978ed12-4e30-49f8-ad3c-4d5dfca1e247", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.10.247.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbee149a-bb0b-4361-841d-2cd137108567", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.158.147.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34641c56-a3c3-4fd7-9add-9fe4820535c7", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.2.239.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e706e0ca-4c3e-4c8d-9817-fc2eb57de47e", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.20.82.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3138d53-972a-4392-b282-d21eff017409", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.239.8.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c913543d-ba22-4990-a506-51848ead7072", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.24.16.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e4fa3af-2852-4950-8eab-ea26829f99b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.83.125.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dda416e9-49e9-46e2-9d63-95ffea7f7946", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.94.172.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da5585dd-2e9a-411c-8dc6-f6c90ba8c2ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.28.153.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8467a388-dc1e-4394-8612-80f165d960f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afaf9049-2d16-42af-a6de-8eeb58172e36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6026d77-5349-4c62-acee-ded32243e475", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a73a57c-2892-4400-a180-a0c971706a50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b97ab9d2-dda5-4408-98c8-c52b34710445", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d3a0474-c379-454f-b38a-a7946d59b9b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0a93bcd-89e7-4473-9dda-ba9f9887eb36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e5c2bde-42dd-4146-ad39-a7a5c79fdb9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb0d693d-2270-40e2-8f4c-dada92861e00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0374a3a9-3aee-4818-a419-c280f85a581e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba3590ca-0508-4471-bc48-bc5d1675c1cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10f600b8-0286-40e3-a9fd-f961b6e72f9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71327451-c03c-4287-ab5f-f56f7b580e9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6af4f832-ae4a-44f5-918e-d2bc1ec4f9dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbcee029-94b8-4eae-8e84-4d57efc23747", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19b60e35-863b-4a6e-8130-adc1778aae57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0ca2cc3-0b99-448b-bb4b-8ea5badc327c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--538b8011-7574-49b7-8a90-0bfcc56128fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44df3dcb-b5d6-4952-b306-58fa522f6113", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48d76e7a-0c4d-44f7-af36-d5891d30ab12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7c725c4-ce77-4a13-9002-0f2e889aad3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56e95025-fb0d-4d07-82a1-b7b9e0809af8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e21bf05c-9e0d-4754-9395-11db12bcb17b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eafa3f06-d923-4d9a-8648-ce2066ba8797", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0658264a-d8e3-4b8f-827b-12342905e283", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ce7422b-b577-4dd6-967e-90dc9d01b39e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dae13c76-0dec-40b2-a9a9-03eeeb549d7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f783dfa1-1453-44be-b7c4-c8ef157e8f24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44f647a6-55fe-49c6-b1a0-4efa4e43dc5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b889f681-6ebc-4f25-b677-18b1a3b2a18b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c5adfc5-463f-47ce-91e0-db0b10d57a58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e098f764-243c-40ba-aa93-7d55e1846f1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e54b5e1f-2bfc-45fa-8832-7973a328e9c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.49.117.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63bdacec-fef8-4268-856e-99d24bfb64df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.50.17.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0eb5d63e-6c81-4ceb-add1-cc54f556d6a0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.52.244.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3f2dfcc-2ec9-4f4e-ab0a-b8b9e392b9d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.55.66.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b70212f-1108-425d-be2e-8268da74644e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.100.130.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--889d639b-80df-4b71-99be-cf4e22db1ebd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.108.251.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf3cbae3-8406-4adb-8d84-dd0c3d7cb6fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.109.72.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfbaf6c5-0cbb-4b51-a09c-fb20a01c05bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.126.12.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bdb5ffb-e726-44bd-b14c-0ce49cbac6f9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.126.135.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae33233f-a941-46b8-a500-0764a6ae83ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.126.33.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66fc6b5d-70e0-4db5-92c8-5d403001cd5d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.126.55.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bde5f68c-24f0-46ba-943b-b89059805387", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.126.89.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19630739-9962-4cad-b277-ebd4500dee61", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.126.95.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c564a5de-653b-4100-b259-193804166ea0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.206.107.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58bc3f85-7942-4c3d-9d93-975299580437", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.32.108.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1e3d595-7515-4b48-8509-c3227e26e31c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.33.55.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dc5dc21-1496-41f5-8317-84fdaddf00d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.105.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96243d77-b216-43c9-904d-9d457e930414", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.106.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69732358-2d63-465f-9a51-82ec3c9c711a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.106.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94cbbe45-e441-48e2-9caa-bd0fe50e0584", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.106.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30c909df-55de-4e3e-82f3-a668d5a2082f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.107.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5231375-b4f4-4b09-b508-8e279c3bc358", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.108.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed8901f6-e35d-4f1a-9642-4852ca421356", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.108.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e26b4e0f-b628-40fa-8dc5-b17da46a8273", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.108.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a455a4a-b4d4-48d9-a5bd-19a69b5bd660", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.108.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98b49e92-fde9-4989-9362-91601b5f6a97", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.109.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d671bb6-79b3-4b73-8e7e-0f7a02c8ae07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.110.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90578a65-d388-4c60-afb6-7f9a95623494", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.111.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63448f13-b372-440c-beb9-f5cfac192c4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.112.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8272356f-5e75-422f-b97d-4a80a540c9dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.116.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5f7ce97-f720-4d0d-8b30-6312a9c37a99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.118.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31099ce4-947d-4acc-816f-06ae581ca7af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.119.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--358874f6-ced1-49c6-a5f9-96190a78e8cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.121.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--709828c0-0a2f-4838-8420-515a6a93b4da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.121.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d70684db-e5f9-4c52-85c3-ccf46ab30f29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.123.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5274407a-d1e7-4446-be09-0397ccc46b7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.124.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f90ea8c-3df4-4312-bb1f-8be290c97f2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f68e0d8c-f8df-4e57-b87b-3e13fbe34352", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aceb5b03-a865-4799-a291-33c3818e3dd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8901726b-b703-424f-abad-fa80386e9701", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9c21c3d-9b51-4e2a-9701-0b9c4841b438", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.91.148.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39656d92-2c74-4326-bfee-a59d8ddb7231", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.96.200.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ad2bbc1-31da-446b-abd6-a9fcd28e2ddb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.129.152.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a925bf43-ef43-48a7-98e3-fa1341184d8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.129.186.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a6e17b3-f4c6-4874-abe4-cbd0db3c1b94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.129.200.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d44f1de0-3940-4689-b1b0-368e2f736f86", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.129.223.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c85839c5-6131-47e0-932d-a338ef5d5131", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.130.241.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aab163e9-13c6-4296-9a01-6999ad5253c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.32.223.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b37d7245-852c-4e04-a81c-49610df04c1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.66.146.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97749c7b-452a-4dd4-8910-a53377a1ef9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.69.167.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--426ce966-ac2b-46f8-a4a0-b17151e23e8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.70.86.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4f410d1-50c2-47cd-892c-2cbb4ab3aa32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.1.210.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06edb523-8840-423a-8981-052143c837eb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.105.56.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05447483-6a7d-448d-95f6-40a34739cbc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.109.187.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--720938ba-91c8-4fcf-9dbd-e9ceec67a00d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.110.5.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7037ccd-ebe6-443f-b9cb-a30c2c534752", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.114.147.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dc1c146-cbfe-412b-a214-4f6addca4bd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.117.202.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61358551-e28c-4859-b5f3-eb48ec8eccb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.120.189.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfaa4d65-75ae-40d9-8ca6-3289a02f92b1", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.123.226.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baebdbf3-6d55-44be-a447-ae146596fba5", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.126.117.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a7fab66-ec8f-42d8-8111-4286d1bbb30f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.131.59.1']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4a0541d-24bd-448a-a5e9-453813068086", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.138.145.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e094c6b-b5d6-401c-bf4a-10a332a9ee63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.14.32.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c8ac6e9-7b75-4bae-8f93-8882aff7624c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.14.32.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7e1636a-b563-4c2f-8aff-711b10d0af06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.142.89.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98cb1824-6311-47dc-ba85-5d5fcbfffa56", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.146.202.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--919f5e01-1735-4932-8076-d6c75bb17c62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.146.23.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--521b780e-b0a0-4ac6-854c-07716a5245fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.149.26.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--099b35d0-a898-4fed-9474-b0b2dba99d86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.149.26.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08bb7415-d22b-4c1f-8c7d-67a43b41dc7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.150.142.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6835740f-afe2-49a5-9ec8-aa5bb6ec6dfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.151.37.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3502ec9-3b49-497b-a4e4-31b6ade238e7", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.156.20.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--323e0c56-7403-47c9-af8a-41f6bbb5339d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.157.96.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf9002eb-e49d-4a78-ad4d-f95e921f7d85", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.16.228.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2a957e4-1f09-414a-be14-7ed39ba92601", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.160.197.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa008aa6-37ab-4462-92c8-a720fdab2e00", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.164.107.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c907030-10f1-4c6f-90ee-15492997c1e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.165.11.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--112d36c3-d9f2-4dc1-9a1e-23753b3ebc44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.165.139.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9ac623e-b5a9-47e8-882e-ef654dc07770", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.168.66.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93c2fe3a-eb97-4b0b-886b-c14f1f8dfa6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.172.27.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--974e0aeb-5729-4e19-a018-845a7b362191", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.173.227.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e174166-92b3-4746-9ef0-e121804e1961", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.176.25.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbb28408-e39e-4e74-ab29-fdf37f6b9a11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.176.90.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd63b271-4363-4eac-bb77-740da4eeced4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.180.212.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b15989c0-6b4f-4ab8-95e3-16121048c9f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.187.12.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be4c6669-3389-4cce-b4e7-8aaf04e850a7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.187.146.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05381785-07bd-432a-a893-2d91c6757222", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.187.146.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d56d37f9-1bf1-43cf-91ad-974f07e0cf04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.187.165.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bacb0ccd-a970-4b33-bb49-3527dbdfb57f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.189.208.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8dee123-5e98-485b-98db-98a6ef91ffc0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.196.9.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83cb6ab5-41fd-4cc8-9efa-53b17681a1ea", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.20.122.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acc3b059-8504-4282-a7a8-ff42f67e0ffe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.203.57.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c02e2d8-4e65-4e58-b9f7-1f1402ece82d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.203.57.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5a2ad9e-f95a-444f-ae25-01ee26e2b164", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.203.57.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5111b3db-deac-4901-89a7-140ba0113d6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.203.57.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5fe0172-fe67-498f-b882-10a7138413f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.205.17.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a718064-16b2-47c4-947b-3a0f5fe71532", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.218.241.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dc92643-8f0c-44a2-94f9-ed8651d6b26e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.228.144.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77626f97-f057-4324-a593-d5afdef2d07d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c2804eb-c3f0-4460-b37b-64f65ad8c859", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9d6e36f-4c87-46e2-8ded-a308ebb35019", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0647f0d-f790-4ea3-a34c-04b76ffc0a5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad6c9ac7-3888-41f9-b7dd-33fc8132ac6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50cf6d23-54c2-4eca-84b6-c693479140d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daf30211-0dee-420b-a715-f164de3785fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e46b9f63-3dce-4a82-8724-c27b6232b651", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d95e836-7da5-4be5-81ad-ac4f1e082bab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0f2504a-a5ce-47aa-9fe6-31cc6018c77d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fa152a3-e2a7-4c0d-9999-eed4c5b5a445", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--623c91d6-1ae3-43b1-9551-df89ababc0ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54673ef9-34c1-4359-be2f-6da0388df869", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--729d6f74-66ba-476c-a97d-75bfc17ad397", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8e294d1-719c-4b15-8c09-3a55c846b81f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bac08e19-3fe6-4e61-bcb8-654a4befb3fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43a2d8bb-8612-494c-a735-3fb8de0453b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9907f00d-d96d-4f6a-b1cc-702e75500894", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.96.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e10b51e1-58af-4e41-8b85-c5b7965e2c61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.237.157.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1e0d6ec-1e9c-475d-a434-645bfa56afd8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.241.43.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1de1fad-f1e9-4390-9efe-0a091ef23828", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.243.24.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74978029-0510-43cd-b27f-7a18bf702db0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.244.172.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad72c0a7-6a78-4e5d-8edb-b255cda4e5bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.246.193.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ddffa84-95cd-4f96-b259-556528b12397", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.27.178.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6de3fa10-dc95-4b1a-908e-b31b5a4c9630", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.30.41.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96a528b1-75af-4542-9661-7ad7fef1dce8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.35.123.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46672ead-2f13-4028-9316-e3afd28566c5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.4.250.0']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79b2f3ad-ce06-4d34-8d1e-3b36ee2e20b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.47.170.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d96e409e-ef03-4837-8eef-7abe375436da", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.63.108.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b98792c-c49c-4ddc-98e0-86bf434597aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.75.71.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bff13c28-5877-4941-8038-3e8fdaf469d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.75.71.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48ef96a6-780f-4952-a144-3dc7a185ddf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.76.88.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c237745-e53d-48ca-b140-714f131865ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.77.246.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28778b69-b5ed-4641-8340-6521e3c62c07", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.88.130.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8913c985-d516-407b-b840-b638c95860d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.9.204.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c4a1569-28ae-41ce-84b3-be4c020e8972", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.93.42.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bb30ea4-4447-440a-9970-41deceb6ad2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.99.3.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54e6f9ab-2004-4c08-93d0-bcb01da1530b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.128.144.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76dae6f4-6046-4279-90e7-2fb65c4f56f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.131.166.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--954de1bb-da22-4abe-8f0e-4f413762f8a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.131.96.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c024719a-ae85-4b48-8c3b-923ae96c14a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.140.148.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fed53361-de9e-4aa8-ab75-505e96e53d33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.140.148.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--affbbd40-b0dd-445a-8490-84556a5ca176", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.140.148.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--483b7881-a33e-45e2-8ab4-e4a720bcc40f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.155.11.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa9693bd-432c-44d5-9bcb-a2fb93ab5139", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.155.119.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd393160-f8bf-4d3b-abc7-a322f464cda3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.155.71.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e5e0393-378b-4901-8c6a-6053d2e61353", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.168.30.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9579b18-4f12-4ba0-912f-6c79a71f9b12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.194.10.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f830432b-58d4-4b19-b615-f9ed5ca76942", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.194.132.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf64fdd7-82dd-4a71-a5c0-1cdc9ad86ad3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.194.147.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0da99aee-5981-4c5f-808e-308bf66b3d6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.194.149.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92d9f28d-4679-48a1-96cf-ea6992521e67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.194.8.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f10badb-1265-470f-8f77-d71bc4af714d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.194.9.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcb2cbbd-f26e-4dc1-8de6-c487bbafa3b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.197.232.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc9078b3-e4be-49cc-b8d4-ef4cdd0acf21", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.210.140.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e07571f-8f8b-478f-a880-8d129e28e36a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.225.143.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35c16b8e-c97e-4e31-8dd2-1dbf3ecee22e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.232.79.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3b4dc21-21ac-4b9e-878f-c2170b9e642d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.236.199.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68c6f2ee-367e-4743-9a19-9434b8e10936", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.236.66.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c2fbb1d-596b-46b7-87af-ab99b48b752c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.236.83.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e15fd08a-51fd-4c3b-97f9-8eb6fbd1f3ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.236.97.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96428db1-8e52-4cc6-b214-058e62e9585b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.237.132.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40478924-85cb-4c7a-abcd-3121a909aea3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.237.156.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4086290b-cf25-40a9-9cf4-5af362bc1f33", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.238.221.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2dc91c8-fbfc-4fa5-a675-ba2309bd92d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.243.35.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31607b4b-e4f9-4502-9dda-33a4b624e129", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.243.35.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e194ffe-3f66-4337-b3ac-d055c4964c0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.243.38.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1462f14a-9aae-400b-81ba-537861bbd590", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.244.79.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c73f8fe4-2015-47d4-8d49-2eebc47f159e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.13.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72c18edc-3cda-4bc4-b22e-37fe66a963b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.136.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94ef9de4-a9d7-44ab-99c4-2cdae9c512c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.197.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0393550a-3c88-4e5c-9983-cf34b268f43f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.22.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d1289d2-2f6b-4876-9c87-7a5388d4a024", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.241.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0877a1fb-f5af-4191-b228-259948aa90ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.250.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7b34ba4-d88c-409f-904a-c966e0bd06cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.37.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef3a8746-a869-4318-89ab-a94c2e0c89ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.77.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45cb43e6-8628-4a02-8e7a-474f9294f134", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.8.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dc456e0-2e54-43b3-96e0-08d655cd55a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.9.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a01e35d-0646-4031-a5d0-0659de6ea385", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.90.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c48b3d6-e5d8-4cb9-b6be-517e01bd6555", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.249.62.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--123958b2-aeed-4029-948b-4d06ac44a17c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.251.181.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee422511-8340-4552-8582-2e75254b7af1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.28.195.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--998d0017-78ff-4380-bad3-d63941c44704", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.43.56.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7004ac8e-85c8-488e-883b-46514dece460", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.112.239.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89ab4b31-eb12-4bdc-84c1-b3eb62328db7", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.225.89.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86bd80d0-0ce3-496f-8738-b293027cfe19", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.30.51.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfd71f15-c8e7-45c0-82fc-5ff141946be3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.96.13.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a015fc75-b8b4-496d-96a5-6a07240a3673", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.0.4.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5977580e-8c1c-4dbd-9521-a9111efb10c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.117.114.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccb21e1c-2740-4017-b562-ca0ecb26c930", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.117.115.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ddd9fd8-41ff-47ff-a353-fc53ba35c210", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.119.165.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88d057d5-07e5-43ed-9432-4de0c6c0c7c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.13.124.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a65427b-9560-4ba9-b6be-fd9435ad3fb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.13.142.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f3894b2-e9b8-47b4-8858-9816365c656e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.13.186.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79be4dc0-5e9d-44b1-a763-70c8e323dd75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.13.239.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61b25826-d71d-43ff-80a6-dc316e29a1f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.13.75.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74ad9178-f912-4245-95c6-94acc2032538", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.196.8.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a9f3582-15c3-491f-81b8-c1cef95fdb6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.227.33.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9571ddf8-77aa-4a6d-8a4f-470c7b954d94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.137.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--999b1346-0788-426e-bce2-4c19f9767735", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.141.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--530824aa-cfbd-45f4-82dd-87d59a8e7ff7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.144.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75abd05b-1333-423a-af76-f1b9c541503e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.144.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29bd3dfa-eb6c-4291-8ee3-3ef1c1b20c88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.154.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16e1b3c0-c70c-4a41-8fa6-3f7a048159c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.169.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3585dde-caa0-4d45-9d49-d90ff62bd6d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.176.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c9f2184-7d32-402c-80f6-b3146bb3002c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.188.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8c1b8d5-01a5-4563-90dd-98ee9c86d427", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.189.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c3f554f-fb48-4cfe-860f-323da8f246ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.77.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a47125b-813f-4de7-a4b9-ee67e40f71d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.148.239.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7cb61f1-5835-4528-ac17-fc7b37d10e5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.100.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--691c7c88-a82e-4eb1-8897-30e713a9fda1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.100.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00b1269a-f4bb-4418-95cb-a903b38fb6ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.101.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edaec7ac-1763-4ce2-8458-9c74298d3bda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.101.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01ac3493-2ebd-41e8-9ac7-9e933d0ee516", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.101.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31b8c45b-8021-4763-b66b-f804bbddd7be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.102.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b016f68-deb4-478d-864e-29b5d29ea24e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d11cd58-171c-4523-bfdc-731e86ba7d86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d616c179-8c55-4cfe-81f5-88a656623e61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9b48a63-8a95-411e-9af4-9ba8c2af00e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5047353e-08bd-45d6-851c-813c7a5c337e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1f5dcfb-d187-4a79-be1a-c4e16ac34341", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.104.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36d93eb5-89dd-40eb-9678-d486caa01f08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.105.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--068e6212-64da-4918-b4fe-b61874c5b93e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.105.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e36242fe-eccc-4ad8-a3a7-9c536bd923fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.105.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bbdab4f-a761-4038-a48c-9077fe20c110", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.106.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af4c6fe5-8c27-49db-bf5d-734973fb84d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.106.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b931d50-6109-473f-935f-0a01ad54f355", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.109.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db722ec3-2900-49e6-9b39-be9ff42bd594", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.109.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4e7102f-b018-455d-90eb-f669ab67ea8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.110.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a7bc64c-0b74-4dff-a3fd-9aa31c04f890", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.110.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b07af48-3d4b-49bc-a997-d8b9486f0032", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.111.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6c0faa0-d29a-4637-96a4-140ed38cfd3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.112.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ae88c7a-9b08-4f6f-9211-b7d93f224ece", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.117.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18a42328-07d7-480b-9ac1-b876a5c15c03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.117.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2a3a4c9-bf81-4af8-aa9f-51538c35cbd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.96.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0037aca6-115f-4df2-96ab-67c29a52a699", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.96.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e170f0b-058b-4de9-b791-368dc8624d40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.96.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af125852-cd41-4787-8b7a-d2b018e5a1cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.97.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44cb3429-d01c-40a0-baf8-654b98411940", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.97.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--159289a8-112a-49d1-a796-155f0d773fc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.97.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52ad3050-d035-4851-8c83-95a1dc620a8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.98.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--756754a2-74b5-4a6b-9bb2-2a120cbb2b3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.98.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18873d1e-482c-49f7-bc80-ba24dd3fc384", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.99.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da64a600-4de6-4802-9be9-ad92b0383230", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.155.56.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4a9fa3d-d71a-4830-b126-2a424e90157b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.170.247.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24530788-617a-4520-b067-bec1824f480b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.170.4.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a41bac35-293d-45df-99e1-0710c7fff72e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.172.128.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edc50519-8977-4cc4-b2fd-06ebfba214aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.172.88.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd230bf6-056e-428d-ada4-ac7d4156447e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.173.122.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ae190fe-6aea-40cc-8314-43ff4d1dea95", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.173.38.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5290692-ce00-4d3c-85bb-9919ac4a7948", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.189.19.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33414f54-9065-48dc-aec0-a88057b3b9b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.189.27.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7819fb73-7253-4a30-afba-663e1642d034", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.189.27.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0208236a-b694-4f2b-8ed0-a0b350c5a1c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.22.49.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0dadfc4-a96b-4b24-8616-ba6452917cdb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.6.164.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14497694-a37e-4ca1-8fac-e8f5de5a6984", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.6.164.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c96b2208-209a-468c-a63a-8ab854c3b4b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.6.182.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe76b897-5719-4c9e-bdb9-8b57c4aee618", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.160.197.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--754ea8d1-be1e-4748-9cc4-990fdd529277", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.165.95.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42fd4366-57b8-4199-b11a-b63e639a5bb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.181.22.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d81a61e-de96-4bb4-9510-4cf25ac61048", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.181.95.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82244c52-d12d-47f5-991c-1518d93e4c3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.181.96.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a240ec9-1420-4795-8bb6-b3facb54f8ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.181.97.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--770b72b4-33c1-49bd-9c48-b2837af9978e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90b9fc3d-68b7-48a4-840a-5961c9fb2bad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4466070-a675-43c2-ab27-65e5b849d0bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a88d91e3-45f7-4c77-8c6a-e8361a3b1d72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72d30f0b-a6e0-4c7c-a9e4-0af48642904a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81687ed3-670c-4a0d-b956-02a21bbfeb6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9a67228-1b05-4072-95cf-a9040e449431", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89331dcd-5f6e-4e19-8527-fcd7291b22e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92f74196-426a-4a1c-b6d5-f8bcaa779796", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a204055d-64d0-4c03-b504-99aee43856ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a50235f2-f619-4b2c-9ed8-224be62a8335", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dfd54d0-213f-482f-9796-3b3d8c629817", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53948bf8-df06-46b5-8233-d25007b6da6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--757b998f-ed2d-4d04-906c-afb65744eb6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6366b526-2887-41ea-a87f-dbfc4e090a2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaed296a-4ef2-4abc-be78-5709a9745f63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--502a635c-c52c-4ecb-8faf-addef8419a86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9bcf88e-7370-4d6e-917b-16e142516a44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00a4a975-0c49-4e97-be8b-75953dec3920", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--653c0639-1877-4d0f-b88b-221794f0cdcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74e86635-d1f5-4eb8-aa09-68e2faa43338", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.123.117.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38ff0b10-79ea-4be3-8e25-c1a8cae7e711", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.123.117.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5497a78-6148-4038-9726-36ea352cba32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.123.117.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55f66e6d-5177-44d0-a537-3758d5263d6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.123.117.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fee2262-2bc2-4d6d-844f-0f3d6cde031f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.123.117.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5777742d-6cc8-479d-8430-21cac844d73d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.123.117.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41c0cde8-2463-42a2-b5ae-e70b289a2e49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.123.117.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72029306-bb60-4530-9142-9377e6d51203", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.151.252.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a49ed38e-ef46-40ca-aa05-c7277474fb0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.156.174.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e938f2c8-ed27-4ba3-a98a-aac9541b4116", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.175.100.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bef5c805-79d9-49e3-80f1-82b7963707e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.195.108.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13226e11-e11d-40da-a37f-324c12358a2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.228.228.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--958916ae-91e3-488d-befe-65d183249877", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.236.86.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f6d15ad-345d-43b3-9e24-1b601f1d9dcc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.245.132.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--501f00b4-5847-4bb8-8af7-4e9737d61586", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.245.172.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f7056b3-0c40-4ab5-86b6-7fe3c47dfd3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.28.154.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e75e54d-bd87-486a-aebc-df1dc16a1020", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.94.87.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f4b1cce-339e-45e1-8def-848b1f7af986", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.10.176.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4a7b5c5-8c38-40b5-b665-49fff17196d0", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.35.80.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45924ca2-56d7-42a1-8399-ab151dcbec09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.78.136.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23f5db63-f14e-4efd-ac18-a18a2532ba35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.83.4.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ecf216d-49ad-43d6-852e-d0d529a70c81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.123.41.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d6c1d12-293c-443e-b454-6dabb65211e4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.26.6.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37b605a9-1144-4d0f-a82e-136ee1c9244b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.53.147.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78c6cc98-6e54-4063-ba34-1b66865c2bae", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.53.8.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edc602ca-6421-4195-a527-6fa4360b1aac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.70.1.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e758c31-435d-4872-b56b-90a6900dfeeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.74.134.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f49b2ffc-b877-4761-b66c-38900907fe1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.74.57.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--368b6598-7f7b-4615-851d-59aca6073198", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.8.44.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04ba0a4d-280b-4d21-b05d-56e1d63748c2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.219.151.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae9108b9-08e2-4204-b4be-fc1c86be34c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.46.213.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bd4b68f-adc8-4f0e-abe6-dfd6769b756e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.78.1.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27a6ae6c-3c8e-4dce-9af1-2dd6c785dd59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.95.232.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88ab8cb6-c37b-48fb-9e01-a756aa21e070", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.125.55.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5747b993-ccad-49dd-8fc8-d3fa4c7b9387", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.141.70.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be22b1fe-0881-4b4c-9e7d-44603862263d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.161.222.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f669563a-4ccc-43c3-9fc3-e1aa76d316f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.185.82.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8c13082-ff62-465c-88d8-fc7215ca43c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.200.71.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a44d7fcb-9e4d-4ee7-82c5-45c3995eb583", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.221.43.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6eaf422-d1f8-4a4c-908b-1f2e13ba94f8", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.229.188.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbc4c643-b564-483a-b8eb-139db5d8f32f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.249.110.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae32fb60-5be7-4517-9fd3-4000b1f5d45c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.30.190.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71cb1222-0cee-47e6-a4b5-0f951384306e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.31.107.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c5dbd1f-8c3a-4ef4-9648-c60e83b857eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.10.126.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--070e8fa9-f998-4f19-b4fe-7004b3b61005", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.133.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a78d1827-2337-442e-a56f-d1b89119ab9d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a821c2e7-b9b7-4598-85d9-891040ba873c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27d2f3a3-a7be-4659-9968-36f83553ea5c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df7cfb3e-8132-4734-9a7a-574ad6a27f78", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.142.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cd68253-bdc3-4681-84ec-15c59610233e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c0fa6f7-2805-4616-8996-154038246e54", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fdc4abd-421e-43ab-a169-423e5a8492f1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30467fb1-9078-4ff7-85be-b7716fa8a76e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.152.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1599398f-7dbb-4dc4-99b3-5189dd75c4e0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.153.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0af9a01-23bb-4113-93b1-d5a35ee6d7ec", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff7c2804-7f50-4fe7-ba21-be4a0928de37", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a7b0818-b53d-4965-ae47-b1a6a4d773ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.159.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7174df1b-9039-4638-a6bd-419d82d27d8d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.216.2.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3218061-9381-4e96-b5ea-a2a1b0d2d6e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.219.184.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c175db37-3646-4263-9527-b33db3578b8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.220.238.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffa9970a-1514-484f-9d5c-2802b1495362", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.220.75.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92d33d85-5c7b-4b1f-8b42-7056d07545f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.237.197.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--042101ef-fd44-4fab-a36d-7cb02a322b93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.246.45.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebe66c4b-ea73-46f2-a987-d488c7382579", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.35.11.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9a17cdb-4ad6-4cc2-95ea-ab63d26b92fa", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.35.55.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e960aff9-07de-4106-a894-ca2d8aa81255", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.55.129.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb9456cf-81ac-43ce-ab96-ee6bbad8fca4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.55.236.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4edde30-766f-48da-accc-edd996910045", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.97.191.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a69ac5d-09eb-414f-93dc-dd81e756fc2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.179.102.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50ba40dd-2990-4dbc-b8c7-6a3e0749fe99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.181.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fdae452-dd69-4a26-a7f2-3d16d98ea126", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.52.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--531aabac-047a-42ed-8955-972b7ed300ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.92.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b1dab0a-491d-4046-88d5-cb6baa16e651", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.209.110.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--082e6b31-4f3c-40b5-bf8b-21dae6bbd6a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.210.49.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a73febc-b88b-4e09-96fd-4ff0a29ccb7d", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.214.115.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f76b33e0-caf4-4159-a9e8-d691ffc6632f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.231.78.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--039be80c-aa3e-4541-a63d-cc5f2647523d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.68.208.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c1bbe71-dc92-44ae-af35-02616761847c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.84.76.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb72f20c-6cb7-482d-972e-b16e8ef91b8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.153.81.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd6aa648-4a30-4719-af7e-a8a93c5f22e0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f008d03-0398-4893-b500-11ad0f2a6151", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1527d6d9-7c07-453f-9f1a-472b64b00681", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd48b35d-4e04-460c-afe1-7f9febc7eca8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.203.16.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--076f9c53-63d5-41a1-9293-23954c398150", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.246.41.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d97f57eb-3eb2-42e1-aea8-b741f555401d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.26.5.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af85d166-a463-4569-9399-1cc76d5f467b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.34.14.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--750cbdd1-aa93-49dc-8bb2-89ec43c6e8fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.54.114.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02679cad-5486-4fa4-8b30-9f1910b505bc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.76.33.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50a1de17-b44c-46ef-a5cb-a508a69ae662", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.99.170.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a24d31eb-0fa5-4d25-b616-46f86307cbda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.144.13.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f88804f2-7ad1-4fb8-9df4-e129c003c79d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.205.83.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1666bfb7-a4a1-4c50-8a1b-f8bed57b6802", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.39.41.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a64cbd5-9694-4c6b-8dfe-246c448175d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.41.181.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7988ac11-611a-4c41-9834-a32214cc51ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.80.234.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d732aaf-76a3-4e20-a2a1-c6e3fce5d891", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.85.18.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fb29fd9-4acd-4a73-a73a-5e89a3254cde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.89.185.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b807ef26-953d-48bb-abe6-38957f560a73", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.93.119.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbb74262-09b7-4f07-897a-fdfd3fa8fd79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.122.147.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a95e4d16-4001-4056-9edd-fe847d78218f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.145.104.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5af4f611-2db0-4bae-b860-43430d096525", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.145.164.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e79ee857-d221-4e37-9ff3-1994c1426259", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.174.116.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c25b49c-068e-4975-9e19-ef687bd7fb2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.179.102.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bebb4ee0-fa41-4511-997d-af79b36ee03e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.32.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55ab126b-86aa-4c45-823b-c87b48b18b0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.32.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2048edc6-580f-4d91-943c-9b062afe09b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.32.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4b8e869-9e8b-45d2-96db-b3d50296f04d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.33.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1e995f9-9942-4557-9122-989468aa4892", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.36.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9eeb0269-fd7d-4bbb-aa95-805906bccedb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.36.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec1267a6-20c4-40a8-b031-27cb021ed812", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.38.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffb4a397-82ae-4bed-9609-e1226c29b503", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.39.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aba34986-5818-4462-be5b-dffaaad67fe6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.40.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba7b45da-4d3c-47ae-92bc-3662816c5759", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.40.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28f71a58-93b4-4b6e-a3ec-ba5cc249e9b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.44.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f053bb6-6a27-4ee0-a80b-dd6f3d05b735", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.44.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08f82ee4-6577-4956-b6ed-007c6a7c7909", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.45.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbab8607-a939-4761-a30b-758d5fdc3ee0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.47.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f2857a9-7ba7-43ee-b1d6-ce3a9cfb1cd9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.47.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f08b7f9a-3dc7-4f26-99a0-ead566a60f8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.56.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dba53137-2e06-4315-9f4c-c376d2708640", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.56.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4affa5e-da79-4207-903b-0389e8cb8820", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.56.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4042cd5c-cfe8-4ee1-91ce-b1a87540d192", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.57.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--796f94a9-0993-4e2b-b1e1-1ddc06978b8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.57.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51958ac3-65a2-4988-8dd8-80345a5b4a4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.57.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efd5eea3-ce52-4815-99ac-16075ab3bd72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.58.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd801cd4-c69b-45af-8e76-2c5459b8eecc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.58.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--488f5151-405a-43b2-9e78-a836162921e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.59.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c5fc086-a37b-45f2-ba64-31b83f484b43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.59.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da862c4e-655b-4cb0-8fe2-7487a9e70e03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.59.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0a31e5f-4c4d-49e7-845a-67f0ef269915", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.59.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--218b0f12-5cff-46d7-a4da-0c88a0ccf925", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.59.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f48b1a94-c867-44e5-97ad-3803bb5a87d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.64.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--699eebe0-5ed1-4ce9-b4d4-50284ce100c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.64.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5a76585-51d7-48ac-a23b-736088bbd5d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.64.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbb3ca67-a9ca-4a4e-bfb4-5e89925f6fec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.65.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70a3a250-6407-4435-8d01-dc3938652908", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.65.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--943f58b5-8083-473c-92ac-371803d8ba4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.65.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be5c31e0-68b4-44c5-a644-4f3d96f91753", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.65.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf334130-975a-4563-868d-e0b415eeb9f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.69.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92c8abd2-7175-4807-aeea-dc85ecd7845f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.77.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82306891-9962-461f-a301-aa97cb255469", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.77.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d7e4ba2-f277-42b8-a512-55d1ce4427b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.77.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94511da3-1dec-4ddb-93fa-e14d01a1192f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.228.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b13020a9-22b2-46dc-904a-2a463086c0d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.234.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b7f9951-e87d-4709-a421-cbb89381221a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.234.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c024da64-7140-45fc-a645-a1d1a36e48b5", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH, TELNET activity. Sensors: digitaloceanlondon, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.235.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrparis", "protocol:portscan", "protocol:ssh", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73a1a5e5-60eb-471f-9ff3-e586460a4870", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.235.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc4e822f-1b57-4a92-9b03-4f5059fc1edf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.236.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66f7cc9d-a1eb-4c24-85d2-db59800418d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.249.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eafa8bf2-ac16-44f1-8dd0-6e41be533495", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.250.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a22ea06-ee94-4787-a914-ac2577b6a523", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.250.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e59e8f7-12e8-4a2e-81f6-120ad8ce4f3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.250.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--049dbaa6-6f34-46db-880f-ccb145a2875b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.250.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01a537c1-bc77-420f-9e02-51c6135c548f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.250.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c51cb02-595a-4954-9642-abfb6539f1d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e4bfb4c-e67f-454c-b562-6fbf4a98737c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cebf61f-3604-4a18-95cd-5c097deafa20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a12cd545-9897-44bc-8e46-2dccf60f0fe2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7abacb77-3fda-49f8-abf0-83626afd0dbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.196.16.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db97457c-db48-4b24-a958-f2a5385e6774", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.212.120.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85af1990-d495-4414-acbd-f79d714208a1", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.233.243.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff3890e2-3ece-4a52-bdf7-20f798b261e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.104.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94f00ebb-7cb4-4f1f-b477-aa904c1db220", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.104.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3e33998-571f-447d-b0c2-feba9bc6968e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.105.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a24c0f0c-0154-460b-9ed5-987a895adced", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.105.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--426cd3fe-3541-4c6e-9a97-8c7b5aaa8679", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.105.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--beb8904c-8ac9-4e63-bd2f-7fd6b6c222e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.109.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2a26239-72e6-4602-9fb6-b0e6edee011b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.37.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f047b1d6-717a-49cb-8ae8-9d4ed533bed1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.38.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a84c111a-c1f0-4f5a-a3c2-33c4fdf84010", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.37.210.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--639c298b-8998-4285-b205-91c7d4c0dc1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.41.137.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--000c5034-2681-49ff-9a2e-c8503b74dab3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.69.6.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9451b4ea-ef43-4dab-a95f-3cad4a3374b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.70.178.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--097681b5-366d-4417-a943-aa7357d97c7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.71.196.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfc95520-3edc-48af-a164-7a3f1d89519b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.71.38.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--617c8079-f261-4d85-a14f-d6fdb3fca535", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.79.130.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4021c29-a62d-4f35-b2cd-f905e8ce5715", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.148.49.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc46dc68-43e5-43ef-a825-d92df6a8dfba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.152.228.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8af65899-368d-4688-a9cf-f67fb675f782", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.160.215.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06d822b2-c40b-4569-a5c3-e6d78b807639", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.167.206.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--658c8738-ee23-46b4-a72b-8c738a8ab547", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.205.179.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4d6ece5-db2a-41c8-867a-c9693a228c97", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.246.15.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97d1535b-1c1e-4220-8342-e4bc02c504a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.253.93.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7ade04c-5914-4fac-b159-0a974246a775", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.28.107.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8faf8683-6c55-4f79-b3f1-c8fd7901e7ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.28.111.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef04328e-e0ec-4952-9461-1a06cb7b851b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.28.177.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87147bd0-635f-4a2b-87d2-73ee8b9b4491", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.47.136.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e01aa818-0f71-4a0f-9ecc-10f83ce2338b", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.64.84.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6630628-1436-44d2-af29-93f3bcfb7201", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.70.93.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d6587a7-c7e7-42f8-8c62-8b1f56dd1901", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.96.242.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6acfb0c9-f51e-47e2-905c-8a724b1a1d1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '12.106.187.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca58123c-f585-4281-87c5-b01869bb16ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.241.79.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5462a71-a855-4c6a-905e-7416858cb9f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.25.107.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d596824-51d5-48b5-89c5-8eec5b77d23c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.32.92.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d14e277c-7bab-44fe-b0da-b5ffd4ad3cbb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.111.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38fe9c0a-eb4b-4f1e-b4ab-97b82b1138c5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.175.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb99627f-f0da-45f7-87fd-6116979f51e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.71.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17c7fad1-d995-477e-9fc8-015132d9085b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.76.202.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a9722aa-6b54-42a5-98a9-0580b079a5d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.77.153.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de52069c-3af2-46e9-bbe7-96a442546c0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.144.201.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8146ee3a-894d-4bb3-9f04-844ddd67ea37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.163.66.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--575d6fa4-13b2-46ee-b1b1-87ddc7fd694b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.171.125.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--785ca154-c522-4982-b302-f0a7f17f51da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.197.0.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fda589f-2016-4eec-8d03-2edd936a88ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.197.14.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76754b5b-0814-449f-bc11-ff0c5dcebbc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.197.9.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f440b65c-5985-4650-b5f8-a1ed85afcd27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.202.148.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f17a072-79f3-4119-984c-e8ccf96de6bf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.29.4.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ca61669-0a39-46d0-80cf-343b15016821", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.29.4.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4071f0e4-a58e-4657-a692-2cbd291cf278", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.29.84.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cbfc01d-db58-4383-82a8-cafdb4c4e2af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.29.84.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c91e585-b8e7-4922-96bd-09c4273f5534", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.36.219.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--897e1970-cb0f-4b8d-b53e-80f8b34c09af", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.36.80.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea3a43b8-4a96-4796-bf0c-ca388e5a1509", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.43.162.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bc55a73-505f-4240-a184-deda86d68976", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.57.226.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5795aede-d28b-4b6c-aa56-8b6143865389", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.121.98.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d58f754-749c-4de8-a363-1406350af737", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.176.122.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ad2ec18-a01e-4bdc-a0fc-f986c41dc3a5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.189.240.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0153087-8fdd-470a-8b14-3080b2b20ca4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.235.177.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d42e3127-5a51-42f6-a331-12a76fb07ece", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.243.10.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b37564ab-6f33-47a8-addd-820ba178ca00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.45.17.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79e60524-c905-4eff-b659-40e3985bceed", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.51.236.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72a99dc2-b779-4e35-839b-c82706e27014", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.52.57.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd220c57-8ae0-41a4-a2fc-28b083c108a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.52.75.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43519c99-d829-49b3-8afd-6eefd77b94c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.96.28.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdec1068-e690-4981-8ee8-92f3ad1e67d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.97.136.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb34a044-8ec6-4618-87c9-a3546f142254", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.16.178.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1756735-2074-401a-a75b-a379afa92afc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.160.175.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f907948-1960-4142-a89e-cd3a9abe2c38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.160.223.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94c27c88-f899-45b3-8714-714efc9ff708", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.160.223.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a141df88-8140-4b48-9736-b32ed384435c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.172.82.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b73402a3-6989-4745-b983-35a08ba56891", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.20.12.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6502a842-f4f3-4666-b9b0-dcededdcdae2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.20.98.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47bb9f96-729e-4757-92fa-75760ab66c0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.207.199.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa8eb8f4-13c8-4070-9ac1-3f0b6680e1a8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.207.65.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7b372ae-69a0-4e1a-b5e4-c704e856e7b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.245.85.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14feb005-a538-4f13-bd26-ac5d36a3767d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.245.97.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6951bd9-68db-4298-8e12-ae632aac1720", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.252.174.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--790aa396-ff0e-4cbe-8eb0-c7aedf30042a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.30.240.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffbc3f2c-bb30-4ab0-ac21-0cbbec977a67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.31.18.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e904440-6558-4f86-b350-d1280929c429", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.200.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eade7fa0-67d8-4ea9-9cfb-b1e3903bdae6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.205.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ece89926-6c6d-4ab5-81d4-b9819e50f25b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.207.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0bbbb83-521f-4bfc-bc17-2d5fee98dd13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.209.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a48ed720-49e0-4aaf-8e00-cbe84128b286", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.210.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--807b710a-1ae6-4f8d-a095-2815da9a1b6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.213.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5762975c-0ebd-419e-8d6a-bac6a44a8bbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.213.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0a5389e-0ce1-409b-b632-42bd8106530a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.213.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--917b63cc-ca75-4a16-b70e-14fc457bf1b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.106.67.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--858f9926-ad6b-4bd3-b5b8-6a48425c9d0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.117.193.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--143c1c88-35f1-4055-8d03-808bc06e950e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.156.200.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc14057f-8f75-4785-896b-9d87c66f4ed6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.189.239.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae1a40fc-2619-4686-ab7e-358e491ff226", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.198.131.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9461d2d3-57a4-4051-8ee1-1d7f36eacd4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.198.132.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cab3b1d9-720f-43a6-8493-1257f563ec1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.221.217.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d75c8e4-b6ec-4da3-9be9-8e101f1dff71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.222.97.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd056346-1f19-4806-8c50-fe9846c613ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.223.165.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9476b91f-3afc-4da5-ac2f-92b662fd0974", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.226.216.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adacc8e5-8824-4490-aa52-481605ae65ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.227.31.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0653ed81-c48a-4176-9be8-56a229d19e59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.89.90.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--973d784d-908a-4aa5-bb28-7147bee3e929", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.89.90.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a654c36-d58d-4683-8bfc-fa7aa6b0ab0a", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.104.32.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e92192cd-85d7-43c9-8343-69fe1dbbcfa2", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.118.108.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dc370ca-39d1-4df6-ae77-2f4320cd5c97", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.119.224.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32b161e1-cbe9-493b-b8c6-878db50d7399", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.122.26.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc909233-bb03-47bd-a9a2-73fdbeb1226d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.124.42.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de38f487-229d-48b8-abb7-490b18b1e1d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.16.207.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3956d957-0db1-48ab-94c2-c9056dbbbcec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.186.122.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3262eb8b-1a2f-4234-b3bb-3ea8353a739e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.224.20.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--270a3f01-d491-4ba8-8139-2790412a0bc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.228.25.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--706538af-850b-4e1f-994b-54dcf4137318", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.25.224.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--668a2a42-15bc-4754-b708-44fe41814cb6", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.25.228.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60fe1820-1ba0-40fe-9092-aa5b20e4d002", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.25.229.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed209121-219e-4fb3-803f-79c6e508d51d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.25.229.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0f133df-5765-48c3-bab1-cdd8b8e3757a", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.25.232.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41b4c3ef-dc8b-4ab2-ac63-524e0682c315", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.25.234.0']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae1d2ee3-e1e8-4d57-bd2b-6d581601d605", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.25.239.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79c798a0-4dda-47b1-9085-648ed0ad8d31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.91.160.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f708d3d8-5694-4227-bf0e-bb071e3bebf8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '126.209.52.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad596ed6-4269-4812-ac87-8f2c92cd4153", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '127.0.0.1']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbe88bac-25e8-4710-bc9f-a1cdb5b7d829", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.0.104.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--795f7539-4df0-4cb9-9a5a-b67960ed06ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.0.104.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0889a3d-afe8-47d1-b8b2-f1f7975e8f87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.1.34.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37e691bf-acd8-4e73-bb10-1dad19f34496", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.1.44.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2a9dc64-596b-40bd-b7d2-2fb320bd506b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.1.46.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72cccae2-a1d1-4331-9b49-aa168b1875c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.106.221.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db612617-3775-4935-b342-dedbd5c72c7c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.225.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0dc0c51-ba38-407f-a72c-b1b934ce9902", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.226.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--365499d8-b1c8-4f67-81f0-0a34e0ca3f7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.227.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e00a4a6-c2ec-4cfa-a511-e54d623ff7bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.229.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ede9d68a-73a9-47e6-89a3-ea94aeb5f2bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.232.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9efa72fe-7774-451a-9478-eaf8ae04d07a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.233.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2497c0e9-f2b3-4b88-b79f-90a418900d32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.237.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc3bdc34-c3b9-423d-8f21-fec226d72410", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.237.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--587356f3-50b5-4c2f-baf5-f5400fe02652", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.237.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc70ad7b-0a37-4631-af57-9ea1d9cf5c7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.239.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--788f97ad-c6a2-42ea-81c2-a95b3ef361fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.239.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64b828a7-e1a7-4aa2-980f-f774708cfd41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.199.225.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7899e8f-dc0b-494d-8b44-5314c245a928", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.199.244.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--581738fb-0e1b-4610-bf9c-0c80a67e4775", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.199.255.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1c56db8-2f67-4933-881d-ed181a37d9ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.201.54.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--271b6d1f-407d-4051-9309-9e44c340c534", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.203.200.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd05c17e-7361-474d-a1af-18896892882a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.203.202.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47dcb875-df06-487e-ab5a-c8153838f969", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.203.204.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b222f73b-23ca-4350-8c37-09c9b76ded1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.79.3.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3fac308-0592-4361-abe6-f67fc11bf64b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.121.54.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--528e8384-0c84-4af1-8221-017c07166279", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.121.89.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5670bf60-2942-4691-bafc-7cfe9be6da55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.213.106.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6429ad8-7df7-4fca-afc1-09fe1b679bda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.213.117.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7cf3c0c-18ff-4b2c-8806-b2e900a6f2c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.222.141.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f9f1eb6-da92-4fe3-8610-646a5477cbf2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.226.94.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5ff5721-8ecb-4a15-91fb-452a7e15d53c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.232.165.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bde576fb-8672-4366-ad4e-b5cc4873b650", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.218.167.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b1a6fd4-d499-4a1b-a64c-f133f73937d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.221.151.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0381cbb7-87ca-4936-a5d1-421284cb963d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.221.239.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c6a4292-875c-407d-8ffc-36b45f5d6da7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.222.129.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90f0d269-1b72-4ec1-948c-efb1d02f76da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.222.169.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--903d599f-db02-42c5-89c5-755eaa03c2d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.222.238.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cc5e1ca-f558-46ec-82f9-2d25621ea5d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.222.29.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe483bda-b4be-44a1-99c3-70a6f8c2ffd3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.67.236.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a59ff32-9508-438b-83d4-31949c31459b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.86.113.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0f7148a-cf57-46d6-9bfd-b62c18e27096", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.86.113.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e29a71cf-7a6b-4256-b7c5-01660a471566", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.86.115.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d1b5b76-86b7-411e-8cdd-d38feba808fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.86.116.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84a3fede-a96f-4314-8913-d9cc7df7955a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.86.117.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17c47d40-439c-444c-851f-0655b455396d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.124.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7ae533d-1ab3-4533-9d81-143a09821cd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.124.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59051225-2da5-4c4b-8eeb-264fe3584b15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.124.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67a7988c-474d-4502-85ce-f95f53ed07a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.124.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03624803-e9a7-4328-ba6a-0b23b2e618f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0e779a5-c00e-4989-acd9-e5d34a0dd489", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b9d5542-e37c-46d5-8270-1de86846b288", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--922fc56c-9897-417b-ace3-8d30b22fb0b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--677fada3-e0e1-4fd2-8e41-0aa029c04ae6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d44b24f-9157-4c8b-afc8-930c718a78af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.255']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5694bd2-20b8-4ef5-b34e-e92fabe8ca0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce3985c3-65cd-419e-8467-8594097043cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.180.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f902fdf-c2e1-4474-b58c-b43e02078055", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.180.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2e106ee-b78b-44fa-b6eb-c7e9f67cc673", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.180.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca82629b-4861-47d8-b6ac-475fff280d90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.182.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdf33235-444b-4ab2-959e-71988b724347", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.131.161.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f973aa8b-1043-47cb-9d22-a747b32a3b6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.131.161.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4a44867-417e-4758-8fb8-ec84f65d1345", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.185.222.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67378246-1ccf-4c01-96b7-8f67530795eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.185.239.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa0d9360-d232-4bce-9ce2-e261acb83dfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.49.181.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59e576a5-8280-41b5-99c6-85bf59b4167f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.100.254.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90bbeb2c-0907-42f9-94fa-130e95f7be5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.222.232.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4911648b-8cc8-4e3a-b486-b81db4acbc46", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '132.145.213.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54bcd071-7161-457f-b8b2-1ea3c8d44ae3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '132.196.42.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f77215e-c6d4-4021-beeb-f34c088fb6e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '132.243.25.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d2012ab-c281-4bf2-8921-7c1b1dff9088", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.118.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f7579e6-2ffc-48e9-8cf8-8fe86e021719", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.56.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3c153f7-5e31-4193-91e8-ecef5ac4d545", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.64.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec8a304d-c2ad-4a06-888b-407e77f53631", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.76.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22b156af-036f-4c31-8b9f-b7d351e9d3bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.83.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0589ec82-820a-47d9-84ac-dc4bb3ab315e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.199.144.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e574a104-f691-47ed-8c3e-8e30079823ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.199.146.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15085f59-29d5-49d7-9235-26d914109ce4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.199.156.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d424e56f-1e1d-4f55-acd2-ea126a685b50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.199.175.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c49d44f-82b3-49d9-86ef-88c7b22150b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.199.211.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bae07be3-70bd-467e-ad3e-250b8119c9a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.199.211.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06e8337b-11fb-48d1-ac21-d48d55a02dbb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.199.215.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ade423f6-e501-455d-bdbc-3d730b6bee1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.199.216.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97c7f52c-7911-421d-9607-c68156b11bfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.199.224.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a2e3344-641e-4445-82d2-cd60744baf5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.199.236.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ea21867-1f9c-4298-8276-fc7f9bab46da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.112.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54a46306-59a1-420f-9675-c6465678a6d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.2.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--544d78d2-1434-4ee0-a81d-83506c27942a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.203.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6be0593a-b7ce-40a0-9901-270117828953", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.71.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dce7bd1c-f4ee-47c4-b824-a16bef9ce10a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.33.66.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68051773-fcf9-4ecb-be0b-f45e9f6e6c83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.33.73.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--793364a3-3672-4d89-9f0d-9b9fb004a3f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.33.73.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9afdef08-e071-4ba7-8799-ffde8a07cf26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.106.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17a65a17-7461-47a9-93fb-3d9fbf0ec096", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.112.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76974594-73d8-47ea-be63-f4224d1fad70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.112.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--692e05df-0c5f-46a8-bb8d-1e3e287f1668", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.88.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f310ab5-bf8d-49be-86f0-fef1e91c152b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.89.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2732fb8-2f07-4bff-a030-4184f0f8b8bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.89.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b421131-5cac-4945-9889-48fc95d853b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.89.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2b62a77-d216-4db9-852c-b4558b9bebdc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.89.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efacafbd-277e-49b0-bf51-f0362d798903", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.96.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8908b58f-6597-46b9-8d1a-5419de2f7436", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.148.33.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df20095c-9698-47f3-88cb-063df331d2cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.222.40.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81435ce9-a49b-455a-b51b-3b43bb8bec71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.233.112.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3a24a20-4b79-4a2b-959c-e59e57bc1a70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.233.112.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d52a932a-3504-4fcb-9ceb-1c29db25b3d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.233.96.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d7823e2-514d-448f-a1b7-d852b5aefc42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.122.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--558506b2-6d1c-434e-819f-8b13740118fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.123.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7785c95-4592-4b2a-9441-b487acb7c983", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.123.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d685254e-30c4-40d6-b784-b82756d343e0", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.124.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63904afe-63a0-4ad3-a9b1-2d86a33137ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.124.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c143481-0a61-4183-b4d7-0ed19adf5bb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5df7bb7-2113-4503-93b6-a58a5ab20b31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35e11d0e-4ffc-45ae-9966-8d0c6095606b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ceb27dd1-c3c2-4427-b1fd-5229b07d56b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ce4f53b-a930-4ee0-88d0-1b690e85b65f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b63e726e-5be5-41e1-9a93-20ee062ee9ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f769483-49e2-4ffd-ad17-ffb91cb57ec7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--372f28c0-9d7e-4968-ac4a-dd93104687a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51e5086e-0408-4e5f-b9a1-c8a5bd01a5a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b89f24e8-0c40-4fa3-b464-ed9bea98e0fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a39b63d-92ba-47d9-9396-6d223bdf8b89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eabafe21-b0d4-4510-9a19-f7f2c653233c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--440e3530-a305-41ff-af4e-daa7a8d46f92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--999f5025-7804-47dc-a638-229b8b3d11ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98acbb63-e288-4a49-885e-fff17d549716", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b591bbac-8364-414c-b15a-19a4546bcd8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1437612-8e1f-4419-803f-cead15e44f0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b618e8a6-babc-4602-a375-8abd9e81947c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b14bc9d3-f8ba-4803-bbfd-667823f3321b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cefd9ec-5e40-46a5-9674-8a777f022a4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--405a6d44-4817-46a0-89a5-2516fc095db1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c004daf-cde9-4085-9999-ac50bd80409f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08af8f49-2868-45c5-bb99-727c185220d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2f66b13-2924-4516-bfca-30518b61d98f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bc119d9-fffc-4336-8a2e-386293682b92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23760baa-7e06-4c5a-b319-6c5c52e58f89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--775e07c5-3d4b-4bac-b661-f00fcf734833", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fdd9631-7535-4e7e-ada8-9d16397336db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c96dcbbf-1497-4dbf-8f74-8a76825752d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11443e0f-4e9b-4aa9-99c3-3e5b2cc3732e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13f65610-c6b8-44d1-9787-8106a2ec4a81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f14e594-d6d4-4b33-813e-9c93c6f5dd9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f03158dc-05b5-48d0-8722-137924e77efe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47449f2d-1c3c-412a-b50c-5b315e28cd15", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.107.189.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3d25297-3ce2-4c5e-9811-79dd14937822", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.248.247.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05b55604-589b-4eed-8969-46d2fce6340d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.38.55.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc57cc25-9f2b-4ba0-95be-a044c3bcb737", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.56.64.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--746e2419-2034-4a31-9cfa-a97a02a22f0a", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.131.219.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ff090d0-63a4-4d4f-b1ef-5d48a1cb92c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.117.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddee31d6-08a6-4cc3-902a-1794df54d743", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.169.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4b01da3-3725-4af5-ba92-f62a36a98443", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.186.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36e5988c-889b-42a4-b807-61aad32d2ff8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.204.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbcf88b7-da40-4a65-8ae0-7766be100a73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.225.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6b8ed4b-3462-4cf2-9bed-7f06fbf11f7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.226.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4360140-8a69-45a4-9362-2cce4eee3a38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.226.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a50352e1-8209-40c3-aa3b-c2539d2ce5c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.34.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b3d1c0c-7aaf-4a15-a5d2-7e74ddb7ac3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.36.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c98dc35-dd0b-457a-80eb-8b036de1fae3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.44.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d8ba945-0fd3-4adf-870c-525aef3dd5bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.47.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9603dfc6-4dd9-46f0-8810-5b960172b237", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.95.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2caa1790-e0c3-431d-9add-0596f8a60dbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.59.54.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2a09342-541b-4e37-bb87-732261017995", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.122.190.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bce4f091-53c3-44d9-99a8-4e411498bfe1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.124.60.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddf71db1-a279-435d-9db5-eaa1d867b0d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.141.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e27e5b37-0b47-432a-825a-64583686f47e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.15.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4012c79-6f49-4254-9467-9a2b3936ab17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.15.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--397b3591-d96a-4623-b5ec-f6e60943360b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.158.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7aa331bf-5d6d-4de4-8a6d-a5af35120797", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.173.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55a4b11b-ff81-42dc-824e-774568c9a342", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.210.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2debfa96-0691-4992-9d38-e75d22dc138e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.218.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a3c29da-fe8b-47bf-82c8-8be2a68e0637", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.38.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f75bc11-fed5-4871-a950-99240adba3a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.4.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--081d545a-6d4d-46b6-ba66-d3c30666b7e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.87.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7d3c75a-1d67-458d-aacf-fd3693472029", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.92.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7de300e7-756b-4b88-8ec0-4aa275492f0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.95.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d750180-88f3-40f0-999e-c7f73c9d7e08", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.2.102.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2f386c8-445f-4fb2-8a72-46ca6c99f4ea", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.246.253.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cce37c30-1394-49d8-a4ef-ba81514962bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.36.20.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32246fab-826a-466b-9be4-1aed511e2aec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.36.21.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--465f4be2-1964-49ed-9fcd-bbdaaa02b5f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.143.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46f1442a-dc12-4670-aaff-927816fbd9e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.167.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f776f47-4e06-4b50-9d02-7555cc8351c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.182.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24877968-a15f-4c66-9837-c4ae87c4fc44", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.243.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b09d55ce-3682-4dd2-b100-ce6aec72a3b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.25.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1abc629b-7bea-4cfe-89df-92eee63f830f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.252.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06dc2465-1427-4a04-b0d8-89df666e6732", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.65.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29688534-a129-4d73-ad9b-3932badcef78", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.82.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f78a5b8-8f1e-496b-bab2-2a3b2c19c72b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.84.54.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8d4acb2-eeca-4cb9-b3a8-00e03b36981b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.91.107.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b210dd9d-31ee-42e2-912a-ecd0328958e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.91.109.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adc8be3f-83c7-437a-bd8e-2b1b412c4811", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.235.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--576920c7-6252-4682-a56d-5511f501229c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.239.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25de30d9-456a-4d63-8e5d-24e0fc778a1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.239.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a110b883-222c-4dc1-8110-d0f751a05aae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.239.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c2dced5-d7dd-4c83-937c-5579fea18296", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.155.134.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73d4ba46-0296-402e-b109-3db30242a2e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.162.113.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0e29bfa-1719-4dda-88e5-823d4dc56442", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.162.117.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--801a10e3-903c-453c-9ac7-ce6c77382605", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.162.180.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2051537a-c294-46a4-a7c3-04f385df275e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.162.66.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24877fd2-4a8a-46eb-b0b2-85afab06510d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.180.163.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2f1e272-eeb2-4bc3-8e3c-d5676e6ed731", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.19.117.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6bac1c1-d4aa-440b-b2f1-eb7fdd88b87b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.227.100.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7625b8d5-70ab-40fa-a3c5-a4ba6a569e51", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.28.220.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--704ff870-30a9-43f3-a32d-ddbe57497f83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.28.49.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d82f4f50-1618-4295-8c8a-05f590732d1a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.132.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cffadf4-6151-4d0c-8b72-49f872530c83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.154.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04128e2a-67aa-480e-8f44-f124179de3cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.167.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e645a8bc-eedb-49fc-aa10-1b4263720867", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.183.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b1e24b4-bf1f-4592-8b18-65cc0b2ad30c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.212.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd835990-80ae-4114-b68c-a144a59517a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.42.255']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--065f5a81-6e43-41ae-83b3-353291d0746f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.56.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe01266f-5495-485b-abaa-634a558dd4e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.73.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b126b9c6-1682-4e08-9837-04f555cdda24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.111.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c847cbc5-815c-40bc-8088-9a7ca09fe06c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.111.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffcaf8c8-2546-46e3-a0d4-bb0c911ed3e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.112.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d20830b-45b5-4f7b-8e7c-609c25ee6da1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.117.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fb53265-7104-411b-a8c7-4d18870cd358", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.118.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c4a01fb-6756-4e86-8f77-5d2b54f66113", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.118.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b25275a-a6d9-4f54-8efa-b97e8bd19629", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.120.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89d1bcc8-e61c-41d1-af4a-ec3c68f13b85", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.123.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c50ea45-5e80-492f-b927-d8600f2a98a4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.127.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c5ddfbd-584b-4c55-b92f-23ea00f43f0d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.247.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2575432-d01e-4aee-a3c9-13de02271800", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.54.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--486960c9-774a-459d-9e28-7dbc5a867bc9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.71.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e74694cc-bb63-42b5-94bb-6d604e7e13ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.80.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfaf0710-11ba-4a84-968c-19989d2648f9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.174.126.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76b97f9f-191d-43cd-a454-94e310e2f49b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.18.236.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96b2334a-16fb-4153-a523-f1760e366a6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.194.62.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a763104f-57c0-4982-97f5-e1e4924513d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.194.85.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--000e5e00-e7ea-4b87-a598-48c564b7b1fe", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.225.217.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74730d7f-7922-405a-bb3a-e7fce2cfbed1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.241.39.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--255025d2-a832-45bc-86a3-d3bd7ab8c520", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.248.133.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22f0ff29-ac59-4ca1-b7cb-a623383e7952", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.248.83.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6b3aa38-9d7d-4b0d-bfb8-2d23e173abbf", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.29.195.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1b714e8-63c5-4d6f-960a-06e435866a26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.38.15.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8796ecfa-7f58-4ead-96fc-3e6f749685d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.58.61.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af552da3-e61a-42b1-a9f7-d20febc93664", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.63.196.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e6b2b5b-11b6-4225-ad85-d0e0376b4f41", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '140.224.161.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6458ac20-5f2b-4d94-b6c7-e6286bf36f21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '140.233.190.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51017cb6-e53a-4364-aa29-e97528b7ac80", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.11.21.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed083369-17d3-48d5-aa46-635ee12f0739", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.226.89.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c9f1881-86ef-4563-9276-877717d63d12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.94.94.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45f24956-7b73-4e5b-be4a-6920bb1b595c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.95.34.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad8fdc02-8b7b-4e67-b8ef-0c0e8240c489", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.98.11.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16ac1ea5-47e9-44d1-9c1f-db441480cfae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.98.11.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfd50163-5c5b-4078-83a7-b90b10d90894", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.98.11.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0b04255-aab4-4925-9480-8744356faec5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.171.90.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--664cf8da-05d8-42ea-8011-e9f90d0c01c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.186.6.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aecc41f2-3a34-4d3e-ab1a-123ec4ec7b59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.44.247.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfdd9d80-f801-4c66-9c6e-2e9c1c0e0a90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.1.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd1b3e49-9368-4975-98da-a4ad87b4ff8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.118.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7b05610-121d-4b38-b3ce-09cc89d2accd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.123.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36f810f1-c82e-4f10-b6ca-cbc846c2460d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.135.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2972cdd1-93c4-435e-8aa9-79e8bfaf55f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.141.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07f6d7d1-98ce-475a-ae32-e811062c8748", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.165.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21982545-0d51-429e-8298-9188be14dca7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.166.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3369f05d-b5de-4062-a4b3-e95ae3928d72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.224.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--092c52aa-4879-4cf3-bb63-085394b28bd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.246.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8dcd2198-c888-43ea-98df-0aed5a53a052", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.65.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2036cb3-be4f-469b-9c09-b84f6e130bb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.105.146.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cc03870-4db3-46d3-b18c-f310b2fa3e94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.110.157.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9db38292-1233-4fca-849d-c67986c1da5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.110.221.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29f6d891-c036-4fe3-94b8-f07b033191cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.110.226.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--114f813c-39f5-4c1c-990a-b19d52fa09d8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.14.6.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e32f67a-28d8-45b2-8fa1-f80775584ed7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.102.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9367407e-8bd0-4ee2-a228-bf9690a0d25e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.145.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0e5b916-d260-4bb9-bfff-5c6a32e75562", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.32.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--747472d8-d6aa-4193-b8c2-a6254619bf51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.44.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab219960-50ec-4d11-b597-775e2db06361", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.20.253.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baf43600-cb0c-43a0-ab5f-c8681eb9e326", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.202.210.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c192a15c-1f2f-41d7-a37b-ab4647a87050", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.244.177.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5dd6c1c-7be4-4d97-87c5-d2af11e34116", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.244.179.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18107071-72df-47d8-a032-d7c13eb55468", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.0.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--141b17e3-de91-46c8-8743-3f2a5b53fb87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.0.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--929e274f-663f-4dca-bac3-8313f0a0bc3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--931cbc84-22ff-4744-926f-90cf2a53da3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cc832bb-9573-4c6e-b7a0-a4dec111a40d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a943c5ba-afe4-4f32-a2af-0cbbdf0cd10b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--643b8240-7a9a-47c9-9633-71de59d8da51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f9d3587-519b-4129-8155-bf5ecea6cb60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fc87ab8-bd37-4f8f-a7aa-bf54253387a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb033c1d-ff51-4ae3-9d1f-c7584af1b786", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41abf338-c41b-4f4a-8b76-9e7163659007", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b69c84cd-caaa-4a12-8518-c86b4692dba8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1103c2bf-9a56-42c9-801e-fd77b29bd57d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--810b12f1-113f-493f-a11e-a40dec63d5d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebacafee-1c8d-45d2-accb-6516b325314e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60363bd5-591f-4b82-b6a3-bc0fcb9014f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4061d15d-191a-4c1b-929a-1cfc16b2e43a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d6c79a1-f9b8-4cab-8803-a6ac2537d578", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fd54603-ad10-44c5-afdb-2c23ecae4e06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06638dae-c62f-4d6c-ba5f-26c23175921d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.173.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6683218e-55da-4a9b-b369-43936f14f4e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.173.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c806a036-c0e4-4dd4-a12e-813116b5cfac", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.92.32.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f7f9bf9-dca2-4dd7-a063-87e4915f672d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.123.77.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6956b073-71d9-436d-9cb3-ca90fa74493a", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.126.143.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49c53f1f-6979-4277-9c2a-62aa61a5451f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.126.195.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46f76ca9-37bb-434f-900f-487efb574a21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.126.226.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7c69008-9ff1-4931-b9df-4ee28eb16535", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.202.82.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--453e794d-7f36-4f27-89f3-af9dbbf0e388", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.217.74.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f3a8a87-1a40-42cc-9576-d5fca263e709", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.31.198.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7597ffe2-71b8-4a4f-b4f7-e2584c44bac9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.6.131.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af929497-2fe8-41ab-9eeb-5e6f3f38a95b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.79.187.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48f4b35a-d0b5-4d46-944b-15200a943270", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.91.71.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3156d35b-2ff2-48a8-9573-f92856e21d6b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '145.220.91.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc036559-da3d-4ed3-acda-efb41e54ee7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.148.116.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69957276-ecc2-405e-9a02-c775b7f203eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.148.5.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cbcd018-50ae-4aba-abd9-e62c043d917c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.185.25.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80168ede-bdb9-4805-8915-587de8f07813", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.185.25.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5212c564-ed02-47c2-ad1c-6baf65ab4173", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.185.25.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee1b372e-e4d1-484b-8286-b6d81fcc8d36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.185.25.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6484ed0a-31cc-4cfc-b562-1bc326ec0f2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.185.25.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb320818-8260-4df7-85b5-970be3185976", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.185.25.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f7e2e27-f008-4297-b3b2-acac94072cd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.185.25.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25db8d84-4966-4838-ae6d-a8c2183a1be3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.146.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65a806cc-0333-48c4-9692-9719b12df9ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.166.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ddac408-4c3d-46db-a70c-3794a6bc5245", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.218.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51a165aa-da87-4d96-b6f7-fe1abebf2901", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.225.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be96b11a-3213-4a56-8094-0a120ade4e7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.227.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0383e71b-242f-4867-8b88-eeefd9e4722c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.234.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a55fcf96-b1bb-45ee-8289-b168906b62ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.255.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25cc954a-7e94-416d-9c93-6157990a57d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.29.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--469727d9-5dd1-4d04-9769-007d9873f597", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.37.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d89d5417-e26f-4c47-942e-57cd63c9dfa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.98.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03a50ba9-f34c-4847-a0d8-311043faa97b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.194.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaa20d5e-36d0-4616-bd00-efd450f3ed0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.52.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47489e93-70d3-4ea7-8c77-bfeec8bd8612", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.52.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--002bd7ad-12d1-4995-b81f-50334c8bc58e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.52.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cac9dd6-8720-420e-966a-88e6bea7bba6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.240.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4250ee7a-4747-45cb-a441-21fad5db24aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.240.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb608e24-880e-4e59-87ed-e0321e995a38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.240.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88026522-bef7-4533-8841-d04cd7ce163c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.240.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f35a4e79-dab3-4c53-a99f-05dce4c6f1fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.139.136.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8884f251-91bb-4cef-a559-1e7f525c36ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.15.15.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74ab56bb-b0e6-4907-b2ee-a6217a954a49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.153.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--873f9906-78a9-492b-a6be-fd43a56f6a89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.170.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4daa60d7-f479-4fb2-b965-42aa64519ba1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--487a52b7-8d57-4f82-973b-2d5ff7e5b0ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1616da10-fba7-4c8e-ad9c-1f5a7712d91b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c897aab-2ecc-4b64-8266-4aa100048ecf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2980235a-3eeb-42c2-bc50-849e4db99fa3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b8e501e-bfbf-4e6f-9dd6-b8abd071f17f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1abad45-6109-4717-90f2-266d2e568493", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--960fff3c-e4e8-4a8c-988b-b348bdbb34a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97a182c4-5ede-49aa-a512-0f6096885be1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f0b921f-01a0-47c3-8d3b-a2b3b5142f46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--368c4428-d0f5-411d-b45c-d30d3058723e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fc6e2bf-8ebe-4341-a8d0-8f46ff03c4ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1316a4ce-022c-479c-bec6-cb16b9e90838", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7c820de-5ba3-43e3-90fb-a5c5cc55fb74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a360f1aa-5915-40dd-ad77-9d147e46f923", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--239536fa-b631-4c87-8f46-bbec9e7b9d57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bba545a-d960-4df7-9460-822625d101a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31ed67fe-e19f-4b7b-b842-afca5492d4b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3459f2aa-97ca-4843-a40f-f258dbc87c81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79bdd1c5-941d-49cf-a970-216ddb375d79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--794f6836-20f3-4db6-9089-f1c0b2b343db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbd34f49-ab60-425c-8064-0b5562b19ace", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01b9eb06-0330-41cb-a08b-58199a7541e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d50e710d-2739-4d9f-a5b8-da78ee7e75f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c47f8f46-f3cd-469b-92c0-201609748512", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85ae1752-4ad1-41d5-a952-0712812a18da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a33bc4b7-c2a4-48a3-9afc-c8f3a4a23147", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec2e2f15-e78f-4f06-b70e-1da273c2d03e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04f1ac33-b193-41fc-98ea-3000a1efbf78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef902117-3014-4594-adc7-8ef53530ca69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abdee47e-127b-4cc7-b7ad-f23153ceacd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d231917-207e-4736-b15a-0868db313bab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--137fcd2e-ac13-4cdd-9422-460484749903", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--603acf9e-2e73-4f70-9936-42badb857cd2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82932d85-572b-4b4a-9ffc-bf43f621a646", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--084ab3cf-1707-42df-a2b2-7d8a01c732db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c14aeca3-01ee-4a32-96e8-17701129f910", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9759b2e5-70b2-420c-88c5-a4c37de1d002", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdcb8ca0-68ea-47a4-906b-b916308e2e95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4efe8fb-816b-4383-be73-924384a6087d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e04bf209-27aa-4571-8c55-cbef0af759ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af4c4eed-90db-42cc-a204-a488d710367d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a850b1df-ffe0-4241-b484-3e59004612af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4497b02-41d7-44ef-bfdf-aca184e032bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79d9efcf-0345-4209-857d-d2ac97171f9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--200103b1-4440-4251-a432-09c990f51ad9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a09b9e48-262e-47e9-96bb-eef27a874ffc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ba2d673-abde-45de-9ff5-a407e4fc2ca1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d88166ea-9671-4903-a79b-d6a850fd9072", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--801f1111-0f78-499b-bca9-d223f36d5dd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dd3dd55-9afc-43bd-a733-cfa8efeef569", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5854c7e6-2e9f-4a49-a3b9-3b2207ac2408", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83706095-bdb5-433c-a976-ce39d4b14cdb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0199a7bd-e483-4f1c-a308-881bc73a7761", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6617cd42-57a2-4424-8ddc-7a8c12ef9aa6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec882a46-3dfb-4084-995d-94b6f6034f16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1ae4a3a-f686-4152-a75c-8eee4351607a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30bff008-e025-4c7b-b66b-e16d22540a8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--117eb48c-40f1-4707-8940-fa3694281540", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae6ab838-ece2-4029-b1fe-fc556abcee25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a1a6b62-1f4a-4e2c-98c6-4a924f017b01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b8411ed-b3c7-4fe2-92ac-0740ce5c2dfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--626553f4-f957-4283-9c64-8c39b2bfa9cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2b95a8f-e788-468d-8c05-8a0e5d0deca8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e208d25-08fd-4dfc-8ce2-3b6f1be0a5b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5d7853a-d6ce-4235-af43-950bf84a0c8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c8cc9aa-5f38-4671-8551-5c7498954b61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2d0a2a8-92a2-4af4-9d7f-a9217686c4bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e76d48d5-9e00-46e6-ac1c-3ae87772b478", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2445b8ab-acf8-4531-8bd2-64c88a2fed84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c48793ae-535e-4b65-a5fb-d004f1e8409f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--803498d7-a956-41ee-8b98-053ba32e9e48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0be57f5-c188-46ee-bb5a-b107cc6f4803", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f16c4114-542e-4654-8ee2-35c1397df6b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--194276b6-941b-4bf5-967e-266e2ac92eb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5360f612-24de-40cf-a1fb-d68e127a2785", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c85cc2e9-eaa6-4c80-b310-09f046466e99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--546e6c28-0b5f-4c1b-bfaa-4a1c364d1d2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49723266-bd17-422c-ab0b-57315f118945", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad022315-e4d4-4596-bf15-3b7af27862b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c56b4342-1f43-4a85-a3da-420f677452f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--627c917a-cecd-415e-85b5-93d3001a6539", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--321537ee-3626-4c18-ba14-c3800449c5d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bcf8659-4e9c-4792-a8b2-0e185cf2a0b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b743f72b-142a-451c-b725-96f5b97fc841", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24c35ac0-c8da-43dd-b128-420cf7c1326b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09064eef-80d9-41e1-b2c0-c3017371f134", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46f8037f-cc3d-47c7-a1d2-e7eefe025494", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17bb65d2-55b0-4715-99d1-08634a475eff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8a75a68-1f44-4025-9ff7-e2d2a5176388", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ddde2af-e820-4d76-9e0b-eda5f5442c2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--335f7703-ac3b-4649-b732-bc9b01802b0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e6d75a3-2eba-4204-ac12-bbfc30c81643", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--420ca600-87ff-4b02-a353-f54f5fa16b0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05d46561-1bf1-4912-9f7d-6c62e6ba05fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d6ad229-f5a4-42de-a71e-97cf5125f597", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6309293e-cfb3-46ff-8ef7-cad5f162930f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dfc869f-6dc7-43de-9012-d6a7834e4319", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa5f555a-2502-491b-8fdf-82091ea5aace", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dcf3098-b315-4506-94da-ef869b76cd7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e473427c-6e91-4c97-bfdb-f5b712c8bde2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d774c778-d13d-462e-baf8-da189651848e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6073698f-b777-457d-b178-2dc57f82d00c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2835e94-436f-4e15-a10c-3101323dcec3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0235d4c6-7525-4aa5-b439-fd609a77d032", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0921c82b-7968-4bcd-baf4-e61daae4dd4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd07dfe0-d60b-4f26-a73a-98c9c7c81a29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff48fe7d-eaa0-45ef-878f-62c8cc8bdbe1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dab5c5c-cf0b-4c38-82f0-0790a5b6d90b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd4252f3-3ae3-49f3-985b-a1a5f954a285", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1983c679-31d8-441e-9f0b-1f56fd6c279d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2d12b13-7c58-410e-ae4a-3b1de564bb6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a971af3-34cf-463a-9354-29fc15768094", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79c1430b-a07e-410e-a562-6043f2604c89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c16d3b5-fcb9-4e86-9575-dadfa4f98695", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eee05416-5026-4107-9b98-fb648ae52f20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ce87dc6-8f89-43a1-b2be-d15dce27de69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc656ef8-eb48-44b6-a5bd-4302867e1c54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d01ad5b-578c-4672-b892-fe024303a7aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddec8c48-aca2-4f98-bcb2-c18b3fbaa331", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--145f3a54-b00c-4963-8387-d930d992d6eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7621a54d-5f29-4c97-9666-9f76dbea91a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3b52681-af83-4b18-81a3-5c3629639a13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66f65444-54cb-4a70-899d-0aa4b69e2a6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39441429-ec10-42c2-96f0-2b6d47d95393", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bee9d18f-357d-4d18-9138-ae4963217b6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36a779b8-7ed3-4e5c-bd34-7317b4b908fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c7a6bc8-b643-46bc-a368-cd34ae72676b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f7e8c27-0321-4c5f-8053-dce5db080ded", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--601e35a1-1470-4124-a176-3862a8a57e9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9aa767c5-e3f5-47da-9ea0-a799fee19968", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f557240-59a7-477b-bb94-482a9b8d5038", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a675dab-208d-4bd3-a3b9-8fa296794302", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d84d65b9-4f20-45d5-9975-f8a478d637be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60dc31c7-5bab-4006-90fc-dc7d7232baae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78e469ea-02d4-4ace-b493-b0a27d8b7b36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a150c832-2580-47e2-81fd-4e202762ca16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--748e82d6-ef1a-419d-92cf-2097688a911f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--420445db-17da-4277-b4cf-cfeace3e9245", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2169f309-bc3f-488c-a71c-7f07549ed9e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0637cc92-6804-4d1e-ad92-2c12f485e590", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--986bb811-6695-457e-a44d-b433652ad9c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--501cb32f-fee1-41ce-9273-83798bfa8bc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5cb9df7-3f5a-4dea-956b-9c0738849f2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e488f700-8c95-4bd0-9675-3c09a94a7494", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--270c72e9-5f0f-47ec-a4a2-200576e138c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56add024-a045-44e8-8ef9-5fdfe820e911", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa7f9d4a-9c94-49e2-8ba8-64d66338ee58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3f21b19-6072-47ea-ab7d-12a2df3fce7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--878a749c-34ab-44a5-b975-5a41277fd097", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--449a41ce-f6b9-47c7-b485-122bf560fa95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be1f65cb-0480-48e3-a39d-39ec86339e8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98bb4c03-9588-46d5-b8fe-f58614f838e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--469127ff-f60f-4173-a3c3-6bc628f8e880", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eabc9d31-7615-4253-80eb-7766dcf21d16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c257884-97b2-4510-9b76-9438b1a448f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49dff621-4ad7-410d-845a-8d681f3c9c4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04bf83fd-29e4-445f-9962-927867976dcf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d589a1dd-c66d-4763-890d-b0257b334be6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31583631-cca3-4346-a81e-20ea9b24d4f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f20521ec-a149-4486-952f-362a4143d354", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c36ba4b9-ad71-4519-93b9-b9bfc7ae4ed1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abb1db1a-3cf9-4eee-8b2d-5117aeee9739", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--489a83d3-d34e-4d48-bcdb-a934266b8edc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91f3c1cb-4dbf-4f91-99e0-348abd73c07e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2976c4c5-21b4-4f5d-b03e-b8fce7db046b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--498d46ef-a921-4136-b5ae-63f24d802b89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a723b21-4346-4d9a-bf6f-85a2b695a41c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--164c9b55-0310-4dd0-8d12-571e8c5fd200", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.1']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--848883d1-638f-4bb2-947b-d368b5cafb9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b9f2dfa-33eb-4041-9b97-9ef489e551ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3d33644-52bd-4516-9835-4e233ea3ec90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d61951c3-dd91-49bf-b6c9-e8756236d459", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ebebcb7-1e90-413f-84ae-b800adba1eb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf01918d-ab56-48c9-9052-1c01a645e6c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48544d44-1d16-4c7e-84d1-2f63148e9f29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--398224f4-1169-4fd4-a366-f0329f41d15c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--191e0426-d7ba-4658-b5d2-777571dfe5d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44b160dd-9b51-4b9d-9531-60d4cb5abc74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3c91e22-a546-430e-89aa-ac69d02be431", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bc44ce8-8b3a-45e1-9f2d-b089a5af981a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e50de29-b236-4337-83d4-d6ed9901fbe1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87796538-9b7c-4538-99da-764863342aae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81372f9e-cb4c-45a0-87ab-2039a24e6f63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d70aaa1-80e7-4e31-a07b-b9f27e3f19e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4542b4f5-5484-4bf5-8a45-2b08774fa52d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29454500-f37e-47c4-88fa-e8923566a39b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df4fe50f-9c74-4616-9aad-d33dcd2b2fb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63a45fb6-0919-4de8-b8bb-3f963a177eb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad5e49e8-a40a-46d2-a384-9537b1041bf4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0b07896-61e3-4e53-9e38-3a10a7d7b034", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22d20bcd-d79b-4b69-a747-de7329c26798", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0911f2cc-6e42-43c3-9231-3484b15fb28d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df67e865-60ed-4223-b47c-387c82a51f1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c5549c7-4ac1-4717-91c3-cb8aba5d5d90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1940e92c-e5e1-4567-a73b-cb5d3649b943", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--784663c6-71ba-4aff-953f-7c3dde97c0f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--343024e2-5c48-4768-9b4d-10e156db4b91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76193116-98ac-4a0d-aeaa-25a449712fc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5672ea0f-060f-4f6f-af4b-6e3c75d86b28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dd7bac8-35b5-4d37-9314-c90cffa6bf8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4b194ae-47d0-477b-8e45-7bb77b33a41e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--549b84d9-d9a6-4409-9ae4-d0a4effa6be5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cb890e1-7b97-42a6-8352-fe9e22abd6c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c0f6e59-0cd5-4e93-9c3c-ccb0be80d055", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fafdefbd-6ca1-4dc0-836f-aa1603970c18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--419cc008-f865-46db-9716-ea3670447b8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d14dbef6-6671-4b74-9434-0142aec5a5de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--649312eb-aff7-4c76-86d8-38cb5ea990f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c49bd00c-b69f-47f4-b77e-6829b0e60bd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c67cf65-62a9-4df5-a332-75e1ecff981b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--487fc478-1a84-4553-aac4-1e45974fb296", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72293a9c-dfc8-4dc8-94ce-4fab59f621d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed391d1b-161c-4109-aab1-8d0d22ffed40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b9c44ee-12d0-476c-b748-3675c2b119c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55210777-7993-438e-b845-e71c9a3823b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3666a915-af12-4af3-aac1-e8c3d502d054", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55c4fe8f-60ee-4f1f-a1ce-01d448ae72d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--899e5e98-3793-43f4-9d08-865cc65988ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a982817-552c-4141-badc-f61d101ced1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1a453fb-5f3c-4fd1-a93c-4bbb965ad502", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f9b1374-efbd-46b2-ac1f-0cb5de456b96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a0f5ef6-b183-467c-8d8a-d2ed28c09291", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90afec86-b3b8-416e-9f68-3781c5c3c8d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7917ec9-9821-4e11-a60a-495f8998afdc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd5fdbbf-4adc-449b-96a5-4a1260f85ad8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd83e7c7-b736-4ed2-9c1f-e91851f2b8d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97cfb3c3-e138-46bf-bd46-430579d59d7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8163b1eb-f23f-41a7-8d38-242cbb4e89a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9fef810-23a4-4a21-ba17-a472e674450f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4efd50b-74e5-4e41-a8d2-2d341490b62d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26cd429e-bf05-4a9b-91a1-e37aba7ed3c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09664ab7-e062-4060-a688-671b33e3ec26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b6a2aba-031c-4e02-ab44-303a39ae6e25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d25763e-9c00-4184-96d0-a1380c5ab86a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8110ad7f-0320-47f9-ba45-15b6980864ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8098432e-9ebb-49cd-a21f-17d01f0ad877", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69bed565-5154-48c7-91d2-2d2ed634ca2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd3aac12-5e5e-4c4a-8a12-7540aeb1eeda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f8be3bd-90b2-4092-9611-5f6c19307b71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5fc14e1-a23d-4a98-82eb-cd22962a0a38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b955c39-1a44-41b4-ad0e-7982c73225c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--418faa3e-6ddc-4582-8962-cda70de96d3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d93dac2c-6c62-479c-99e1-5fcb77505695", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd4b48a8-ff17-4e4d-bf5f-033b8520dfbb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3e2a295-5656-4439-aa42-74eb51f3935d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ab458e5-d755-46e1-9e50-6a92382ba1a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3af9a90-8c9c-46d9-8abe-67d4a5b40a96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5ac2137-e1e1-44dc-9eb4-530e4e4b22e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec85f6ce-ee65-4127-a015-5a750d21c2eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c14b27f2-2908-4aa1-884b-907967149c1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9465887-90a1-42e1-8693-48e4e12e3f47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b3228fd-4e8d-4d05-ab08-ec669f78303f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70df7367-5035-4931-b22b-6c6ad37880d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--039d1066-5111-4634-be07-e6fdcc7a11d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d26398dc-2982-4a8b-a54a-fca8ff79a0e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--878e4e1a-e02e-4916-ac0c-d8193b2e3bd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61b2e17e-abd3-4247-b4db-9a81d59503b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f229372-8863-4717-8ea1-c3da456b0c8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--414449d8-a69a-436b-81a5-9c8f4318b530", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d53e69d5-f88f-47c2-951b-0c23297e6f76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--181a8c94-8496-4977-abfa-25c7e4695a64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a6c7876-7b1e-479b-a747-0d56e776dfe5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2edfeca0-2fe3-4766-b0a4-8d8aab6c560a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cb633ce-d389-46a5-a774-5e1647fb8642", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2249258-41d2-4c27-9693-ba4e9493c5be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5862124b-738a-428a-ba5e-ec104ad942a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0e502a0-3124-4d23-82d6-0fff43787611", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce610fcf-aaeb-4836-af07-049d4f92952b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b85bc3c6-8d79-42e9-91df-8273431dc2ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb5fa3b7-745c-4b14-a139-fdb5b8accffa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e956e721-6888-4036-b338-d7140efa1668", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe70fd37-6b7c-4058-8c7b-b7b274bcc7f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d02c3641-c804-45aa-88e3-7ee23df33ef3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e143f1db-79b3-4292-bd55-319fee7126bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73ed7a97-d665-4bfd-96b1-3983e4415d9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a21b4ad9-8f0e-400b-98d2-20a60c25bcb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20db9d4f-6bff-49a1-85a0-e54719dbe43e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be503dd9-fdbc-4673-bee1-e9ad551d3075", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97279753-5715-4473-8527-cf825e17739e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9922bbdd-9ee7-4052-95eb-d160cc810b27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1f61d6f-edce-4c6c-8a6e-bee845597890", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cf38f36-171b-46ae-909b-7d92c7f0afa6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42019a44-b7fe-4031-a24d-f04981c8d53e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ac98f72-a303-473e-9576-773f0e7cb642", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d00ee020-09c5-444c-ab95-24d151bb06a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3c802b4-4fb5-416f-a88d-b2a108332468", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf720317-d61c-45f5-9718-016a652e05fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4efc83cf-795c-4dc5-80f7-788e3fa8e2da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c11429f0-875d-45c5-ac90-6164f4fd9c5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db927cac-5b1d-433d-ad8c-771e9a6ce138", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.255']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56dc1633-ae91-4454-8065-b89fb93f0280", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea5456b7-07fb-4de5-a2ad-d9b89d870bd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--752826f7-c2ab-4776-bc8e-494600c74c02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f336881-9801-4199-8fc7-a7ff905701fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a35edf25-7523-45ea-8825-1d0e01aee0cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0889847-79bd-47d8-b48a-77a7f2747ebd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3af73183-7a9e-4a9d-b11c-4860453bd6eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--890473ba-2d52-4fd9-b3f3-4966405948c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85860f05-6b86-4802-8d59-d0f9de5ed14c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b827d66e-d2ae-49fe-9d2b-0433573e3e21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6332f26a-e270-4c85-bb7e-853896c5a4be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4736f0ea-94be-409f-b282-9d568e774ab6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e2ef141-18f1-4b2d-97a4-862adb90dfbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0268541-8caa-4f2d-88ba-ae8800391451", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc1d03de-c592-4480-a02f-8f37d121ba4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4380609d-0fc1-4169-a033-dca8ed747747", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b26628ad-6f9a-4a9c-9337-7576c089c428", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67a23c07-5cb1-40f8-8cde-d1defd6e2f0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75aa1317-ab2c-4214-a377-1e4a176246dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfd5bb72-afe0-4563-88b8-997a190d203b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b55d45e-2eae-42e1-b1c3-48c7d29618f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71b64e68-e8a8-4b6b-8ebe-a513c4f17009", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba1ed420-37e9-4759-b677-20a101800d3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d12c05dc-9719-41f4-b341-e105f37dc240", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc5a4fc8-7441-4869-be87-6e601f9a4fd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3fcc2c9-a835-40c1-8ab6-8daba352846f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--038f1abc-3186-4b39-ac48-ef714ce093d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb04c034-4fea-4138-927e-bacc03ce1dd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15d18742-e1f7-4b19-917a-50e2d90517fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd870f4e-6d18-4dab-8255-37c355c4e844", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--563769c3-56a5-4039-9389-d045fe28cd4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d3f2a3c-69f4-4720-848c-e27642d31f35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54c0f1e5-0c48-4720-852c-71fb14cf0798", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8e43f94-dbed-4335-868e-85f8718cf06f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb693595-03ae-4404-9a99-81d29f73b277", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4358f74b-fabf-442a-91bc-377437c90dbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c21ce0f-03b2-4fd1-92c8-0004fb89d5f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a3a9c76-738a-45e0-a0dc-17373f3f00c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85faed5b-8902-48dd-86e1-4ab1117ad1ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e7e28e9-119f-4d90-9306-b6cf949c01b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0f4f482-de2a-4d3a-a17e-ce39cdcc31ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c95a6e6-e960-4bdf-aea2-0ccea3b4fb7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c3e3524-05d7-466a-a7bb-57f4f40c3bb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50e14298-3c10-463c-a637-592c19aaffa3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93c66aa0-9d72-4199-b8de-c3e58279222a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3148babc-9ba5-48b0-8cc0-b652cfd443b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67f355df-7858-4375-8313-f577fd3ec76f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3080dad-129e-45ac-960f-ff0c6cebcedf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bbbf634-04eb-4f94-9532-8232684f0f86", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.78.161.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--354b80bc-68b3-4519-932e-ad3bd6f79b5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.78.97.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17a43ee5-2f73-46cb-a942-b5ce46393aa4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.113.190.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--682aee18-1e7b-49c9-8be0-f934c675f748", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.113.201.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfa5fad3-8da7-4d3b-b0e7-770d7465d81d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.113.221.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29393a10-3ab4-423c-a5aa-d842fd809df2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.135.122.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cacc8a2f-8f80-44a0-bae4-04697ce90abb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.135.45.163']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18925182-014b-4788-81d7-238f47e9a7fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.135.70.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2a7dfa8-85b1-4ff3-a2eb-219ea71a3a06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.121.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b7a4ebf-8b54-4728-8105-586b229977be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.121.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c973f1a-c617-4663-bf3d-1b2ee227ded3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.184.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7ad4a75-196b-4b46-80e7-2a4877340159", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.184.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64d2ef5e-a115-44be-8d75-a4b01640daa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.188.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--086b5f8c-2c5f-4abd-b654-a6fa8ddeaccb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.188.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f230bcec-2525-432d-a9b3-ba97d4d8f144", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.245.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f092b488-c002-43a1-b097-72acd7907bf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.56.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06eda3f1-3627-4b84-b82e-e37e71495a19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.56.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d411c065-5753-405a-8134-636f167637e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.227.118.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cafdd26-9322-467e-8221-5f824a476be1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.104.31.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dd67204-f827-47a8-a656-ddc5df2431be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.34.240.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--214cd5ef-815d-4c33-a030-1276b828e12e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.56.241.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7858dd70-a217-416a-83bc-2f8399f0d1a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.78.179.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a820039-f794-4972-b105-17641f612b65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '15.156.110.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--beabdcf3-126a-476a-854c-eade68a7c514", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '15.204.150.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4279ec2a-fcf5-46ae-bfcc-f1ae7fbcb0f2", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '15.204.157.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc36b28d-a23e-443b-84f6-6eefbf927ffe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '15.204.226.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77e358ef-abd6-467d-93c4-06b3cff16a56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c9cf4ac-5630-4b0d-8a4e-67600258dacb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c67e40c-69ee-464b-ad8a-d6600c0d0094", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3df28a72-32cf-458f-830c-1ceb5e844f00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6b93894-9cd3-4d69-9b99-1a8899531549", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa0e621e-ab74-4d70-8de7-478641269f97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e743de4-52cb-4975-b655-f335522e9cb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b6dd904-c684-497e-9675-c3c4cf756afe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a18b69f-a945-4f2d-a177-7218203f4929", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d7651c9-ee61-46cd-a956-3a82939e0681", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ea9783c-a36e-401b-bc21-c9b2e01ab021", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fda0abb-8384-4b4d-ace0-d45d547668b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd7b16a7-400d-4748-af8a-0d62e276ad7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e27e0a73-5727-473e-a0f1-ae23e4569e30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ae3c440-7bd8-48ef-bae8-de9284c15d28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffe1949e-053c-4eb8-ac28-eca3061addb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2754f26-26e6-4ddb-a322-fcc7ae3f1194", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7c82d3d-67d4-48c5-aa73-c7b1d34f8500", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86448ba0-4c51-45c4-99da-c9b2ca5c2a20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--285e3371-d53a-4dc4-a67d-9423d720788b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--298e5b02-6015-445b-8b9d-dd093731ad25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a38c8518-3a97-44db-b903-3ccdfc3a2f81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57ad744a-be12-4ec5-8e9a-aaf57e7b964c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.163']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6832083a-a930-4489-ad66-251052864571", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25d0c35f-f32b-44cb-84e2-ab133fbacc80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a29e0c45-39b5-4768-9a7c-d99bc8dcaeba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2edc996-4ae9-4eea-9ea5-c7eba1769d3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eac8c02-2510-43c0-b6a0-9eb14fdaeba2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7edc5803-e401-453d-89f2-6f9f4e268418", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec4a358f-45e6-4606-a46e-1a29ed2bc8c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--787d4ddc-23f8-42ad-9c72-3431610f4d75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a3af7ec-cd77-40b4-a37c-8084f232879e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ec41b74-f30e-4cc2-b73f-6dcb58496b3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1559635a-dc25-46d6-aed5-56171419934d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d6fac90-ff42-4bef-b34a-cc9c7a564f48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71c13762-f825-4731-8c74-338e13a0b98b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d338db42-0d20-421f-8abf-cbe82578c7d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b5fbc84-4fca-46f3-a312-e59e7759892a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b936878-5223-41e0-be9f-d2adcde0d149", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc462890-eef5-414a-a0d7-bfe7dba96a67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06dabe4c-63ed-4d64-9614-d872ee84b946", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cc2917d-1a32-4286-a02a-55aa80256e66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bb79dae-8231-4aec-98b8-bebc99d45a2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eabc186c-31f6-4bca-a572-453e5ea75c0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6772085-108d-49ce-a0ad-736253c4a2ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81d4cc39-ef42-4262-ba35-e7cc296fe51f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbb0ece8-5c6b-463d-9c84-0f41677c5fd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--550b3d11-be12-40a5-8474-927938964c51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa2015b5-13f5-4e84-8264-e83285ac3c0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a39db4d-d29e-4494-8145-2e2497c038a9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.95.30.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--221ce64e-fba0-473d-b701-d1aa56d30e33", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.115.146.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31f3797f-ebc9-49b9-86f3-37b57416ccb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.236.24.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68948618-b40f-42ca-9444-c5e4160a7f4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.237.79.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--562df0ef-4404-437d-9ab9-87c933db3ac6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.242.242.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d961c1e-e155-439e-b72f-3c61ddea85a0", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.30.87.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44f56b19-1b5a-40b6-84da-b19718e3188d", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.48.3.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1f6c69d-78cc-455f-8e48-acaa077bb9b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.69.83.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4da261d2-16e5-482e-be53-04181d11c75b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.173.0.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43d09c39-8635-4105-9112-28407ba4eb05", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.203.177.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3bf9211-69c6-43b6-854c-4cc2fda7fc68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.231.22.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f645593-d22c-46c3-a34a-e8d280a0e52c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.128.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--216d08ee-eb21-4756-be4e-53bcf33d5f44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.128.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c3f9799-7571-4a45-9935-d398b42c870d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.128.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5efb850-de5f-4b8b-ba2b-1d234e483c70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.130.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6f6a402-861b-4844-bf74-5883d94b917e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.130.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1be5c0a6-782f-49cc-86b2-a054ee6e79fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.132.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f246846-5e13-46b1-af7f-120eb9fd36f6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.132.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c83f320-f352-409a-9f68-cf7edad06ad0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.133.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e45d37a7-af00-4c1b-b310-80bcfdab30ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.134.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0b3fc72-17a8-4ebe-8fa2-3f5912912f8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.135.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9578d3d8-1713-45ab-a916-150ab03b018f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.135.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98067a88-dee6-4d5c-b33e-6c2edf477c5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.135.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6edc138a-6d9d-4f76-8446-e0b94ce23653", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.139.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--843724b3-4495-48ed-a032-85264ed36f1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.140.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aeee4d98-f364-4533-bd9d-2a18cf4f6afe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.140.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87509892-34c1-4ffb-a439-a1a3a4189273", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--599014d4-3bf2-4955-abbe-c1ecdc42a78d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c79cf81-a3e7-4600-99c5-8df3ae3829a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bbe2416-348d-4f55-b494-17c4bae991ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9608e6ca-99ee-4e26-bc0f-0514d1977a66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--133a4732-6382-4c52-8eec-daeb85214f18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dcd6c52-3661-423e-a89c-14400b48e98f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.142.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a276c58-cb93-49cb-a2fb-d0517d8fc268", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.142.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--751a9ec5-b8a6-4cf1-9117-94050dc8426e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.146.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb327247-f249-49a4-be24-fa1f87af2e72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.146.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77d4d017-cb9b-4b0c-b109-11e278ad1746", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.147.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fcb257a-e7e1-42ea-97d4-ea9c017f87bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.148.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60743b1c-2daf-42c6-960a-fad218b61374", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.149.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d4b3343-a8a9-460d-aa31-e2877305c039", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.149.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d23b001a-de18-4849-99f6-1cb179ea2b05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.150.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1baa4622-e27a-4967-8bcc-dc491f0846ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.150.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fff9f05-f788-461a-8479-c4bad7dba49f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.151.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41a6aed0-e5e9-413c-a0ec-3c725e246257", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.153.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53af09eb-f358-4094-a358-3d3518ad7e45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.156.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd7bc2e8-012f-4f11-bc03-228088afe857", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.156.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3219143b-f1a7-42e7-8593-d3c36e582c64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.156.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03804aaa-ced7-4b7f-bf91-0b0242eac4f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.157.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfbcf3bf-d7b8-49bc-af2f-2dcec66125f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.157.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24861f7e-1064-4e8f-9b30-b205b5d487b5", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.157.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f23138d0-14d5-43f1-91b8-62db7e40c8ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.158.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02e1afe3-b314-4eea-99d5-2498f25c1e6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.158.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d999080b-9faa-4466-8bc5-315dee3855bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.168.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1cd438a-7921-4127-8a1e-8e0d7f1ea9d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.169.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e4d45ab-6a3e-4016-9f89-b47713712978", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.170.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--513dbedc-b6e1-4845-9e6f-7a4a87fdbb06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.171.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c8bc7e0-0f35-45fb-b280-0f5f46c63ff1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.173.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54d03eed-b264-47f4-9aac-28ef18b4ddf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.174.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b96617f-586f-4fc4-9bb1-3afb569f87a3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.175.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50ce88c1-7ad1-474b-b979-628e3fd2fee0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.180.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--523e80ae-f55e-4e41-b47b-8035ec2779e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.181.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e89e8dd9-6c10-4834-8026-52460fdc3648", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.182.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf9c9e15-a5b4-4ea4-8bad-2aeb0d8848fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d896ee8a-459b-4d32-9d9d-544af824ad61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70ac8a77-ec9e-4222-b578-757a8da7f27e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab84d0fb-74dc-4a2b-b4a5-fa326bbbf872", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c6bc834-c11c-45fa-9c20-1f2bd565df54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.186.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5646e29-fed7-4bbf-b686-3ed8d50618f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.188.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e61cd78-293e-4c1c-88cb-59f47797b8d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.192.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41955835-d4d7-48c7-bbd0-297a9d4af93a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.197.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa798d67-ec63-42b1-8753-4ee0d9dae04f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.200.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae5bd777-fcd3-48a9-8ee3-09f0cf113fb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.200.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40fc361c-3e91-4f2d-b65a-5d007b321ee9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.200.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e33402a-c558-4eb5-a8ce-37a1eba49881", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.200.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e712118c-10bd-4a5f-8877-51a34e62e21e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.201.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--917274a6-9ceb-444b-9242-e39fd8e95135", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.201.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d302d33-bace-4702-a494-95a556936632", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.201.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eab5b599-bdc1-403e-9047-cae615c5eac3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.201.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f6f6e60-c6bc-42ec-b8de-d61d9d3abdab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.202.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da89f3ca-e521-493b-8b69-72fbe3aca1b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.202.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7e8e67a-a16f-4ac2-8e12-01b460511b03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.202.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31b9906b-35c2-4829-977d-a4b58f85a683", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.203.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10070b8c-10b6-4eb2-89d6-e50dc3544f2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.205.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--754c4ee3-e7f7-40db-9929-edf7e9892c21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.205.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d97f4556-bd8d-4fef-be43-f1aba7e5b0c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.205.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c66b168e-7aa4-4a7a-91a3-80a0e2b96e62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--342ef8fa-b1ab-44cc-80bb-d91bd92471fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2233e6d-5060-477a-adee-77241dd902d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c51de8d-05bd-455a-a33b-6467d3f20f3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f614eddc-8308-4e02-adaf-902937df49da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87afb8de-de13-43bc-adbd-1985381a6b6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f45351d3-0972-44db-930f-fceb8b548b0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6b83732-f571-4aea-8bf5-ab779b4c5964", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--605a51a6-8c31-496a-8fbd-4625b0e06a14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffc71a2c-0e75-4554-82b3-42d5a970e744", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f22b78b-b527-4b0f-9574-4f39b8109add", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34ca1dd3-a8cf-4e14-8193-ec240c284c4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.208.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1d6dea7-b2c5-41ec-9006-9feead86a672", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.208.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9131e09d-8ee9-4f80-a1c0-bd89d6dcb147", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.209.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c6c59e9-3bab-4590-8069-cba0179b8c73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.211.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9a27718-4b86-433a-9ed2-97480dfc1bce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.212.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6bdc915-e1a1-46f8-8908-4863990bb918", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.212.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--479aca0e-b286-427a-8839-a38d99701e46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.213.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e12dae2b-f18a-458c-a333-6ac9fec5b13a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.215.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad25017e-c06f-47c9-b676-34b3f87c99c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.215.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd8c8808-69fd-4f4d-b65f-7bf6ed817660", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.215.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7cba386-c8ae-47b7-a3ec-b7155eeac817", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.217.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28fe7e7d-d613-4ab2-9411-58fa38336bc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.218.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cff08035-5e24-4b8a-8410-ebe296f145e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.225.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e40d187e-3014-4701-b9af-ddbcd08aa91b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.225.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1366f371-3d79-447b-94bb-fb71813c52fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.226.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01252741-717b-4c1e-963c-e716a141c177", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.226.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42b6c27b-5f4a-4006-804f-b0da711f3406", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.227.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96527b9d-3659-42dd-b2d2-c93f3ef7de0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.233.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65eb343a-dfa6-4420-ae6b-fef0f0302038", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.233.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1eb5dba-15a4-408e-9ea0-bdd880d180cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.233.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee436102-83b6-44ee-9646-df31143e9958", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.233.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbe9a0e9-b548-4abc-8ce1-3ff81e9d53d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.233.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9aaa79b3-065d-4c79-8e10-e1fb49ed725d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.234.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4fcbd00-2c8d-4a1d-9738-d2ee012987e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.234.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcd7afde-8a24-48da-a2d8-41ee11ae068c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.234.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ce2a340-3683-4c01-86ac-1e6c6910e28b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.234.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c022d5c-9a37-4ad1-9162-03c4ac7f42ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b3166f8-9f6b-474d-a8bb-3ab91c52d739", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd6fe63e-3e4c-435f-873e-d186471a78ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02d91e58-4a9b-44d4-ad5e-ca27eee6f6ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90e79a32-5e9f-45bd-9858-88bb5ca8c467", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.236.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96652afa-ff95-4962-ba50-12f4c240e7e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.236.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--926e6209-aee2-472c-8a0b-9cf2d92c9671", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.236.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec0e1ea2-4b59-4fe7-be1a-56337338456d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.236.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f64e57bc-d564-4fe0-b3a0-4738f05b5cb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.239.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--402d3f6c-388e-4066-80f0-58e5b29aa531", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.243.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41ede246-000d-4c2f-a1a0-4d21189d0169", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.245.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--289a6f8f-ea40-4f0c-85cd-0e53a9aeee22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.245.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--031f9fb7-418f-4401-b270-482b4a755f76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.245.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8688b43-8ce6-4dc1-9883-5b0f096c041c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.247.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2eb55ce-2970-4516-b541-d281c1e640b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.252.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a4920b2-7149-4d01-8136-45f9b6088017", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.255.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd200721-03db-48e3-a5dc-0bc101a91bcc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.42.136.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f403dd2-773a-46f9-97c4-c17301214be7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.42.143.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ad78fb2-aa41-49f6-95b8-e3f3b932c661", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.42.172.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31af087a-f6eb-4ba5-854d-d0051fd542d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.42.239.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--964aae71-af0b-438f-9066-3385de7a1726", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.53.191.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c31aca8-35bc-479e-a6cb-2f30f1c78fd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.53.22.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1037b98-ba45-4528-b24d-4a62997327bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.53.3.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8272210-ab62-419f-ad3a-f2bd71923bd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.56.68.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--775ce7b7-7024-4b91-a3e7-109b021668c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.0.124.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60a5f649-acde-4d95-9bf0-9a372887c03d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.0.126.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd33a932-ecd8-4038-87b3-fcba84366b90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.0.83.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a6cf6ce-b849-498b-b815-b1a982ae4616", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.208.64.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d64da7bd-76fa-4611-8a37-7434c988f23d", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.67.145.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--054521bd-b3aa-4842-a581-934c63871e0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.117.199.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e37d365-a2cc-4a10-b857-507dd5180bf4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.124.129.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6eddd32e-ede6-49e1-807f-67ce5d8056bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.125.117.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cef46242-3644-44c7-a24c-c5c4e4bcd631", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.16.119.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1166822e-b3e8-4583-bf77-3ee1c3abec12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.16.180.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52765507-d6e3-4ff5-bf95-76d572d2149b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.16.180.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f9f107c-6825-4dd1-97ba-4e12b942d1a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.16.180.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28aaab57-d5d9-4cc6-8888-a21f82f4a0b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.56.163']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8422205b-4ad5-4bd1-835a-e5466e6a5b63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--349c11c2-2e55-43df-b510-8e62505df2ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7407e673-0238-4959-8233-b71d8ae58907", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fd480fb-c0cb-4f24-a184-0428a6e10c32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e8c0bb6-87d3-41a5-b7a0-c253392b7305", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d385d36e-2545-4715-998b-f522776287bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c59aa6c1-78ab-4338-b903-a3ee920bfa7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--410400a9-541b-41cc-8d8a-f163bfdca8b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d8f38e3-f647-44f0-a6dd-8d8e355c3829", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01066766-9441-495a-a88a-f426c28248be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5123672e-6e62-433d-a5f5-3363a3a2a081", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--397ae289-5129-44be-8b9e-5d347353cf97", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.209.4.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b4d69f9-44e1-4465-a5bf-94ba9c557a74", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.45.138.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43949f1e-e83f-42f1-a53d-57ab939201dd", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.72.193.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fd0afa1-214b-4dfe-bf14-ac7a0f310b6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--064145ee-8cc4-49f5-9d83-8640332a4380", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f57616c8-e27f-4fda-82df-65747a694780", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e8cbbc1-fb8e-4423-8fce-e8bb226712fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47327190-8cb4-4673-91b6-84c32061be6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93268d59-b69c-435d-82a0-fdb879bc7032", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c02e49a-69da-4ffe-9582-6519003f237f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f8ef5b5-3c2f-40c6-98bd-1d435afc3f54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f98c9a2-9f68-43c4-a884-58dae228132a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ace1589c-8c24-4db9-865b-d500767d191b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e745e4f9-1126-4f4d-b85e-896eacbd3413", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae6f1b65-6e30-475d-a3ee-d8e42b7898ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3535bfde-ca10-4eb8-88a3-f36c51a6f4fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53ca20fe-6e95-4d0a-b179-3bcafa02542a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c034a02b-ea4e-4efb-9f68-a61d48b45fdd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62cb9289-4c2f-4c57-b4fb-5ebb198fb7bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa8cf68b-6cd7-42bd-ac3f-727febe4b5be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--faa12910-74b8-48ef-8399-ede037fd08e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bed7c1c-0d1a-4948-82ee-20147b7198eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8dc53e3-96ff-4e67-b605-514a226d532e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4242518f-270f-4c35-8e43-13b9307b66a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14b6a5d2-6959-4745-b365-26442a3bdb7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--549c7f65-681e-4ba4-be51-b20f6de42e87", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.92.17.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7839b77-f9c8-4f11-8512-47bcb9260956", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.93.60.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63e6524c-f674-4571-8979-afea2cab87ef", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.196.150.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea5fadf4-3777-46ad-82c1-8d200917f4bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.204.126.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a8496c2-df16-4361-a863-e7ce33f82cd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.210.176.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b170d883-dba7-4210-a974-f3077ff3d8a2", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.238.224.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75580cdf-dc28-441d-9458-8faf42efbb3d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.245.144.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92d2e21f-e92c-41a8-9d0e-efcb64509df0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.0.0.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9368e0f3-e170-4b04-99e7-86db8af76047", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.10.107.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dce8fdf6-609a-4900-991c-fcc154f3c0c4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.180.34.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc8c77ec-f0e9-4ab2-bf34-c3f84e4ebec4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.102.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22bde52f-82b4-411f-96c6-455bddbd99a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.190.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fab5e6b0-fc46-4d57-be41-6619ae1cd32d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.28.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e37c655-95bd-431a-ac31-158a9137e72a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.48.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d27ea0e-50e5-44cb-9f15-335ac1c88eb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.172.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--505019a0-5c67-4951-b738-f311d3dee3c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.178.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aae3b8a5-48be-4813-b827-34cb903d37aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.196.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e0a6700-4790-4529-9e25-e2cc3be6ede6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.229.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7005f96-42a6-4155-80c4-41d498c3e114", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.237.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bab758a4-a459-444b-be80-0802d5302fe2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.243.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebc39698-9158-4836-9d79-00e0416621f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.245.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19d7d394-e989-49ff-bfe0-cd45f3448fce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.69.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab48ad95-275d-4579-9a1c-9ee0fd2fa41b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.76.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3e53006-70a5-414e-88c0-f203121fc4f0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.55.39.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcee0719-368c-4afe-a226-7192800a8f60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.90.131.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dfcd3bd-ebe4-4eb8-aa36-52217f6d3016", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '158.174.210.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11b75a33-95da-4ea3-be2f-6aba6669e9ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '158.178.224.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8a50f41-ce89-421d-8fe3-c7a77a3b31d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '158.69.113.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0aa42523-7b5e-4d4b-b194-652951932464", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '158.69.227.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bde6a92-b639-4f34-ab3c-cf809682b379", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '158.94.208.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--960338f0-0c85-44f7-b99a-e8c04f110636", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '158.94.208.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd3bcfe2-9de6-4d0c-8077-fed935621d80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.192.146.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46d32190-6407-4199-abbf-8d66109526fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.192.146.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26705b04-c2a0-4cbb-81b3-84625b8cdc41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.192.33.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c24a30a-04ea-44e7-8bc4-eed274e79915", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.195.79.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01ab3940-29a3-4e10-abe3-6e0b7eb32864", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.102.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c201762a-e6c1-491b-bf0e-e8ad081f1e49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.110.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d12da18-529a-4f3f-a281-2ad637a27fb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.116.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b71ea942-a743-412f-95b6-e6cd51f0d0e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.130.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6efbcc9-348b-40e3-9b1b-7d030ba4c831", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.65.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbe41ba0-650c-4d7a-baab-5f7ffa355c8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.8.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15379822-4cf7-4e82-8c88-9e133d89233e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.161.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--605024d6-d189-4feb-9bc6-084ff126286f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.191.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee4fe639-6274-482c-b97d-7acfeadf0e1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.211.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33a9ba37-0a53-4c6c-8589-70faf491f757", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.4.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cb8cdfc-f32c-44b0-96f3-920b107afab8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.99.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fde86eda-5eef-4f60-90b5-a14a3b0abf7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.117.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0f51291-b324-453d-a157-005d3aa2a223", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.124.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35fbed7b-a11c-4346-bffe-11a609c0aeba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.17.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa9663b7-55cc-4243-a25c-659ec0a99083", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.18.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f511dbfa-300b-4352-be92-56aa2f3561b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.190.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8737379-9f0d-4035-bdee-f82f4e072baf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.191.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--175b58f8-1399-438e-9854-93ef247fbfa0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.227.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d569b77-e74b-41e0-b64e-8f788beac866", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.245.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40f9ea67-4589-424e-a10b-46c3ce0f935e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.69.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--003ca04b-4ca3-48eb-9bbf-e9dedfca9cd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.70.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--334603dd-0ac8-4960-9df2-cfacc1626593", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.91.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4085b931-ded2-4cb2-848e-cb64f9fdc122", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.1.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7935f35-543c-4361-9f2a-fea09a523c8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.234.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c2bb150-b37f-4265-bfe0-a298588a5050", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.47.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--932c2131-bc77-4460-8aaf-3d38dbf58a3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.97.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fe13186-1f4a-4084-a150-b4f0474d9a1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '16.176.125.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed486cb0-5644-4d12-bfa6-dd0be4f5370c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '16.58.56.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6032dad-f8ad-4423-b04a-d4a92ece6e97", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.250.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--792ca16b-eacb-43ab-acae-24d2a281a065", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.69.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4028f6df-1e69-4709-8aad-0f84abe9084c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.69.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d22cd954-0e61-458e-b550-4ee52206d033", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.76.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2edcef4-f61d-495a-a0f8-a825df27dffb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.76.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5bcb9e7-0000-43f5-bf59-936303d098e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.76.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e79a4335-b3a6-44bb-bd26-c2837fd0a72f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.76.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d699376b-70b1-47ae-9437-c26bf0c2ea65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.154.103.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75c4dac7-6224-4f81-ae33-05cb1bc4aa7e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.16.124.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f93292c4-10c2-4c32-bb71-970e7586c391", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.176.105.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b99e20c6-7b22-431b-9688-00e3b44c39fb", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.187.147.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69d5d090-733c-4b2a-bf03-6ef01510c469", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.187.147.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb33dead-ffd8-467f-a2cf-31c562c595e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.238.24.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baf864cb-0b18-4431-a164-4992513fd65a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.18.141.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--250dfec1-8184-45be-8f12-edd216b41d9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.10.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82c69b19-41ba-4d10-9f5d-bce7af7afc01", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.123.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1abad4a3-9821-4504-b5aa-b360241eb418", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.141.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b62995a-5dbb-4b31-8387-123b32573fac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.190.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c63123a-8cef-4054-87c6-0df7299f5853", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.231.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2657711e-6fae-4529-8e45-809ef7604070", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.5.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fef8e12-1a8d-4dc9-b77c-5816ea9dd303", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.50.255']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43852372-dd56-4998-8598-39173734da1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.79.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9601a649-e67a-419f-8f8c-ea024d03604d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.210.245.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec5f682f-5d6c-4da1-8fd5-1f0c8f2631b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d23824f-426f-4729-a509-5978d0401e62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b8da7ac-ee83-4bec-a14d-fda5034548e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c25236c-6c52-4dac-b40e-49f02d7e9a7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93d6fa1d-0437-4cf4-8b25-048f7b29e7bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec0a31bc-ea56-4b50-8cc1-c0c2355d82ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f6bf485-a201-4b98-88cb-071be261b954", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84de227f-b4ea-40ce-9a29-a20352228649", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b293ac06-9c82-4c82-b41d-9070efecb6b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--486333f8-b4e2-4bba-b59a-d0c04cb0b8dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9894006d-f82b-480e-a6bb-a5a8ea2a4d7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae132c25-b7dc-4834-b091-872478f585db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5061f1d1-a6ed-436c-9f11-421fbc4561ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56b21b0c-ce21-44a2-8f7b-1b88c6d72c4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9573fbda-5207-4d27-aea9-902ade9a7da8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96a081ad-7e07-4e5c-a9c0-b7507656f848", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cb2a02a-3566-4542-98b4-86356d50f722", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98265bf9-8501-4248-979e-406b2ec6efe9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b03339a-7b8a-4cf5-9630-fce15a99cc14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13762076-d0c6-463c-a0f8-241b1bd9b0ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d85bbc0-4987-4b2d-803a-93d1ca519ac6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--237b9732-7132-4d75-b94a-2d02fa076d4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40417205-9825-4564-955f-dd968b764f76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3069b211-c3cf-4e47-8c38-e852e96eefcc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd5f2dab-0354-4c63-800b-de8246b7c46c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2effcbf-d0fc-4b0c-beaa-77bec4dc9ced", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a489eea6-f300-41d7-9a88-41380c6cd961", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38c614aa-3438-41df-b47e-7f2c0094b009", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73616525-b9da-4740-9718-263e5118fdb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab54573b-ce40-4705-87a1-21bf523879d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d6a173f-d19d-47f8-aa00-1bc9327a398d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d953cbf3-b193-42f3-ad1c-e1f51e033a96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e261277-35b1-4852-a432-06a787bdb09b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc3c81ca-a5f1-4643-a97a-f70dc5b89166", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cbd2888-da94-45f5-9eb2-37534097e9e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95cca180-631d-4f53-b8a1-7fcbb87ba674", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d739f431-0cc3-4e5b-b0a2-dfa2a832a12f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--103fd768-8c1a-4daf-afb9-e368abbcf29a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e193f573-9b7e-4cbe-a2c8-998ce2caa035", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--362c1650-e7b1-474c-b7f8-3d0b068d78f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7acfd18-60c8-4291-a47d-c6bee693743d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c48936f-7a79-4920-89a4-6e66faf8926b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1d228c0-851a-4e07-a6cb-16aa088b4390", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e0551c5-f218-469a-bac6-6bfafa8ccba2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--176d2002-d7dd-43e1-9709-2d96b1d23181", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25b73193-7505-4583-841f-baa59ab855a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2e168a9-94f8-4285-a9df-6661b36f46db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59d0a054-1788-4bed-96e0-3a4a0a3851e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d5e7012-a375-4f93-8080-7153668fe807", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbe6c7cc-cbe6-4b07-935c-346819c42eba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--863d6cea-fc3d-435b-b3e9-68d88c32dbcc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4adc55f-e724-4b74-aae2-f8e8a7bb722a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea61dd4a-ce56-48c7-ac09-e9f00831f523", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--829fa77c-5bad-4762-a341-72de9041b70e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--691d258e-c59c-4ea7-a73b-b2887a93773e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dc0ca21-df7d-4054-9982-26b74423223a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4e79f42-9e9e-40b2-9062-4e72770bf36a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f088297-df4f-4a9c-bb44-151ca39c9fda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af2ff6bc-1de4-40ca-ae3e-f5ecf40c55bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc08b0fa-f92c-44e5-934d-8c971899ebe1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--946f8bd5-0b93-4ff7-8ee4-04ddceab987d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66f9d389-871e-4939-b3a7-f8aebb785b9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89c44155-41a1-4776-8018-da158d7d34e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb54c50c-1dda-44ad-b153-040217414cc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e26ba93a-2661-4c1e-b9be-a57a3b1c0e47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bd5b4e1-db74-479d-a6ba-65673dded10f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6902aeec-a1c8-4bdc-b631-ad152aef5b9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f826b97-0304-48f1-be52-8b5a8f3069c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0802f2da-5629-491d-b286-d36015fa03b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b89a9c04-a41d-4353-b898-9b286ed16b09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a64cbb6-e786-431f-8bc4-e0755dfa5c3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d44c625-9420-49f4-b354-3e96c8e804e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8d76656-9cf0-40a1-9926-70f868eb73cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a5a6db0-ee3f-4cd6-b65c-7015e2406961", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f84859a-f22f-49aa-94bd-d7f220a12443", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2c3f32b-9fa0-4c9e-9b67-8cc64455b140", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cb2aca6-6dff-4557-b773-55a392053e82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdee6a84-5d30-498f-8e57-7b556a6be4b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc7e009d-eb75-4185-8823-053465ef4a0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b67c17d-abf8-4134-b6cf-01e5740cccf4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40bf04e2-c0c8-40b3-ad6f-c298745c33c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d6b0a8a-39ed-4f05-af75-a0d799b9d05d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed3a29b7-eb3e-463f-88d1-34e1e6bbac85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb617545-90b6-4e43-84f5-df8934bb145a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac77c658-6102-4b9b-bd35-6a67a49464ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5c3321c-a795-4b9e-875b-2856fc12ecbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82a81055-8c54-4178-98ca-1aeb7754cf7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72696e25-394b-4f7e-ae13-05137557b736", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d64895b5-09ba-4e57-83da-05f129d8b0ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b9890d6-c35a-41aa-8bc6-d2fb86c4ebba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39996a8c-1188-4631-a89d-c066a01ee148", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c442f05-b47d-464b-bfb3-a752f2384943", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--149c2231-db0e-413a-a95c-5c06b028ccc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b3e1509-3da8-421a-807d-017ae59d740c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23d7bdea-181d-4bfd-a5b2-4cf47da69c8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9cbeae2-7cb4-483f-b5bd-d3a223e89c0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71722c39-a66a-45ad-b995-8d5cbf4345ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bc85224-cd92-43b8-a903-5510f9f26065", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78826fbd-591f-4543-9005-20d64803d23f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a312a63-0792-4a02-8140-ed79d4eec916", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17e32042-b068-40aa-9edb-d416860a854f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8eff53a2-c2f6-4930-b5cf-ead3ee692332", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5995cfa-c506-4239-a86f-f387e91ac94c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04a0ba21-16db-4947-ba58-db059a86e34e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1f6371f-0192-4599-8146-134197f7df30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5996d849-4a42-4201-929c-ea9d86443a98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--443367a0-1826-4745-a2d1-e6cb4984e80c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85454ca4-04aa-417c-b63b-552488fbfced", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17ffe764-cd66-4985-be83-6f825a24cbc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51f3e48a-6b7c-4c3d-8a8d-b50e2dc3bbc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9a6be10-7dad-42c3-abf9-605010182566", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0fffb63-69cb-43f0-bbd5-8823b6e89db4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--036a2f73-c337-49e2-b681-bbb6f1be851f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b075dc8d-6615-4ef6-9961-4d32eab18415", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e01b80f8-e449-4841-9385-791df5a57fb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a18147c-b907-4514-9c5c-2dd6ceb0f064", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4a14e3b-85a5-4188-b9d3-a99ca362dbfd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fb6d638-7926-48e2-9aed-f3722209cd0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d1c143b-26f6-404d-bbdd-9a13205d7d35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c951200-4b62-4793-9c0d-ae8b89de6868", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb77e887-b229-4b09-a8c2-337be50c07b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df90d137-8f70-41ad-944d-257555e5d1f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54c8be91-ff16-462b-b49e-6d26802ccde9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b47976ae-2018-4024-b081-879e295850e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53b93260-60f8-4a94-a1ab-25bbf4f8a6c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32645184-70b4-4171-9319-d29738ba2562", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a599edae-c288-492b-b1f0-f08801293e6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--595397fc-1041-403d-9b47-b24d1183db99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f68f4a0-9148-4707-9a35-b3935c25f999", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac1cc6d2-cb19-4916-abc3-5c7e275ec758", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a7c315d-b9e7-4599-ab75-27224e3227ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcc95a2d-45f6-4493-9506-7de82caa5bd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0778144f-e5c5-4691-8f8c-d56aa9c3cc41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8b0f53e-5a37-4d71-8b3f-86a07cf45faf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dce0ec54-6b29-4d31-9a3b-f59308bccdcb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d165d526-5f4a-4840-9446-7fc7a1f45591", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8231f264-dfa0-4528-bf82-80b57d9cad31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--402bc653-1376-43ee-b187-ef259371924c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26dffdc6-279a-445d-936a-cce6a70f7de7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e4de772-26e5-4853-abf7-865f9c0af8f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--446f8939-a3be-4ad5-b2c1-d1cc5ae6d3b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f01aca9-7f53-4004-a31c-12dfb83a94d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a5c10bb-85eb-467b-a171-856e923bf585", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f08a727-7914-474e-8df6-49309ccac34c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d50324e-f12a-48eb-944e-e898229432e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92e77aa9-a4f0-429b-9acc-387d309d298a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4350ec6-3507-49af-b830-65c2794b3988", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b18f97ff-e4a4-4448-8bf3-b41e03f23097", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f19f181f-25c7-4b33-a51a-231cd0904b10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0e83861-c6c9-4c96-8854-db393d76ca5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24b960db-755f-43df-8c88-8e86b2859d46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9493241-078c-43c2-9798-009717a73c9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--733b610b-eb23-4bda-8292-06080fd4ecce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d8651f8-194b-4115-8618-7c0dcfe34771", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9df8cc0a-6a99-48ce-8b3a-f2f38fc15450", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18cffa03-cffc-4490-a710-7bb71ee7a1e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c2ac0a5-d800-48af-abe7-68b46aa6727a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f44b071-7f24-468c-ade7-3c21e2c7d931", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--331e9916-d34e-4d68-a9eb-0fc05119b807", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2cbf4b8-7074-4908-b406-a1cc6c6be33b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1463332-5c9d-4a45-abde-7929ebecb4ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--520407b0-7410-44bd-acc8-b154e85b14a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2c7413a-7686-4fba-8e52-8ef4f8445c7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4183a84-1423-415e-a2d4-75178b858953", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1bb40bf-aff9-46fe-bcb7-470f4a65608b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1911750-2ca8-4a1e-add7-8b9b9789928e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f556b01d-38c1-489a-adb4-b417bbb3ea96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c81b7d1-8c13-4a3e-9e07-3bdf8e04a2dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3a67026-3a8a-4223-a828-b8250c78fe87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd95324e-4a6b-4dc3-920b-0636143457d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44ddaadd-92d9-4ef2-95b3-082fd1337a46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--533ec9e2-16e6-46a0-9dbd-f7a90d652901", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f98e4b7c-7436-49d7-856c-673c7c6cd4e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7482f773-95c7-4323-a4df-7086d42c9eeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35ec237b-a902-438a-8c80-a9fe25e7892f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d281677f-2d8a-4b07-a362-180505cd8124", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea1be919-d5db-4e17-b401-9a4a58cf406c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--910f724b-f33b-432c-951c-ac3033ea1656", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c1ee8a0-d907-474e-a670-fb72a0ab4cc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38e9513a-6ab0-4124-859b-a6e6d8701ee2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--272f89c2-e1cc-4156-8be4-51e2ffe652d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e91a498c-71f8-4f15-8272-f0900f740f90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28f26526-5fa8-4311-8f60-984da2ecdf13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90b03be1-dae1-4ed4-81e8-d9a0db32afe7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4d4159b-7d5f-4af2-a78a-e6310edf66e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daee3bba-4fb3-4017-ab05-f8e4cb159d32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6d996f1-4dd5-4d74-a624-6327f4458221", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e53ac31-6688-40b7-a1fc-42ac5f4a07f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a596da41-a9ec-43cf-b515-b6585aa1702e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1aef0308-cd9d-4d56-a8a4-1d8e3c8313ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa9cec45-26f2-4fbe-a57e-68a1b504b75b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e844f83f-3401-4e67-abb7-65daf49e8822", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00130adf-9f4e-4339-a412-ab82cb24c182", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f81c7555-78b0-46cf-97bf-e04d765da467", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--763cfaaf-42b0-4292-80b7-b626335a8c2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b616e331-64a2-48eb-a4fa-100469b12fc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc5f47c6-0bd3-4bed-b51d-2cd671605013", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5702e6d-eaab-42f5-8172-2bc376a42716", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27985d99-eb69-4f5e-89ba-3af33a09d719", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f807365-a0ce-45fa-8ded-94ef52d58548", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08864493-7b28-45b9-bdda-0d12a690864e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86a13a14-80bc-4c7a-809c-dc90a782217c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66607288-479b-443f-99d5-0a536157eace", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8715591a-96d2-46ba-9704-8227767a4313", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01eabf7e-0894-4542-a123-336fa79f5b3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--064f4929-e8c4-4b16-b05e-92d4e61cb6af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--302eecf3-b487-40cf-bf62-cca195a91b51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ef69d6c-0b14-407e-9b73-907d4a7eb031", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--431e4547-a5d9-48b7-8cd7-a9d1a354eec4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b10825f-c846-4c30-a2b0-fee68d1553b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--824cc709-fa21-4a95-a305-19750fe5edd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61a5c22e-1e5f-4699-bfa9-c4321f03a0d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--356c945b-5f5f-4aaf-ac06-07bc9e1e7ff3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5b5b707-ccec-4555-b908-4990c41a1de2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81c23583-001d-496a-af04-c612fc197c93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--513654dc-2623-4959-96e1-1c1b59cd59c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6f1685b-578b-4c25-bcc7-87364c563bb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65556829-4d35-4c4b-bda8-86fec406150f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1baf24d1-73fa-48c0-bd64-4c2a7bee749a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74052187-4990-44c3-aab1-22ca029b6ac7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a044cd4-e9c9-48e4-a8c1-d7034c1ba982", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24d8674f-6af8-4509-b57b-3572a463f8f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b59dc970-b143-4225-ac3a-dfcb8d24912d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a485012-5e27-4be6-b825-0322537ec889", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89750b36-bc61-4d1b-869e-3781ba00702e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eef6981-e70e-4a4f-9909-41262ed8b98c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d90f641-427e-4ee9-9c13-694667d316d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--035d62ef-29e9-4b27-8c16-7dd634c6ff47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cb450e4-fbfc-4995-b7ae-15417ea661b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3736944c-ae3c-4bcf-ad6c-21fb1c9b1bd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acdee2f4-b739-4097-a962-becb6c55652a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39490d0e-8974-4108-87d2-61eaa7431ed6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64d9a23f-21e1-453e-83f2-511b84c7172c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3670f563-1420-43fd-9410-22e6eec9ef55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d0edd73-cc13-408f-8c1b-bc1c5ac4afe6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88c0d3b0-19aa-4e69-b241-1defa2db2418", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0da2eaa6-153b-47df-ba9a-fa9d92e571b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a7bdeec-4d26-4892-83b0-75dd82418139", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80717376-3998-4434-96a8-b0f69a5c222e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3f0173b-373e-479d-a9ef-899d3ff96ea4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--653c7fd4-94f7-454e-8db3-53619a84de0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69534325-8b5a-4ab5-8e8c-505c204c4a97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e945308-0c69-4406-b01e-2f48939d0011", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28d6b63f-ae7c-42c1-85bc-48a3f96a6fba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac90cdda-33b5-4037-85ef-f6e475f9fb91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e051d9fa-ae84-4655-a13e-2b33dc2140ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2182b2c7-3635-44cf-b56b-7f6070f329b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc3711a1-4c78-49d5-84de-a2cefc2686ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2b3455a-134c-46e4-afa2-2799387ddc60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0505a702-5a5e-44a9-981d-dc7d7d68ff42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d7c9566-067b-40b9-a63c-9c953c3e5808", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f381a38a-260d-4df2-ba25-405c14732865", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1722417e-0022-4ab1-ac5c-95ac1fff2295", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c17f2a1f-7ded-494d-bf42-46084fe3c587", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--996c7d35-ad0f-476a-9886-a2a8cd1e70e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--563b0bf5-e347-411c-8335-47bbd4397656", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98fa1eaf-d871-46ba-99b1-0329af93edcc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fdbf785-6a7d-40a4-8a18-8071b3c3d974", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6978d4c9-3151-4cb8-a41b-6bcd6545ab12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44e3d7a4-b893-46e2-a5ac-40cd9d0b60c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d386112-872c-488c-8997-4fdc14d5bfab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--945af1d8-006c-4b08-867e-481c1584dca6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c4782a4-7197-4c86-9bfd-8727534df91a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efac467f-7c87-457f-993e-7b3d876f7484", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a16caa5-9cc8-480e-a34c-68efdcf1f268", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab33bdfc-e676-450f-9366-a91814ab6f9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f97e6ed-15c6-44c2-99af-e9b13c305b06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a3a19da-5677-4502-ab0d-e9f2cf87cf45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e527f581-971b-4a6c-91fd-031fb978e9ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49e0d98a-60ba-409d-8b8d-61a66ee5a09e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82f9023a-1570-457b-9175-bf06e1b720e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa0f797a-e1ea-4b79-b5b7-507be509ac35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a16686b-1f27-4ab6-b5ef-22f27d58c7f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6ef8e37-f56e-4fa2-b2ea-37fc5dbd74f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecb9c26f-260a-4c29-ba1a-78128fdb0537", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--620611f3-0cc3-4c4c-8237-fe22ae90d273", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--926474df-f11f-4b88-92d3-e17ee0f4c3ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2b708c9-88a4-464f-addc-cbdcc4db55e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b646c488-7dc8-464a-8c8f-c1204604e391", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--160eb2df-508c-4aa0-819b-95d19c87bd1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43fb8fc5-39c5-45ec-9fac-8d00b8d52306", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ca30c3d-e3e1-4c50-b45d-02468da9f782", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1b7da07-2de8-4478-bc99-ca05b5ad2fd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b56e0317-4e84-4470-9a5a-8f7c4748a0c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26bf74b7-df69-487a-a8b4-76370b03707b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a38cf514-6f43-4b21-8246-40e076d40d0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf27c208-4e90-4ae6-a059-42d45530372a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a66ae81f-1aaf-4611-bc8a-19cbd2583849", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d08dad9-af55-4386-87e8-8520b8ba9834", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93f0b74d-f205-492f-be52-c6ca05ac9331", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b7bd734-9eaf-4bb5-8e61-d1c6c0c2a0ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfd380f2-a1bf-4aad-991f-7f472e092658", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d60c3c75-e394-4e5c-8b6e-43ba4c59d603", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d6b7d13-5b07-47d5-9d5f-04f176386e98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fd9694f-ea58-4f8f-b8cf-b75fd9bb9443", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b8cea5b-79e1-4c6e-9845-c1a0a21832e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e40ff04-31f6-450e-8eca-51a9c1f7fd43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cc75446-dbd1-4ba2-b4a9-69e4d456b58f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf6de188-95f1-41fe-a69d-3081e9f0c3c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d40422c-2518-488e-a6a5-8a365076c7ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a056734a-15d0-4b5d-ab7a-b9d9541a6a1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44fa1c92-89ca-47f7-a562-38fe63cc10c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--236970e6-a53c-475b-aa85-e8ffd883565a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14167b8c-f49f-4d4c-9f50-a8d5b9ff780f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b6e6ab3-46fc-4469-ad0c-c40107eb1098", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64129437-dbab-44f8-8558-94da25f07f2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba60f951-d615-42a7-a3c3-1a00bda52e03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--145316f3-91de-4a5b-b77d-04a233602eaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--516838be-9163-44c1-984a-5b8f909e485a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09d20580-0c89-4858-99b0-fa71d6cd99f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9768c69-9b94-4ddd-8fd7-24ca92668bc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ecd0283-a897-4ad1-860f-7261cc562e38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c1e7c91-85fe-4a1b-a5fd-abc4bff267aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8838d9a8-84e2-4ae8-8959-b167b37d52ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d5a90ab-5860-4d9c-a519-4831ee453137", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54662efc-c065-41c6-a283-0658e386be41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--364ddf8e-d897-4139-a1ed-9fa1078aa5dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbb1ac35-f04a-47fa-92c7-e5579182217d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--212c4e8b-9d33-4562-9550-ef4bf42ea2d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41584da1-4949-48b4-af81-a457eced0dc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2068bce-6c97-4a24-b317-5bee17c10b53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55b1f232-e2a7-47aa-87b4-4a3a7f2daeac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1568f9de-be1f-4401-8c33-4596b6c66ab1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19c32f81-c183-4726-b81a-914abfb60475", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb015b6a-27a8-46b6-a9ca-1013b1b9b702", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06d207da-4120-43e2-a595-77ff2a6b7b70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ea2768a-a1d0-4f7e-b6cf-2454c2d0cef4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--887e40dd-fc85-41ce-8f87-5f47bee4090e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--304da6bd-2ec0-42a1-833a-01dc696f9f5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5581017-35a6-4a92-b0cd-cef7eb03e6a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d18de0eb-a62a-4215-9cd4-8f8cb43a4fd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cf7aa78-0393-494a-9519-3d964d197f76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b4f68ca-bab1-46d9-b823-61cf0be3ae5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46c5326b-ea36-4c0d-aa34-eacacb88bd46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11cb19fc-522f-47d7-b746-f26b73beb67e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--313e098c-3b51-4832-9073-4ba13ba4082b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ce5158b-440c-4705-8eac-b938919563f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2eec4167-1d69-4137-8266-0fc24ebfd8ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eae632b8-c771-43b4-b3ca-13a3387c4bb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4ee0a4b-70d9-41fa-9fb7-c9b401d356c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb769d0e-21b6-4679-a676-97b07fcb8f6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dd37a20-d18b-48ba-9482-16666eea0631", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fedacccb-ad08-4f6d-accb-e8e6370feaaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45dd398a-4449-40d1-907a-47c094e5d6eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddbb7d92-ff8b-4a89-ba68-9fe10a58dc99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8bbd3cc-52fe-416b-b503-81156b6b83da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c9bf145-dff6-4d5b-9b9d-daa93e785402", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7543bc1-59b9-41f9-92b3-29a8c8bc4045", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18882a00-5a47-436a-8a02-7c49ea71224f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed49b123-a492-4c56-ae97-4c06c17d7eff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eefc6acd-0f5a-42f2-8147-3f3b8b7d20ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c8f3002-774b-48af-8c9d-5082f035c1af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd78ac17-e85a-42f1-b18d-07a65ecdc18b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f10168b1-7593-44ba-99dd-f176c3afe087", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b61af116-d928-4e92-8c2f-7bd53053bfe3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67bda937-b6fa-41b1-ab0e-5e1fdaa67c67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2597b77b-dc39-45fb-b6e2-9221eb374be2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11791d43-1e13-4aa6-8b7f-00f3661c2e2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ec1b814-fe29-47a0-8db8-fd7e6655ad6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c63ffb3-58b0-40fa-82bc-2f05eab538f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55349636-ca54-4d5f-86e4-3c0e20fe310a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--566800eb-c671-44e5-9c9c-1906b2a67893", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93e2d005-6c31-48ea-972e-50d68d1af71f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.16.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--952cd4bc-1542-4959-bc42-0a69fbb194c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.18.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6adba6a2-cbc0-4197-b253-e7feb1b5131a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.243.114.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a6119f9-f48c-4be6-ae15-9a00985ab6c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.243.116.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--377ccc1b-6ced-42e5-a127-509b22bd9dd4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.243.138.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d33343e-662b-4ccb-981e-5f6d13d783ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.243.164.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03103db1-26c0-4878-922a-8bf4a9a33bb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.62.120.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90829371-47bc-4be4-a84b-3cc16898e264", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.172.137.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1ce916f-0568-423d-ad07-40a8714b3e87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.172.155.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8535df0a-5854-41cb-af46-9d8675c1b46c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.172.185.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c41c857-1c46-4858-9381-1c4d48a42558", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.192.217.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b19bea9b-dc7a-4d4c-a878-a7bfc577f8fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.223.54.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4eb2f59b-3f0f-4eaf-a90f-97fc789db56f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.61.156.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d707388f-1ce5-455c-a143-6a8f99d3487e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.8.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ada5bd2e-11b4-428f-a479-77a5e7457591", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.163.24.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1149b011-6f98-4917-aad4-ed917adfb127", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.90.149.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad4ebc39-c2ad-4119-88fb-369df8517086", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.90.173.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a4e277b-3d4b-4a9a-a163-1a35bb591b7e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.90.208.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--837fdf70-fbb2-4e01-b775-07198ec7e362", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.100.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86261bf9-f989-412f-84b1-fee97d4e9f85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.125.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58a893e8-9ec8-4519-b20b-e7ed7238f983", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.138.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cd6512c-2b0a-4b75-bca8-b3a5b243a692", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.148.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c78b0299-321a-48b2-8977-ddd44972c483", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.167.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c027ddc-7f34-49ba-a422-51500bb1ae53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.171.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00eaf6d8-82fd-4f0c-b507-1de3b398f0a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.178.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdd29486-e3d0-4100-b7b5-4e4169e8b5db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.207.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e23d6b84-ddab-428e-8b97-91c4cac4a0ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.207.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac37c98d-25e7-479f-b79b-5f71697293a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.232.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbe8a2c4-8cce-4c50-b5c0-0aa1e46c0a24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.250.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--981d50f8-b8e0-4909-be53-3f5656ba3ee0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.77.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21efb56f-0c61-4a34-a57a-710ec5feca11", "name": "Malicious Host", "description": "Observed: FTP, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.10.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ftp", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c388339-255d-42d7-809b-6419c0046354", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.10.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51e3c0f7-d0f4-4c4d-bb57-07fc294f285a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.10.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb1fc2c0-0399-4a1c-a792-c17c3aaa9119", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.10.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3c4be07-fda7-4972-ae19-7d03318bca95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e095fb8-3687-454d-bb0c-0862b5f0356d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7aae08c-f363-436b-a24c-8bf368af5d9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e68e7a73-25f6-4dac-a047-6c5ce293f197", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34f11866-c5ae-4147-b155-811d729006a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9120472-323e-4630-9ca9-6e439ce4de96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.118.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb039616-8634-4252-a859-029da3a7b9e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.12.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6778b9e6-10e2-42a9-9bed-792907d8ce0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.12.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3d02c1b-e475-4dc0-8089-f8799a6e2aa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.12.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2a5a2bb-3ddc-4435-a104-30cb92d76d26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f58a6bfa-586f-4c50-97c8-af7fe1de24ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--920b5db2-9e67-412e-aa24-0ed84c089c6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea3fea00-6b4e-4bf3-9e2f-687f0eee97a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b8716a6-fe18-407a-890c-87689c1f4963", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c592cd0-4327-4933-ae6c-509d50d5ec07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.128.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8732266c-46c7-4268-ae9d-28499508e328", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.129.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1d953be-3b11-47c5-b7e9-df8143dd8f9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.129.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce11f4d6-c561-4afc-a881-68daf7de085e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.129.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f30b07a-0a86-4209-8723-96015b4b73c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.129.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a055ae25-c57d-4185-b910-60af6a125fe7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.129.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--079483eb-0554-49ec-9d43-778773107f6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.129.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a2410a6-de72-467a-b276-50f4fbec7a77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.129.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--173345d7-80ab-4325-9f89-c670bcb902e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37af8a1e-a173-4ca2-9e5d-c3e014e212c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b6f3f20-f4f3-4551-8321-d7a49410bfa5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2db3b2c3-d105-4885-8f48-a8f51dbd7aa8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.163']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d072c163-6a60-4ea2-8149-64a33be83bed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64975592-399d-4afe-a76f-84524f622768", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e8607a6-61cf-4e96-a929-1fd4d9f6ac6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7abb2855-6c1f-4224-acbd-bcbd37146d99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4753afcd-a93f-4345-9c36-9db161c556ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3b2ab3f-2c3a-490c-93f6-d86e0ae07095", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c858340-762e-416b-b62b-d760a5da35fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb1395f7-83bb-46d3-8f2e-4162609ec062", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2e99f03-1a1f-49cf-b4a4-2f3fb20d487b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--554838b5-ab7d-4f4b-ae6f-6f3484f0f746", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--598bd10a-498c-4680-bc09-cf87d0aee52c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c6f1e48-cbdb-4638-a50f-0ae728d32057", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe3b6f83-ba93-4b9b-8c6e-e6dba4ebbcf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cf4487a-bc17-4b73-8151-a73edfd50535", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fb97986-1da4-4021-a2eb-12ba653f7313", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.151.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c636fcff-a9b9-408d-b7bb-c315277ec598", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.151.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7758e5da-40db-4509-8542-9fc411764ca3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f045939-2b4f-497f-baca-004ccaa62ed9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0695964-a52a-4f11-9087-d5303e07ef6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3af34e2b-97a8-4712-91ba-d001031148e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3956cc85-24ec-46e9-bfed-02432da93467", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90feaed9-19c4-46c0-b00c-4975e997a90e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8efd5006-7cf8-425c-b7a6-1f05e117d98f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8492e6df-c0b4-46aa-a83f-022e7f8098c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45e9b18c-8c26-4136-9517-d317daa8e7a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ff44f30-204b-407a-b84b-e0b5bb8738fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b47dd9b1-5c04-468c-9d9c-f5517b9c9370", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dad2122-92ed-4b44-9c2b-6a004bc13e66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d17ea2b-d695-4bd5-9766-000cc956b121", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2950ad1d-f194-4c27-93de-d6c2fd85236e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c929555-c576-43a6-a1fc-22be137ebdf8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--755159c9-da95-40f5-828c-c01d0b9e4951", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d14ac3f-d9d0-4248-a410-a9c49297319d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e2cf894-c5bc-4015-9984-993a7cfe5e3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8409e8db-337b-44da-b490-0c2354f2ae19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ccdb3ed-f94c-4d50-83fb-87db922d51d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--275b0fdf-e32a-4914-9b58-cdd974b18579", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd7df996-0f53-4317-8087-824ccacc2034", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37807f96-d04d-40b6-ae6f-ee9aef935e55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d40d08b-0f60-4738-b1d8-6207795c3e62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cb44f25-ebe9-4611-943b-8161b898d1c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd99d236-551b-43b0-bd21-0fa87788ffd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.164.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6ad9614-e61d-45ed-bc33-f179a509d9d5", "name": "Malicious Host", "description": "Observed: FTP, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.164.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:ftp", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb07a558-a3e1-4386-97c3-fc788386ce1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.164.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a408634-9ea9-4e3a-8a4f-e8c6e6e93a97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7232e177-379e-48d8-9925-577d51c88169", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c6c5daf-684a-4a0d-8aab-48f9529c5e3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16af2154-4873-42ed-bdb6-6849de55d212", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8db62350-ba3a-466b-8c59-416fd73e75d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b094cf7d-a8a8-4638-8a8c-a11b09e427d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f56d5ad-1876-4144-8397-85d6bd062a50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c62cbef5-6029-4c56-b524-a8f158763061", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c56a7535-b11a-403a-b797-d130807c69e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c014e437-3493-4f86-865a-27d9cc490920", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a06c558-1fc0-4498-aeed-bfe901b4e803", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b002433-756e-41ca-95e7-bcfd5398e6d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26105f76-ee5b-49ae-9468-cb24d112802c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f5d1cdc-5ccf-4747-b09a-0cd5fbef1b7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d199f484-8410-43a1-841f-786962c83cb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d424a5dd-ac5b-44ce-ad0d-3a02eca19309", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a21ac3c1-1fbf-4f52-a8c9-3a3236853cc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78ed1f47-cf4f-4bb4-9340-0eab2ea3f019", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3883784e-b4b9-4a50-832d-ecd04d611a33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a56bd2b2-91db-4123-b97d-45b20a53da65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab2e0773-5b24-4f63-9a97-22e50bd71d26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56273b28-71a2-487b-8215-86fb4c16ac7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9b6dafa-9c97-40cf-a7ed-5a979d061f11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c5178f4-cdd2-4a40-bbef-481961461302", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e317cfda-73ef-4050-bb38-387fe89f311d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfa0944f-ccaf-445e-af3b-7fd978f4d2a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b520249f-995d-416f-87be-60fdc7de7c78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2a7afde-6d64-4aea-9177-f097216c6dfd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab3ff3c2-0919-41ad-a94b-0ea42b1f77f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--123220bc-5179-49d9-80ae-243546b4a8ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--288cc8ea-eb20-41f7-9259-b1d89a4e5083", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de1b93e1-0732-47b6-9a4d-5628f9b5e98e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13229a0b-b9de-41d6-8f25-6b1173ed693d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02bb143b-164f-454d-a08b-cda2320da74b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--890b8ce1-3133-4b77-85b3-b970533e8814", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--081a3914-2edf-46f4-8e16-18f67038afa6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0fdbf83-7d1c-4d2c-8c5d-92c8a2e60043", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8abdc2f-2976-4b2a-aad4-8f06622ac421", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6701db9a-89d1-4caf-8a71-f83d448da244", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--854ccadb-1f13-449d-b337-73d9a882ac9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8173151-838e-45df-8a2d-37181d3aa59f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a34af67-2a0b-4a70-9c63-f43b8822d161", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da723568-9fff-464d-bd83-8cfcc20a35cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4b4b285-36f9-49fc-bda2-0d9de273d902", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6066612f-7c03-4096-b002-249511ef69e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82958ef0-ccc2-46ce-be17-5b749226e7ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.174.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6e1cd4c-6894-4aa9-b0a7-086c3cb93c3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.176.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19b98588-3f8a-474d-a63b-0f7844181777", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.179.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f32339a5-433d-4c3c-affb-d4cbd5000df2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c995f498-21b8-428e-bb5d-63273333f42c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28e8f067-f378-4e2d-a711-b83a3bec2451", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b48b2b9-4fa4-4bee-a7b7-09fb0b441680", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--872042c9-432c-446c-9a63-21f36f7b40a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afe2a9f9-2204-4812-bdb6-ee3e2bd987b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a90dba6d-8e43-45eb-ad8c-bd7910da9374", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cce23122-4e23-4636-9bbb-7fe5e7998578", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94eb8e52-f72b-493e-b347-f9fbf42a9e41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26ff6f41-c4aa-483b-955e-c8c6cd3af94b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d1879f1-712e-4cb6-8003-7ea23afc222f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df264123-3510-41f8-85cc-b288c87c505a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.187.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0378fa7a-d54d-42ce-aa31-1ae94dac665d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8819ddc8-88db-45d4-b814-02d371bc66db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35890783-9a2e-4790-8f5f-0efef5339076", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fb5d5ad-56df-4334-8f96-5f4f034e88a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94dd0ff4-1509-48fe-9e70-c6a333410218", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be02bce3-896b-4267-a9ea-7b2e9c4e5e07", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.205.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8ac5711-fa8f-4c57-8844-6c8b3add257c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a90036a-86fc-4ecf-8843-30290481305d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73648e40-aaf9-42f1-a78f-21915d5c7c8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14735dac-ce15-43d0-94d0-2f3b88754cc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--012f2962-40ca-43b5-9cfc-655724d73b67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ec75e27-8bbe-4f1c-ab0b-56e3a12997ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c40b79d6-734d-443a-b66d-8c7eb6019c04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fa52cb7-9d8f-44b9-8386-d6fc5f92c689", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.218.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dbdc9a5-2f2e-43d0-9005-988fa312c9b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.218.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92518fe1-df68-45e8-8c98-25d03c11d7c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.218.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed7d6d96-744d-4ffe-9668-e996ef3ba22d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.221.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--102b2046-3f45-4ee9-870c-d45d158a638b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.227.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e59b61e-a6fb-44a7-946e-aff03dd49dcf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.23.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81baf560-39cb-4c22-a541-6df103973594", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.231.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c541d86b-66c2-4a00-a6b0-2613b2f90563", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.231.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a9e5d74-14d2-48f4-a25a-380a1f873680", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.236.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3bb3975-c2b8-42f2-82a4-0b109bef6655", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.29.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91193468-1951-4309-95e4-837e861f0039", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.33.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d484283-9ba0-471d-9cea-77e7c5dd2092", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab0b853d-8c19-4e6c-9648-b245805e5a7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d39870b-b3e3-4d49-9dec-d9c947b0f525", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--770dd859-6079-481a-939a-619a65a434cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6d12955-db38-4bf6-a914-750b50160cab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5f6d006-ca06-47a2-8a85-3ee9f51630f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1006b165-cb18-4335-ab46-c0aa3d530ed6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--969dfe85-945c-4e7b-8182-4d7fe35d788a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.40.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f344559-1cc1-4dd6-b9d4-1b8eb138e542", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.40.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac9b2a9c-4bf6-465c-83d2-e0b8d6762466", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.40.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0b9c05b-fe3c-4f81-8ec2-a58c5fd67754", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4a95cd8-575e-4398-899a-900d50cc8b77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afcd1e0f-e019-4d3b-8f56-01c9e55952a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47ddbc19-89c5-4609-ad40-fd9838c40387", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f500b285-d38e-4c68-8494-b7fc337da7e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35321ae4-fe94-449e-ad4b-29c8c7636bb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbf5585b-8953-4e0f-881b-8d91d9667ca2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66e3a847-1cc7-40f1-a37a-8e4e78c7bda1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49b3ff1f-0227-466d-911b-32c16ccfbe6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e1c21e3-035c-461c-a1fd-fb677c42e09d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.42.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95042a98-99bf-4519-b714-19d64d815f82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.43.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbd58cf3-ca37-425e-aafb-a63ca0ace442", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.48.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a5d3f44-b2ca-49e8-96ea-3d95a04655f3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.5.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8950ad98-489d-49e8-ae7f-20d714cb0bf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.51.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72c2c52e-5542-4002-8960-e30b0103c640", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.51.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--246f64ce-9340-4f76-9601-bd82f3ad58b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.58.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--223dc8fb-11a2-4e25-ab4c-78928ddba562", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.59.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fac43fe-a372-4dec-8aad-b79f23fba29b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.6.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--747b91b9-789a-4caa-8e10-c87413608b58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.6.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cfb5e91-98a5-4242-bb93-de223ea16f4a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.6.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f575db6-a18d-4519-b782-af73e001df85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.124.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--181b4eb0-4e48-402c-8d40-d48c99f908f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.158.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba90dfa0-aa50-42c6-83a6-bcc43622c6d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.180.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5f762fa-bcd7-457d-bd82-d25fdd072306", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.189.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f9bcdd3-f682-4ca5-9d36-ca13650ee38d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.193.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95c1bea3-8943-4ccb-a386-075c669eefa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.224.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16ab0811-f042-4fe9-ad2d-c9626b1df5d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.230.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d701664-57dc-4e1b-a587-f87ec6ba3302", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.24.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5b1f141-2c92-4239-9696-e98b55eab7ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.26.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f83c4090-1791-4cad-9cf1-a19b07f9561e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.39.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be8017f9-23ad-47ba-ae87-acd28d7dd6c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.47.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e684625-9692-41e1-91a4-c0d6a03d79ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.60.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5d173fb-7f65-4054-932e-518cc133dc41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.69.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abf28d2e-37d2-4aaf-843f-436fdf51ed44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.103.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43009c4c-8fca-4340-b2ca-2ebf1eff5926", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.117.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86ce4a4b-0110-4f9d-a867-4105c2afc9a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.148.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85a74485-61d8-44a6-bb55-ace32ae53872", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.15.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcacf1f3-9805-460b-b1be-9829459ebf1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.20.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28310990-831c-4ae4-9398-62d06bbdc6ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.207.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2c6b724-7a3d-4166-82f1-927f81074bae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.54.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84e89924-8206-439b-bf62-28040cea4284", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.62.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92d692e6-4c34-487e-9fd5-293305b89863", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.95.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42a25910-b5f5-4bec-b1c1-128866db58c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.151.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4af04995-ca18-4143-9b12-f8aac2be791f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.35.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f25d5a8-4788-4a48-b682-2178a9d3d3fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.69.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95b78072-f638-4c03-bc9c-9aa8e103f795", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.245.176.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc256fa4-5d3c-4402-aa66-168741e162c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.245.215.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27a91fe4-051a-4715-9797-ccacbf125d4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.245.237.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--600fb6c4-554c-41a6-92e1-acc5e3e22e36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.245.244.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a49b3f0f-1171-4e28-a248-47b83755f21e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.245.246.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0147634d-f05a-4128-896d-fae07078f552", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '166.1.60.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5e70f27-2bec-4bbc-8293-461e02477c24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '166.88.143.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9edd3ace-e36b-4043-8e3b-6c6a0dc3f7fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.114.156.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86067fac-2835-48a3-9fe2-2f186fafab83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.126.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--faedc0c2-f0d6-4c18-8111-1e8c075eeabc", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.152.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e7c7648-bbfa-478d-af89-e5b968cc9ef8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.176.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e27e57f1-9691-410c-b6e2-95dd55adebe3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.201.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cf41b06-2ed2-4aab-b92c-68f45c55a036", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.252.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4e86977-c7eb-4afe-98d5-26db1be9a1dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.47.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48341a15-fc42-43ad-8e01-54b16bed0e0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.57.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--104515f3-7cc1-4cf7-b02f-33ae2aae7e0d", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.76.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf33dcdb-dc28-479b-9ce8-e807492fec65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.89.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b289f759-9992-4f05-8780-ea0da6108eb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.179.45.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c97ac65e-e9ba-4756-bc25-887ef200ebf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.235.26.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd103efd-3fff-4711-ac06-baa1ec94e652", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.249.188.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1c0f838-0458-494c-a04b-14d778a6bb7e", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.250.28.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--740a0891-d828-4aa6-99bc-22ee92dbc241", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.250.64.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06de6b95-0ef1-4d43-93f1-c8351badea53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.57.198.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5130675c-1fc0-4227-91b9-2ac95ce58d28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.58.114.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e65033f-1aeb-422e-8131-ee1001f7c0aa", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.60.34.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1894bd24-c1f3-4def-b67c-3e98ebd890d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.61.132.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b53a2076-52ea-45cb-821c-89bfa283974d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.101.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95ea6607-958c-4138-9965-66dd5f4fd92d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.122.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--083dee76-5c30-4af9-88e6-934251d09144", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.150.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83e977ba-d105-4b0f-81ec-98b20d8b40d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.176.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0105c8db-6d70-4519-b9de-ea60aa993d67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.218.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6367a983-da1f-42ee-98e3-46a986932210", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.229.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66763b97-7556-4d1b-8e38-4040570cdac3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.229.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac8778b5-4436-4cd1-ab56-b06b9d0953ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.241.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e062dad4-ca04-45c9-a04b-04fd0a1d8281", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.88.171.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65428ada-147c-4a04-9743-11c902f1a00c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f64617e-3988-449e-b6e6-a7c325a57637", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adb55c2b-6429-4e2b-8c52-404d692980c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a57eb20-731a-4737-ac06-6e5010e222f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--290316e7-d1c1-49a2-80f0-072b20189b2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44f11516-1d80-44e7-98e7-17e299d91b03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc3ff467-c293-412c-8530-6c466946bcc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8689ef3-8936-43ed-bb94-192ecce722e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2c9e43e-7daf-4144-8a12-6dcda19e977f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17eecc50-eb3b-4906-88ba-e8a439f51472", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--535d9907-4e41-47a6-86eb-2f00d2f01a4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e22f1e59-19c0-4bc3-82f1-0f1ed3ad830c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d4449fa-f687-4d04-8e4f-5f15939f42ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0820e195-57c5-4412-bcea-29c468a60a81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c1b7814-d701-4a3e-8eeb-565b9af41d0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f651125e-0257-4c9d-9313-485d10dbccfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--425ce0f4-a426-48c3-b39d-cd388a690aa8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ebd67f3-0b8b-4ef5-a77d-f0a47b361c11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3658c691-d3ca-451d-b230-eac80537de3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ee9af2b-78d2-413a-b33a-500e1db3051b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68ff74e3-3dca-4900-a10c-fa515c48da77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4600061-367b-474e-986c-4f6a6f150985", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24afa028-97c1-49a4-b47a-a404f133ca67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e63c6d7e-80f7-4f18-9884-5fd92566217a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1458d0c4-ebd4-4a57-bb20-4259cd5fef35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f341640f-1108-4043-b04f-f0eadc7837e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1cb7306-4c7b-4441-9832-4fdcbf258a51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--992a35de-6716-4d1c-a230-712a5c5d7a39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--868227ad-e0ef-47b9-b1c8-837b3ce34b8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44be29c1-d91e-4f8a-8ff8-00ea6591d462", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43f4aad0-e98e-42b9-9a6a-28f7079e9dca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6804255-b145-43b6-9f4a-29bb0bd5d538", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d88a7807-f9f9-4b41-aafd-bb9e1c5eafa0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3d26b20-396b-471d-a0df-e3b8d5e9e9ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc1d338e-695c-4d38-a84c-81521f13c3f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b318b9f-ccda-4adf-a2b1-ff1ff4234921", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--764e061c-d86a-44ce-a05f-a6eadc4034b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1355197-26ca-4044-8239-ac7f2f8d7e98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e0bd784-395d-4659-8a3e-38aec4de1702", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa28df33-d90f-40dc-a8ce-0b9eab40eddf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58a84a97-6b21-4ab0-99eb-92d7c163f940", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12b0d2f0-6641-4af3-b503-d4dfa1cf7944", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f53a056-28c0-4974-a734-dec01b03535c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdbe88a6-45ff-47e1-b576-cebbe68e2769", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65778aed-e0c9-4271-899a-916718229a7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa190f65-8e90-4680-8b80-de4c68362438", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b166c06-ad09-4f5a-9969-88007748b49c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--047f63c3-ac00-451a-bb2c-aa3781753f07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d75ade97-8cc5-44c2-9d57-a7568320a261", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b4de206-5417-44ec-ab9f-b59dd649c166", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e5597f2-6d50-407f-a87c-fec0d05629c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43c30b92-d087-4651-a21b-f40b3ba31135", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc5759b7-4ab5-4e95-b6b1-27cf97bacec2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c28102e-a191-4547-8872-1f0f65f00f05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42b63d48-82cd-4c6d-ba70-59cb9178ee36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.101.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a91130ad-5dae-4cd9-9d97-50ec60dad360", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.123.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eec53d4a-b320-4ca1-94e8-e2b3b0dbb9ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.125.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17b43622-d511-475e-80ec-e9fbf1bab96b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.129.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e6fa2c5-fb69-4730-8b20-63bd2ea9e504", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.137.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1de358ee-74e8-4c17-9e6f-c7c53b4a57c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.139.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3955f4b4-16e4-44ec-a763-7a9b570f605f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.142.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc530873-fd3d-4145-a358-7a543ab8bf73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.147.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--444b2b38-9a42-4ad3-a4ee-47d735fa8ff3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.183.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dee6bfd9-215e-414e-89de-d2ca749ffc1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.211.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e9b3ec9-6445-4d3b-8899-bb137154c253", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.83.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9a69e72-ce7e-4a8d-a0df-c34d20ab0414", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.93.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5e154df-3170-4935-ac9c-912e30792bbc", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.138.213.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9695f8f-5c03-4622-8ced-0771097dba82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.114.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--635804ce-f45d-489c-86b3-323381e6d726", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.123.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13bcbd9c-b254-4669-8dc2-e0e5b2347c5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.16.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e0b3e56-2b4e-4067-a12d-48d807992a8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.21.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7601b26-7105-49bd-9927-0baaf7095472", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.42.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--041d6645-c582-46f4-ae7d-ce2344ad759f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.66.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a090f0b0-b213-4e05-a430-9ed466ea6cba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.76.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb6a5019-45c2-4d6f-8613-ca550480afab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.81.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa892542-47ab-48bf-8057-5f489e415d19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.91.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbfeb81d-975d-42c6-8d47-e0c3bd6cad29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.196.206.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63cb8f54-469f-477f-a5a1-25d507b7de86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.197.12.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf15d9ca-780b-49ab-a47b-fd2ca020ec8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.197.12.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1d654f5-0543-43b6-9b75-b09fae3aa72a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.197.12.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fe0f5cc-a84e-420b-a980-21590db89269", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.197.12.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--509b608b-892c-48dd-b374-59ebdfb20d20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.197.13.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23bfad9e-4856-440f-b6fd-e05432892d5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.197.13.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6012b626-05b0-4ef5-a332-8f6830b0800d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.197.250.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62cce82b-1de5-4524-96ab-0d4fe9e1ec76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.228.201.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2faef383-fbf5-4658-93f3-f3a1b7bc587a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.232.202.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02238702-4402-47f6-8ce2-53d747020794", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.11.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06120843-2093-4ba9-84a0-7a383c16a671", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.11.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e5a443b-177c-4ce7-9c83-b7b7affa2e42", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.187.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5d281b1-340f-4852-8940-10ed65d76f34", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.72.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91c8e281-8c33-40c8-aac3-f4e180767524", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.130.204.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d5b9232-55d8-4b1e-a9a0-c197bbcebcbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.130.204.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--299fbdab-96e1-49a1-82a0-9b1825113e6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.150.32.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e521783e-961a-4c1a-8ba4-2bcac5d06611", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.158.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d01f475-de96-4974-ab94-718546b6330d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.163.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d9d19d2-7bb3-4941-85b8-7b1a3d9d5374", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.163.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--307eb99e-2468-421b-961c-b027440baae8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--caeb65c9-bd36-4200-8c9f-080bb293086e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d6d3714-25ea-4ca4-aaad-62efb8abf99e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ebc11a9-6fab-463a-a2b6-0fc3c4db3cc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dee9420-ec0a-4a8b-891f-9a12a973458d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24f8745f-c361-4bdf-86e7-e72e20e52ef7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62d70c7e-ad96-4a75-a79d-a25ea3343149", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.205.31.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30d04bcd-b7e9-4235-9fc8-cc341003ae0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.231.180.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d13b1e6-c311-4109-b754-32df91438792", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.231.201.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d0291c9-23a7-48f6-8670-b079465af01e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.239.78.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c804dbb-80d3-4857-a976-08dca34f32e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.245.172.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e47f89a-6941-43c3-864c-7ca0db483623", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.247.34.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85dd21ad-0aa1-4acf-8a71-a88523e73dd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.166.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1f4d030-d499-45d3-a092-022a1c7c358a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.167.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81b9e0f6-6392-43b1-ac84-157fbfcb5aac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.168.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1450e750-23c2-4be0-8e94-af82497ee09f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.178.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5e277a8-5b5f-4261-9421-793f60e32265", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.195.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f361fdb-a80c-418c-8235-90a3e5df450a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.195.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5032c909-eaa0-4ce5-82b5-9d0c0f103e9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.209.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1792e65a-4759-40d4-aa76-c841c4e33ef5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.211.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e836b1ac-dfd9-4544-8c49-2bfc9095535c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.239.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b87ae073-db6e-42e9-9bad-0c4a4eb1b6b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.80.101.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbedaf7f-ad3c-4f49-8507-a1870def5c45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.81.116.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b37dd1d-b0d8-41c6-a183-6979bb68e347", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.81.232.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f4155bd-3d56-476f-8c48-c69b550d55e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.81.81.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73f29303-91f9-4b33-b2c3-28070e233a50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.84.37.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb73acc4-899f-4b46-959a-9550662e9a40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.120.31.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b908c881-8c91-42cb-985f-c6117862bee8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.213.141.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daf2b221-933d-4b0e-afd3-e93ac08c9829", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.224.66.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95a3682e-d507-4199-b9fb-612fd5d81e2f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.229.11.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--068282ec-9474-413e-ac5d-4276bc71a9fd", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.231.181.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24a65e78-bc51-49c3-bd8b-810dd4262136", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.25.158.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73fbc049-7cd3-4eb8-8e73-0a35242628df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.250.246.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6589eb9-82aa-4592-ae01-5060f5f40af4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.37.93.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d598580b-7232-49f7-a983-9a02041efafe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.67.71.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65648332-2c1b-44f1-8cc1-f372ba226d38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.8.138.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce898d50-778b-488d-bdc1-332b03b836df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.100.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1c4ea1a-6c20-48b7-a4c3-649de3a5986b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.105.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69f3697f-8406-430c-8442-46049dc8c08e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.11.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8da3c7e1-e82e-4dde-b676-b626a3bfffb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.175.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c94bb3f-11af-484d-8349-06eaff3e5743", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.19.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddc0eec9-08e7-4ec7-a374-3c5e53cb5d21", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.210.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdd764ba-f9c3-4f74-b87c-727ba1f9fac7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.93.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9942d426-4a9f-4bd6-b892-3038b72f905e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.105.128.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de2dbd2c-f333-4e43-9fd2-1d219787b5ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.105.158.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56e9c832-0c19-4e17-9c46-fb99b51dc33b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.105.197.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--134c71d2-baa6-4f52-b491-659df9e2beb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.105.246.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bb16c74-a164-44d9-9b5c-d36ec93726c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.219.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c0adbd3-3335-4286-ae90-c6e42a8ca514", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.221.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af3eb932-30e9-4506-a7ce-fc1211358097", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6fe3b1c-38e0-4769-8295-93e98b6ae1f1", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9172b2e3-141a-4e41-bf37-06790ad5965c", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16fe5614-55a3-40df-8181-234c184b5a5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7ee0919-89ed-4c0d-b76e-221747b67380", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95fbf89b-9330-4bf0-acc5-674c40dff340", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.113.136.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18c379b7-7d05-4db3-945c-6bcbeaa56671", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.121.58.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34ffc11d-6de6-4936-a618-e07b3c959627", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.171.243.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7d6240a-2e04-45c0-b90c-5303ef1fcd39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.172.30.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--741b0ac4-e9f3-43a0-92ea-666e8984d1ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.174.132.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24e07570-b5f8-427d-9a75-a69eef53f74c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.174.234.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2741b0fc-25e6-406c-bf59-af25f568bde4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.178.115.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbf2e689-e6fe-48ab-9bfd-64d950351d29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.178.82.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18dc0b74-db47-4311-b27a-2714193bca3b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.190.24.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbdc432d-92bd-4699-a679-74d8598b8319", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.191.171.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acd3cdb4-9c09-4061-8493-a97422bb870e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.104.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1890f51-a096-45d5-b4ea-c2642814e213", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.104.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18ac5cf8-9ae0-45cc-a83a-eb4fdc10ebea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.104.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eeb39816-39f3-41a2-9da1-b59eb40f9f0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.105.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb5636ac-6fb8-4305-b964-9dec486d18de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.114.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--543565b4-f758-4671-98cd-8b263094bbc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.117.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3864a342-2948-4f1e-9257-e89bc757af80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.117.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8a445fc-58f5-4c75-ad80-e2bdeaeae3ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.117.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--352e6ece-6308-4c14-96ee-03eb2e6e06a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.117.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5ee5511-b020-4170-baaf-17905a593e49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.117.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c700b15-89c5-4bf2-bed6-ab2abb07857b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.117.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd76d2a1-a05d-49b9-b791-b22b5d12e603", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.117.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb1814be-47a8-432f-977d-11d580a6fd21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04886890-0da9-41fa-a97d-e76d20da3485", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50957ee0-a935-4780-9f0f-77de4eb6a512", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e24d3a61-9ea7-41bf-b550-db419d4a24b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f714473b-9b7f-410b-ba68-9453a225f94e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c0e8c4c-c9f4-483c-a6ca-9ae031b6cfb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d611ef0-7b51-437f-a2bf-e36f60c9fcf4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d495cf8-899e-4791-8c82-057cf417794b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00e83af5-d0aa-405e-8811-cff80f9153e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af7ac68b-f518-4bfb-91de-b552456ebf45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.49.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b74ebd9-967b-4dcf-87e8-337850a517d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.50.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56480c78-9dd1-41c7-b873-a952bce5ed46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.203.216.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--843ba34b-2516-4979-96fc-cc76acb4cab4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.208.24.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88393773-a23e-4f8d-b2e8-fa4015b04620", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.210.68.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7f2ceb1-6363-4489-b5e9-e85b33905f7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.210.9.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fb34a91-d108-4c2b-bf66-161d4da1037f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.210.9.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5302231a-c8a7-47b9-a528-a47fd0f60948", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.212.188.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--144b861c-8304-4d69-848f-90649906f270", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.212.200.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--733cd3fe-b6ff-4259-a02a-ac6eabe36f64", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.212.217.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c3615c3-658c-489b-ae57-8f9f5398a3da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.212.224.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f29e731-bb03-4591-a674-d47e1f6993c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.212.224.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f1a001f-8c4a-46b0-857c-da22572ef756", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.215.145.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d9ae5be-5436-4e64-a517-05d26c85628c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.143.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b29eb1d0-b18a-4f1c-88d9-5b4705e85522", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.15.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3d2d5d8-260b-4d9b-b683-0e455b4bcada", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.216.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2616f57-09b0-4524-9464-c661130a707f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.246.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b29aaf3c-da24-491f-bc89-11259318d8d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.27.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3ff3f03-cc32-4510-8678-dd1af945fcb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.3.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82c1d8d5-49c0-4506-8ff8-577e9e9e8085", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.8.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--054dce34-1e6e-47a9-a2e9-84b7bc5e8925", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.233.219.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b080ed81-f717-4058-b11e-5e9b4c93a9fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.233.221.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c17fc2fe-34b8-4eae-9254-ee85e573f346", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.192.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccc8959b-cd73-4f90-845d-6f49ca25dbec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.192.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e88584c-b70c-413e-ac06-2bcdb4465b1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9676e76c-4aaa-4d84-9595-7d115e71c188", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86b06ac2-fb62-4eac-9153-0ab4c5cb34de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63ba60d6-11de-4a18-9334-215a6915a2a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4b4e096-843c-4a26-a034-affe4be40a21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.21.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7870714-985e-49a6-bf04-db63a071051a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.217.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1ec367c-19cc-40ea-8146-c44b95900825", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.217.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3fd1b2a-aff8-484b-b3bc-de794f479dc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e2e18f3-0ee9-4e29-be9c-40c40d08fb8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84329481-7360-4cb5-a457-d7ee343573f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b04710d-ebd5-4e07-a3be-ada246c83117", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--800c9a2a-d9e4-41c1-9dea-e39a93a4d65c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e15a6a6f-f52f-4bb8-a183-87ad904780fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.221.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71b15925-d62d-4ba3-b53e-40a9ebfd817e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee65fde8-ef8b-450f-bbbb-7b28d4cdd6f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7173953-58f6-434a-a354-25b993207a95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46607c79-5123-4199-a11e-b86730dc0a6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21ddc680-dbd0-4bf2-8f8f-2a3eeb7cc0db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.235.189.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a4b46c6-5c39-4997-9a67-42edd0abf6be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.235.190.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c39d1c2-b2ed-4628-b798-3d6a09804ac2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.106.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85231ed6-d45f-47d3-b7c6-f1c69148a4fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.111.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c9a8d81-c115-4d03-9e3b-1e03e273781a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.111.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3bf757a-b0ca-4be4-8137-cfc05ba6abc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.111.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0c3ad4d-80ba-4942-bed2-8890bb0f0d08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.117.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--561ec482-8d50-446a-88cb-f3772ab36654", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.119.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fa59a78-e3e4-40c9-b860-77d6d3aeee08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.123.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b47fb3a-e49e-4ead-aba2-325cda116136", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.126.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de4cf733-f214-4ed2-8e1e-c5742e98368b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.126.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c613b54-1c66-4850-aaa9-49bc41490dfe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.127.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09a0424a-4103-4d1a-8d27-239590da5c04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51c3e08c-53c0-416a-b948-21850613cffa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ad2aabd-a235-4c9e-b9af-45377f1bc25b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42e2b04e-3ea7-4ea8-85b4-0535bb872ce5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f36b711-9ca3-45dd-8293-586cb01d37a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93591d44-e006-4573-8016-ac1a87927ace", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.96.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4c1a45e-0296-425f-a957-a22f2589fa17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.96.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91570670-d045-4189-9e18-4f8e90a7cd1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.117.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e740174-4a88-4cc2-affa-14ffcb53280b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.118.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28cd6de9-6332-481d-8aa8-cd7b95756340", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.121.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5969bbd2-1a02-4f5e-9949-c4042f6a8e1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.136.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--213e5713-2a1b-4d99-a33d-d41581392453", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.136.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdf2584a-8884-47ea-ad6b-fbe146bc58d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.150.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f410fdae-55d4-4238-b070-7e8422dd3599", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.150.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71c4a6d1-9d91-4d50-821c-c75f34223dee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.155.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b76f494-2695-4e53-9d48-74d771c9bc5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.155.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d63c7682-9cf5-4675-8cb1-328397271a26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.156.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c68f234e-6b28-4e0f-af81-bd27a6888c8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.156.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df6664d5-f463-4a27-8430-bfdf00965d07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.238.160.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eff3eb8e-ff75-4cf1-9bae-5bab7d6a88e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.238.171.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddd0a797-4eba-4dc2-bdbd-3f6cd6d012fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.238.188.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17d0dc1f-f47c-4d3d-a000-7336aecf2c88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.51.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49f3e517-60b2-4527-b03e-8461e7b0b19e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.51.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90434f8d-bab4-4942-93c3-537aaa4a91da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.62.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f37c6779-243a-46bd-bb8f-425349587035", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.245.112.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--551d2f5f-5d0a-47b3-9ee0-418d011af169", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.245.16.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca4f79e9-e82b-4366-9c5b-9fcafb65165f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.245.225.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d64989bd-ceb3-4311-bc98-a3ddfb266513", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.245.89.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1df2639-13b5-4be7-9d0e-4b088b6e98da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.56.30.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8a55b21-c70f-4425-a81b-dc376fae3374", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.81.62.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f0bb9ee-112a-4464-9e3d-077b79475c0c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. CVEs: CVE-2019-5418, CVE-2021-41773, CVE-2021-42013. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.86.89.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41773", "external_id": "CVE-2021-41773"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42013", "external_id": "CVE-2021-42013"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6d15fb91-34c0-43f5-98bf-3caaaf01b35d", "relationship_type": "indicates", "source_ref": "indicator--8f0bb9ee-112a-4464-9e3d-077b79475c0c", "target_ref": "vulnerability--18b00767-6fe4-4c52-aff9-317d315ef022", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d6c008ad-a255-46ad-b634-c5a0d314ec87", "relationship_type": "indicates", "source_ref": "indicator--8f0bb9ee-112a-4464-9e3d-077b79475c0c", "target_ref": "vulnerability--3384f172-ff60-42fc-bb04-7abc79e498e6", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--29d9aaf1-9e29-45ca-a902-e4ee2b462785", "relationship_type": "indicates", "source_ref": "indicator--8f0bb9ee-112a-4464-9e3d-077b79475c0c", "target_ref": "vulnerability--eb1503a6-965f-4d2c-bd28-e1f287172aa7", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c612f276-a587-4ed8-99a6-9e40662ed7b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.93.103.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f847af97-6c9e-4cfe-b027-69f330e525da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.93.106.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d86dafa-3a04-41a7-99bd-88ed33866315", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.94.9.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5f281a3-5bc7-4249-ba31-6d9216234332", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.96.172.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70ee617e-060b-4ec3-98a7-b79008f2870c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.10.13.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c152f709-1fa9-46bd-9b63-11de869db05b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.199.117.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9482703d-4f1c-44ee-97eb-7e45f6ba3763", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.208.51.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dabc6a3-a010-4162-8f77-cfe6ace07b63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.212.223.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7930b2ba-bd06-4efb-b50d-0c637f53dccb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.230.150.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d2a8337-aa3b-41d7-8391-e5f3cb8ae4c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.236.82.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--294b9531-d1c0-4fab-854e-c53e81d796ec", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.249.52.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95d5486d-5c93-40c0-9baa-63e3ae2d3d2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.254.207.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ca8f358-eca8-4e83-8c1d-42f3a63fcb8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.210.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--659af032-5ab3-4255-ab7a-9c68266d3284", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.221.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a7ccdf9-b537-4a8f-bf01-2df9b8809ce3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52c40fde-ab7d-4f38-81a4-b8efb63340ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bac7f4ec-2b84-4062-ad50-8de6495651c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--406fd8ff-9244-4cba-838b-e1bd0caa7dfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ac5e0b1-a637-4418-b401-2c46a89dde21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5733449d-0e63-449e-a212-50956940393c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4443b80-8c5a-49ec-b112-5f2c2a4d3fbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3306762a-907c-46af-8af9-957ea3909b28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e26132c5-ee36-4362-97d8-a9a9daa34348", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b221372-450c-4ce0-8b70-8d06db1a42c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7c62f1d-d8cc-41f0-baa5-a39232c901c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.226.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e00dabff-f56a-4c75-9dfc-b9c525355c9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.232.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a58c10e7-3b59-4b07-ba61-2fc8f61ef829", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.242.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db72d14f-6074-439a-9481-c2f3ebce91ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.243.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--440ff1b9-8ed9-47df-8a37-3a97a8e1edb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.248.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30673c98-b119-4e63-8829-0dc42ea217e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.49.211.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b06defd6-d5f6-4126-b426-6c7ae359166f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '174.138.15.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b145a29d-d618-47cf-9f18-5fc70d90ea90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '174.138.87.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c459d319-1526-4e6c-891f-5e66be6af232", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '174.67.236.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e3dc31e-1e67-4e56-9e53-0139280a5295", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.107.244.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6412df0-656e-4a0a-aea6-939771a41ef7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.110.115.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a70c695-92f4-4e49-ba25-b67d15e9bd6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.13.203.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--792b210a-98a2-4371-a05c-d2990cb0a225", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.138.99.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02746d1d-f4b7-4686-a735-b7864fe3e82d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.150.55.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6d1d05f-4ae2-49b8-ad8a-24a737c1dae5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.172.113.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c9f4a19-468a-4821-b80e-62f47fa73d43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.192.243.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--268d86e4-52fd-4d0d-8a08-331985b8e659", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.203.104.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f560e71-e4f3-4f69-a9e5-3a4c32972749", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.206.14.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--108f0a77-f610-4ddd-bb32-0cca4b6dbd07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.208.65.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07de38a2-bbce-4d60-9e79-d95d04395887", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.215.65.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f19e05af-5feb-4742-bd2b-3d75290dcd39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.120.22.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--230f625e-6589-469a-914f-cdc578283d88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.120.22.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64105af0-a38b-4307-9267-649bf5f1eba4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.120.22.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0eb49970-02e2-49e1-a160-2801a4f836b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.122.120.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49df7bd9-ac59-4b85-94b1-c6e7f335e55d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.124.88.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ebd8986-fba9-4d21-b6cb-1c4b8f8a8f93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.235.182.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d85aba27-3e74-45cb-a096-5cd62e8a9b09", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.27.135.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0857316d-c4d6-4e0a-aecf-33cf3a3abe56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.27.250.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce66ea9e-6665-4c2f-810c-5dd2fd68d20a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.32.193.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e50a0a30-2c5d-44fe-b5fb-7d6326deddee", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.45.26.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad5be84f-3472-49e2-a75c-0ad9fcf30f62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.128.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46bc1231-3305-4d40-9960-cd744ec3116a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.131.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4742c2fa-c854-42f8-ab8a-8a6beef4060a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.131.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ad8a2e0-009e-4bd0-b0b0-75bd8f35006f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b9cbe30-2cf8-4a8a-becf-615a7525b756", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b69959f-d946-4b72-9629-6b46092aacd8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--223d16a9-6957-438d-8606-cba38e19b400", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a72915d5-0493-44a1-8b46-fa09a33a1f65", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49d369fb-bc6c-41dc-8f61-1fd213ed7355", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28fb6095-3855-4214-a94c-8e7c9dd585f8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3396ac8-b133-4d60-a9bd-6d8b5cd94233", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--334265d9-403d-4745-ad1e-bdcea0b55e6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--690c1154-44a1-4a33-b488-e89953e9ca62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.134.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff0099dc-cbe4-46ba-8203-433e5e3df96c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.134.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9eb4d7df-2182-4a71-85b6-9cbf6e67e493", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.134.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65f1b4ad-63d2-43a8-bf95-e11a31aa1466", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.136.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--184ebf05-b8db-44ab-b5c2-bf9492d54ca7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d15de891-9b26-47d0-a7df-ea7e32e92fe3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d7de91e-fd6c-4e83-8a1a-77cefd24931a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65334fdb-b4fd-4e1f-9786-8d5afa406465", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b704bc28-059b-45a7-921d-f3b0561c1dd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d31ecb1-892f-40b2-bb98-fdcaad446bde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac81f810-058d-4b17-814b-456b28500596", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0158f92-da69-41e8-84c4-1e619b07d668", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60ff074c-204b-405d-8a50-f09e6b0bd907", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d3a1864-9380-4035-a0fd-776b6c678ea1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b561519-c177-4c99-ab30-9decc3ebfa13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6c8751f-231a-4f9a-9cf8-68db8a6c760a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--611f8528-020e-4a6c-9803-8daf9ad010f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ded0f75f-9bab-4da0-ba69-9fd972f42ba4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a79fcc1-92c3-45ea-bc6f-7dce1079bc4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56d89400-6f64-4e4c-965a-83b1ea89e10c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.144.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--493ceabe-11ca-47ee-ba1b-22330277b1be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f03e94c1-ed4a-42ad-9a67-5b99d91964c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ba4ac9a-ffc6-4dfd-9ef4-8c9e909a1ee0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bffc4eb4-809c-4adb-8c51-062c9148c005", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--972675fc-10ed-4041-b978-5f15a3551a5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa6968c7-936a-4052-ab1d-2688465479a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bfbd4a1-a478-40f4-9d69-0157f3f23a41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5904d93a-8f77-4afd-85f1-528770c4d78a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7dedd35-3359-4ca6-ab49-f90a43877aac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9cc2854-d4b3-4469-91b2-833e46805b5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c6aa25d-4f47-4839-9264-3892971dd40c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81dbe1a1-036f-431a-954e-6da19843ab18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d03d25ea-143d-456e-bd91-6695d104592e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70b12105-cb6c-4499-b085-750f5073f081", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e84a171b-5f6c-4922-aea3-c4e6166552f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47cd9f1b-e182-4349-989f-22929adf66f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c173e7e4-ca71-45a3-b11a-213dc1fff5ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbad5474-8499-4c56-a37f-a16645ad7a6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcfd380b-7966-455a-bce3-a85c3925ec63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91aad627-2ffa-4b96-bc09-a29332bf701b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28052656-1ac4-46f3-922c-28a813238520", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.9.19.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--423d27ca-90f2-4365-a392-aa2a051dca47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.1.105.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d975ec25-9224-4261-99fe-003620466208", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.115.13.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5c8f402-3b9e-4a04-a8fb-09c477a53cf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.116.30.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01f3b363-2612-4f7a-95ce-a09504828492", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.126.135.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db6123b7-1af9-43ca-9d08-67137c8b5995", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.155.86.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a84a96e-f97c-4e3b-ab38-781455fc0a1f", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.159.146.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f279dae-d39b-4932-94cd-9bd964a50c51", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.183.238.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46376e09-03e9-48a8-a88f-a766bd996146", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.20.248.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac00b767-77f1-43e3-9e3f-5602762f23e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.223.104.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20dbcfda-7dab-41cb-9703-b8aa26fc7721", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.234.174.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa5d8550-47ab-400d-a259-d2932bdf8ea2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.236.8.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1307713-6ec8-44be-b25d-40f7a39412d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.249.168.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7af380f-e456-4709-ba8e-5b0e6f5dce4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.250.62.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8c6cdc8-55f7-44ac-ac58-c3b118564d98", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.36.61.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37e3a1e5-c6e0-468d-81fd-c2944d9993e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.47.163.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c925ad7-d728-4c72-8b84-5b8e35e4e63b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.54.27.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6de2c175-25c5-4cab-82c9-fe0d5a1b17e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.66.112.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fef4969-178b-457e-9186-7bfb374fd0f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.69.176.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c86fac2-87e1-4958-9a8a-05109e3af3ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.10.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0e704ec-6130-4735-bb45-fa684693934c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.171.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85514a4b-125d-45ab-a818-15a445a09d47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.212.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be2e6558-d4cd-4da8-8a4e-fc71a66c34ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.233.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b9f8cae-7738-4775-9ad7-a4cb0a80ba24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.237.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89e5c806-662a-4e44-be5d-10883d1ff051", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.238.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef826369-bff3-44ca-96f3-8d16c0aa50a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.33.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--371e0e56-1287-4981-8462-b08fdee89ec0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.55.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55b04b06-2f77-496f-9384-26c966bb10b2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.84.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bae5c66d-8740-4e75-a310-ded173971f71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.132.20.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbae5095-68a8-48bc-acb4-526709e4e5c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.134.10.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0f8b345-b76a-4b01-812f-f46735f6b56d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.147.125.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a090531-81b8-40cf-bfb8-8902540bb83a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.156.145.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6c4244b-8354-4cbb-902f-b91d85cb1167", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.16.52.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2730b544-3ebf-4102-9fe2-46e85c9f95f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.16.55.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f91f589-4ad7-4fcc-b1ad-8033028a1d51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.17.53.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca84e477-2698-409d-a857-59c93671e498", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.175.130.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85a8aa38-e500-4f79-9ec1-4f41aa78e0d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.185.223.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56752d41-6d5b-426d-a1ca-ffe2450e01b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.19.98.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53cf13b2-0271-42ee-9914-206dbef82670", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.20.210.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5811774d-bcbd-4104-92d4-d02a9905b831", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.20.210.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--282e8a53-7a9c-41f8-b46a-8aff171c7f82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.20.210.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d06ca8d4-6d71-4353-b8c6-ed1a0f5650dd", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.20.210.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ad8cfdd-6069-4bb6-a400-c3024a4e3fe6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.248.77.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80c548ba-dfbd-40f2-963a-d7e3640c68c7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.251.140.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72339dca-db78-47bc-9ab4-d5cd207eb2db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.54.78.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc6179a6-6b88-4264-992a-f68f2689a6bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.62.225.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e3bb636-b0e3-47de-b543-73b81f98856a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.62.25.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59c61a1c-6938-45c9-9278-e3971e1fb21f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.62.55.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe49cfbd-8d5c-4176-a2b5-68be61e96df0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.62.94.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ee68c2c-0fb9-435f-81ee-c500b92c7354", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.82.75.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6d20a0e-82bb-4386-ac61-260c43bdfdaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.83.200.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94a7e8c2-4158-417b-b107-bb341ac9dc09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.83.200.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5814bb36-d77d-4f84-8d50-02862407c879", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.125.155.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d48c98bd-fd74-4748-b41e-fffefd16064a", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.127.65.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42e9e78d-ec63-4ae0-8d50-4ab3740de003", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.158.27.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--168c1b26-e1de-4a8d-85ca-d84dfdc1a840", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.26.27.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90b60c51-f7a6-4fe4-bbef-0a799fcc4397", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.26.4.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35d47203-bf7d-48e2-8825-39fabe1176ad", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.33.186.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f907a3b5-16ae-4e61-bc27-b9413b23e334", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.41.8.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8330e99f-0234-4e13-b63b-0646afcb8939", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.42.57.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--822f8a5d-af65-4d19-9d38-d7477db84f89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.42.96.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2119ffc2-ec26-40b6-abea-7c05a7169612", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.43.146.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cea7d869-9b7e-4146-92ca-12b3eb69a043", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.49.192.1']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef782791-e1eb-46db-9a40-e4a8a6a0573a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.49.194.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81708565-9608-42ee-8fc1-76a5591ac906", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.49.194.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51be558c-9f38-4357-a809-4e8b0204e00d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.49.195.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14cc8582-8a41-4400-8532-6116d308c960", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.61.232.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2ae7995-2931-45c3-9ef2-4ed11117872a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.61.232.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--097e20d6-fdee-457f-8242-fd160317afec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.62.77.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92f3b7e1-05c0-4af5-8e8c-b9b81e8a3cc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.97.24.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5482fe9b-d706-4f5a-9282-3f79f54e788b", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.116.101.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2eed9a58-1c7e-4491-81a2-4402612c5411", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.117.136.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05979a5a-353f-4af0-bcf7-99bc222d5f6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.119.209.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b63d7099-b695-4eac-94ac-0ecaacc4b53e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.133.212.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef8a88e2-0868-4ce3-892a-3bf9a5ac81ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.143.235.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15d40b66-bd65-4c2b-a5e4-91845d5a702e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.189.74.1']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1ea700f-9d09-4ce0-bacf-34bf98038c52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.190.15.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f6e7de0-d0e3-41ec-b679-d8492f261ed5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.206.252.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--924df662-5098-4508-8d9a-31f72d2b0e59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.217.208.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c13c948-cbb8-44ae-8fc3-07e558c3f6f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.218.118.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba10b396-0e51-4eeb-a66a-dda2d5cbd25c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.219.196.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c472324f-b0d2-4e33-9cdf-9b5da083e575", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.221.179.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19daa64d-1108-4d8f-8c1a-fc8f7be51c0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.233.100.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66689be6-ad19-4fac-b8c8-bb5278ef0c19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.234.209.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26b52f89-78a3-4ad1-ae97-82db5477250c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.100.217.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8868859b-1382-4726-bde7-b1f3ac9c3bad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.101.183.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e261195-fff0-4a98-9853-a3c4f8623b8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.106.83.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1931cd0a-4e40-4ee7-91f0-574687b9cc96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.111.30.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0fe4caa-8c74-4fe7-bdb2-2cc7f998988a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.167.128.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e96f2b62-bd25-4f49-b86f-567a842abc2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.167.128.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--530c6ad3-24dd-4dc8-906a-8f400eadae3f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.184.43.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0c3f789-b62d-4dbb-8871-a25d21dc0b10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.184.90.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4b4d134-2afa-4fe2-a8ea-1372bcb6dd2e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.213.44.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02eb1df1-957e-4a60-ad17-7d5ef5897687", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.231.110.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2cd962b-f279-4ab5-948a-a9ab2a5e365b", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.235.129.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cd008ce-5e4a-4d57-8338-c308983dedbb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.248.19.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--caa3c736-f0d8-476e-9305-016616081380", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.253.187.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0318597-4711-4ee6-8e85-e000c5b5b7fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.254.116.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92695514-e798-4c2b-b5d2-dc87c8742bc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.76.137.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b7cca4d-4c08-4619-a81f-52ede8a9d7e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.76.143.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edac817d-57e3-43df-a64c-134f200bcec3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.76.174.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--282e5fbb-8bbf-44c6-82da-d9c3ad694cd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.76.243.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c679df31-a492-400f-a29f-f4d6fd7715e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.93.32.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14517e31-d23d-4333-ae63-eb3d6076a0e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.105.143.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d74db98f-635c-4dd3-a17f-b975026965fd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.115.208.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b738475-2f0f-4e97-9803-abcca88bf843", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.117.188.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90014f3e-0838-4fdb-ac26-56347e45eb42", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.117.204.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebb82183-f941-4b24-a5a5-23d10ae8f477", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.121.16.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1109e309-2663-4906-aad0-869130f10ee0", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.126.74.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cb42a42-3084-4d68-bcdb-b92c37b69fbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.170.92.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09ad3e1a-5833-4c9b-bd08-7643da21e5ee", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.171.83.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d6f5c3c-662c-45e9-b4b6-6cc7907ed8a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.178.17.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7da04362-29e1-4b8a-bac8-afe7f87d3eb3", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.178.87.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2913811-066a-46ec-bd3f-971d6de863cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.214.173.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27e8ac53-9759-4bc7-83c3-2c5e95f248ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.229.193.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c0dba3c-f5a6-4127-96a8-c2b4fc1a1091", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.230.173.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--949c7f05-4697-438c-af7c-c18002743bae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.235.2.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c39cab6-3884-4881-b7b0-8a905a4eeaa8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.28.187.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d481b7fa-e785-455a-802a-54bcc567db33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.31.75.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95e30906-d29e-4a0e-bacf-7f995f7b4c40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.44.217.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ef2ee1d-462b-49a7-8cb5-e526741da182", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.49.8.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5946a455-21d5-43c2-884b-5277c8fe7de2", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.78.11.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0347ad5-ddba-4e5a-8ea3-08f2c83310f1", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.91.117.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e05fc40c-a1b1-4fef-ab24-769cb8767e3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.94.229.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22ae8155-0885-4bee-9e59-18c88af26bd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.95.53.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98c43d8c-7587-4a19-a56f-b0bec5b8fd93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.10.99.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a73c363e-2127-4b28-a5bd-6f2505a14a71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.105.123.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8b9f0ec-cb0b-4b12-88b1-bfc3002c9b04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.138.158.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b88754a1-734d-4946-b441-6033f3f762f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.138.158.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dee4c57-3263-420f-9574-b53df6ff65d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.143.115.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8059670-24c9-478d-b06d-11094e3fe150", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.16.3.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0c40226-6b54-4f07-9f89-2c3f15d765c0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.180.154.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffff65a6-5296-4704-8f8b-c45fae1b060b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.191.78.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3cea895-88dc-419d-8275-e051eeda1366", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.242.168.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b6d2952-64d6-4e90-aa7b-8425dfad623a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.242.169.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c66b398a-a24b-40d4-bf95-85050dbd8cd5", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.253.114.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f50a1fac-0b87-44a9-8ec8-5eabd5641f6f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.253.156.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ac69c05-9205-4eda-94b1-2f2db33a4da3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.43.76.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3da67fb1-3446-4821-9427-0e24766e46fc", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.48.68.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c1828e2-d153-403b-9d3f-ba93457859ca", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.53.179.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--040069ea-f5b2-4d3e-969b-cad0152eca3a", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.53.179.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f8cf486-8d56-4587-9916-1fe2991c40ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.129.228.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dfea04b-9dcd-432f-94ba-626db7869ef8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.131.9.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afd66128-3925-48da-99c2-2c9e8e7da06f", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.149.162.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcf6d496-8f2d-4d4b-9733-19c56c0f5302", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.236.101.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b5b6fcd-3944-49b4-9915-24cf84aebabb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.236.7.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2296059-8365-4e76-af85-f83367fa4367", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.239.58.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70060145-1297-4e30-8881-11008780115c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.36.35.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--799ffbda-51ad-43a9-9b13-981ef14e4ba1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.67.1.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--911e1455-4609-42cd-bd3f-acf3d63319df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.81.35.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91c9b8a8-e246-4e41-833a-5869b339f947", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.82.34.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54043726-1317-443e-abc5-10b96b30674f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.92.115.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cc61e11-f39a-47c7-abcb-af570c748353", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88e4947f-8312-413e-8892-54579aff41a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27ea3cb5-b018-42a8-902e-8cc52a5637aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28ee998e-be65-450e-a4f9-7706455a6197", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ec6cf66-6345-4d70-bfc5-5671f4449839", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad015269-e3c6-4ee6-8fa8-5dd39507fb7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88916d39-9374-424f-9f1e-055319a059f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cc9b1c3-815b-4781-ae74-b9c906bcaca6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4829021d-9efa-496e-a47a-6e2fc0b42087", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb04189a-3b64-47c5-b412-c173bd86fab3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af79abcc-9e33-4146-ab01-f4523334a92d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--420eb0e4-181a-4699-bab6-7dacd8e19e6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b20e29d-2fd9-4b88-b1aa-98e179979881", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc9ef361-4448-4c1f-ad46-9f6ece1ff10e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1f97597-d17d-4259-9498-8416b5c101d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2db4acd0-89dd-480a-83f1-8907ffe41306", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baba5194-9435-43dd-ae2a-59302886f2e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db823444-5966-4544-8154-c6b25489756c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8c12b9a-688b-4733-8bb3-a663cf4ca8c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c55b4906-ddbb-4d6f-b484-d408aa50b2b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efc14f47-dd2e-4dc5-a999-058fa8bf2b56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33cdc35d-2157-4ac8-8542-e50c5110522f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bc19283-5fc5-4ed9-93b5-49140c3ea76f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11df45f3-55d8-4074-89b2-708f20ebd78f", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--400c139f-c2ce-49f0-8721-28e2d3389de6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93947275-4dcb-4c07-92cb-2ff83f865299", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c466226f-a2e4-46b6-8ea5-6cf8536beb18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--078a2169-de4b-4d27-8f2a-a6694a1c10d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5a8ce5d-8c1a-4285-92d5-25c7e3117096", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7626707-8581-4e03-8c33-1837686b0b59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3b988b4-f8fa-453a-b9bf-96039386672b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--962e83c7-28e6-4d85-bd42-8de7206dfb21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34445589-d5ce-44d8-8667-0990c1cf6389", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baeba5de-fb18-40d3-bf44-a74abe9a83cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddaf6281-47cb-47fe-8ea9-bc43134eac9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--292b3aeb-fc0f-487f-83e8-9d866cced8c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3be47d5f-9345-4449-9e06-2490fb80cd22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd093d83-5c69-4a8e-8d67-3183bd22b62d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd9fdf6d-a710-47a5-8628-b993b1b65f58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8720b1c-e9a7-41fa-b7da-a5c5f171cc5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d18a80c6-4037-413c-911e-d715773abf5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--712b5772-f9ef-451e-b126-2916f66ceab0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b637e38-80aa-4324-bdf8-a18d2ca914a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--875d1151-bd95-4737-9d1c-7eca72835571", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcb9a17d-926d-400f-be93-1d5e01c2a946", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19e80ed1-8f40-4a8e-9d11-e215decf0da8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5007ebbb-56e9-4ca7-b3b6-6a4402952c7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1f395af-dee2-4436-9d1e-1c7504f4e1b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0122c3fb-2309-4fda-b460-0516bc00a3bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5048c45f-a9f6-4ed0-8da7-133ef3192294", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3b2c564-635c-4bf0-abe1-f3372c5fa129", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9484a11-f8eb-4d61-b1b8-2280f370c25c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.107.167.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfca52d7-c0f0-4367-b318-627df5fc693b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.107.179.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40d4a01a-77ef-49a6-b2d1-2f3f94c2348c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.154.1.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43c0c1eb-7272-453b-8363-d2fceec50082", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.154.107.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--673ada47-c154-4424-85ff-7eccf0addddf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.154.153.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61b667eb-cd42-4486-b1e7-a7595ff2f711", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.154.156.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17f333b1-f11b-4fdc-9020-c565ac72b1c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.154.157.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29e36fef-f5c0-46d9-8383-2fbe0eba5ce8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.154.78.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a8b9f07-7aef-40ba-99ce-ae14b8bcd8e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.154.78.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41d9a60f-587b-4f73-8da3-ad9297cd56f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.154.78.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f1024e6-4dd9-432a-af80-6bf558339bca", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.168.31.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99bc783c-69ea-4720-ab0d-417d6bae3fc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.93.45.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7b5e0ab-3ab0-4b55-96a6-75a002a6f39a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.104.71.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--785eabe2-1af7-41f1-ab1f-b3088f1b6972", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.107.80.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--521bdbdb-5c8e-49d7-a434-1ff9771591a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.109.21.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6232c151-89e0-41f4-80be-aa182bc5f63a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.12.59.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96fa6178-38e6-474b-8504-23115193c5c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.12.59.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--877c2425-f4f6-4874-b985-6fa08bbc37e8", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.128.37.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bea6e8a-e58a-4bec-8f6c-2407f92148a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.134.49.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62cedc43-1d22-4aa8-a300-b5101903c08b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.134.49.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1dd8fb2-1350-43ab-b0e4-2a0c1289a3e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.135.157.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89cd56e4-bb98-4118-a1fd-cf757080f964", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.145.245.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cd0570e-575c-40d9-86f0-cab91564b37e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.150.191.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--625c3df6-97c7-4933-a94b-01df4d94c397", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.151.146.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72d3c4da-fc5a-48e4-98b8-b626712cae1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.156.73.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba3d79a4-8e6c-4457-83a0-a15aacf91b57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.156.73.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--209bdbd6-bc95-412c-895f-21d391ceb490", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.156.73.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b49ba6e0-aed2-44b6-a6c6-7024279d7476", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--736c7584-0a64-4850-8bb0-3a5e20c7fa34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fed3409c-3464-4000-98c7-5f6f48b1473d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56971d21-cdb8-43e6-8043-67901d60fa3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5368f1e2-b78b-4409-8a39-e92ef019a6e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8473efcb-033f-449d-9be3-bbda346b89fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--389b231a-5cd0-4cc0-a82f-5878d4dbfa4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a13182e7-bef1-4ed3-bb4e-3848887fbda0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dcec47c-1d48-49de-8be4-43dd5300d151", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46ea9f0c-597f-46a1-aa46-8e39f90a09ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e1b907f-fea8-404b-bd0c-52fa75e0f386", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.189.114.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5df7d0af-6cee-45d5-92a3-fd4a78834ce2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.189.114.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a7dec72-5fa1-4696-852e-43846170b8dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.189.182.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac17d8a1-68d4-4cb3-9416-7b55ff3dfef5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.190.104.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--168428c1-7796-4930-baab-b28a8f43b0df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.165.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33f3bc8e-f3e4-453a-a2f9-230325d0f062", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.1']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3859b636-61ca-4461-bd62-e6cbe61fa47c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7aaa5ca6-da44-4a2c-a1ee-31a83db61f5c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7aa7e89-39da-4739-ae86-76f02b9fe9e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a76f54fc-b491-403f-bbdd-a34209383c70", "name": "Malicious Host", "description": "Observed: WEB activity. CVEs: CVE-2021-31207. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31207", "external_id": "CVE-2021-31207"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8e14689d-31c0-4e10-9e6b-4966b267c40a", "relationship_type": "indicates", "source_ref": "indicator--a76f54fc-b491-403f-bbdd-a34209383c70", "target_ref": "vulnerability--46662d17-7108-4a7d-8b83-36f90f7e9762", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ff6006a-ae7d-4c92-853d-e808c3432127", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--780a5d09-85ff-488a-8e2c-5c19816bb097", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b566de6-ffbc-4718-a208-422e72ccbf54", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c9809d4-4874-4e2e-aa68-9882e2381a63", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66a493dc-942f-422a-99d3-4b33f6f40394", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ade55e4b-8d56-4d45-8dd1-9abb5652c4d4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--820d8f43-56bf-4c57-9122-8b2890b1b434", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0004a49-12e7-4f7a-b589-3e5e5f771c49", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--496d6241-ab6e-4946-bd1f-0a7fe9b3a3f7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8139e5de-a306-47c5-9d4c-8d3a63cea2af", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3947ed2-3321-4123-8a9c-bfa1c35b1347", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9be5d87-ced0-48e0-b51a-2590a2c944be", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54d03b6c-6700-47ba-bb45-cf053170fc8b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3348c11a-f61c-4116-9056-ade84942d3ca", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dba4395a-ce8b-46f2-9a0d-1f28186b8228", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73ab498c-e6b2-4f90-ad66-9948fc499ff1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83a0b3fa-cdcf-4843-85ce-7c33737d702e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bd906dd-cedd-4e68-a82a-054501f42a5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ca99b42-d1e0-4b6b-9f2d-daa6e2ebd851", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c141356-da4b-475e-91d2-694d3152c8cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5692fd4f-9bd9-4670-a9f2-fe70f8754f0f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.201.188.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2705b22-9e39-45c4-84b5-5f6ba2e0a32c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bb65cbe-ab73-4299-8dc6-659255634d31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7209df2-f921-4a04-8e1b-9404a42506b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acc9a955-4924-4866-86d5-29e7e8b0192c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4f31cc8-cfeb-4cad-ba6f-195b3145c944", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b2b82c3-a422-4dd2-9c63-076f92275310", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--551a7315-1967-4720-868e-900c03ee933a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b0c5367-bd51-4aeb-9d60-93772a0454e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c71024b-7c3f-4281-a455-c6efd8a1df54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53b5cf5c-bc9a-40bf-9613-fb721a16de53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afe16a1a-0918-47b1-9cd3-c4c510d8ea65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8c9614a-1c5b-4308-a750-54d8d7ac9ad1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e748c3cf-4ac9-438e-9bf7-7816b83addeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36c672b6-d99e-471e-91ef-1944ffaa61e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa8da125-f9ce-4b05-9fdb-d65627ed04f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94b9c2ea-0e61-4963-a17d-68a8e7e931b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.222.138.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8c0eba9-589b-4791-b3e9-8229be26e389", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.222.138.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9411f59-7df6-4617-bc2e-95cea5b74cd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16b57535-7cc1-4666-8876-00df62120541", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe4556a1-70b3-42d3-8562-7ea2e6ada9ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a5d09fb-ed29-41a8-99f9-9c95ae922594", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34826c2e-7fa0-416d-abb4-06fef488605e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec77a980-def8-45f0-825b-9f57b02ff15c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--748088c5-8bdb-4e1c-bc9c-8c2d11507dae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89ddec98-a0e9-4d1d-9cc6-cb591d97d51d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47939b94-bced-48af-b58d-e3e20f95669e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3276205-ed0c-49d3-9be1-98cf3cd2730a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f31e550-e67e-4959-a258-67c0d6225572", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfa6f319-7a6d-487c-b044-4f3c6b7ebfd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3663c37-1b88-421f-8138-34a512d3bb25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c414e04b-eab7-420e-8e57-1a07386c8fd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80793286-8da9-4f19-910c-f604500baa8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a7ca859-6024-4958-adc3-b6c5eac9a5f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c984d20-8dc3-41dc-8d01-10452b7fec1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fae45c8-980c-4c1b-960f-564156846708", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10d9de03-700e-4d1e-bdfa-3bda9b75a6f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90086d2d-c405-4895-b6af-41ab1c7f4a73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaa8f68e-421b-4294-abe1-a13e0eed7b41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18182321-f3d6-47b3-a24b-1994eb4a1d75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48490de1-9ebe-4126-a989-aa9f77f4237c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af5584ef-28ea-4fa9-ba50-c776cc574897", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dc13ed5-290b-4aef-bd69-c380f9b9820d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.224.128.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--482ad5df-e425-460c-bc5a-0b69d83ff315", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f7f0b3a-51c6-41f7-926d-8a2d727bb477", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dab903b-bbed-409e-a9ef-61b51c1020e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f680b09a-e77a-4e6f-afb5-18c2c669cd7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a61da758-b59c-4c74-8c02-7d3e08aef9b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.227.153.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8485dff1-cffd-462f-a095-6427de039817", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.230.219.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a021eb48-7b69-436b-9b93-a7bd8a8a208f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--491ed1c7-313e-4003-a1f5-8c93c21184fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--580fc3ef-d1ee-4a40-8884-d0b7a81beb52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c12b8d8c-274c-4d2a-ae5b-e9b4dbc6c6dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89f90f58-c818-4309-8e5a-56fe46e1d0ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--309a906b-52f2-40fb-82ac-a3b3c0d702e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28f7e181-24a5-4d0e-86dd-fd539551135f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10e41ad1-ba1b-4478-85cb-5e14b531a279", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1d2af77-e37f-4418-9c53-82cfdd35eb0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--225625d2-3011-4902-a6da-3c93d57d84b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c401b5a6-0414-430d-b0ee-ac3ee8310c32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--407bcdfa-4df2-4854-bd72-3350ba4c52dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05ab759e-a829-4d0f-a4fa-98b65181c0b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97d2cfa3-a661-413d-b126-a521279ef9b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2359edd7-8509-47fe-a0a8-db35a4c34710", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--064ad19c-12b7-4029-a253-35d813cc097e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d72437a-4858-42d3-a2bb-e938ec688f72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d920d2a-f93a-4ef3-a57b-800227104638", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--789ef89b-8cc7-4bbf-b8c1-bc16a4a844ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fb7c557-ae97-4f9f-9776-727afb524001", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6d4b43d-a8e1-4abb-97cd-88a6db780faa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6c025c7-7696-4171-abc2-3e297fee48db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bdf8476-b469-45e5-8cbd-bf448187aa15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db2d76f9-1882-4a19-aa62-198cd647a754", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75bb0e25-737a-4be7-9206-eefd5dcd5a9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7032b772-dd33-437c-aa90-c9f6ec1f6cce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--942d0a6f-a306-4ee3-a9fb-1668ce2aa166", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25be9273-4968-4cc1-9fcf-73e643d40b96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66f84d14-4786-48b6-a31a-45af770524c0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14236f47-66d6-4480-9556-234e57ab48f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c41abcbd-287c-455b-9486-271697663008", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db702473-b9ee-4133-bebc-19b1ed15e99d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.246.130.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8438a265-e521-4cc8-a1d8-8f85fd765c62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82b1393a-c58d-454f-90de-e2be19077f94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59ae8b50-c57f-433c-907b-cefd924fac3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a78e0646-b032-4c98-ba3d-0e61b2c7e932", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77398b6a-6917-4df3-823d-02a143a58e7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1481c7f6-6c1d-4cc7-9d47-7d5b49ac434b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--483fb61f-6727-42c4-98c5-51ae7955437f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00af43e2-2861-41d1-a3a8-e6bb6f1cba58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1af346e2-b0ab-44be-b426-109f06ecfca8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6590d8c6-4c1e-4f43-bd9f-b5ce408d6b15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d80569a-16c6-42a7-9ae9-672ff6bbc86f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6d608f4-4634-4f33-80a9-50aac9a9bccf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d2c33ce-1c71-4aff-bee6-8821eb4d4e3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76deb6ad-7713-4341-b736-ba67914079e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31474467-7575-427e-a49a-1617fc16d6bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d756aaa8-610d-4e2b-b8ac-8b365a7c8ac0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.249.150.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0153f05a-4813-489b-8f63-63f1f0f53419", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.253.160.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa1150ba-f223-4d84-830f-7925018accab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.255.100.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93e17408-ea9b-45d9-b4e4-955c4a95806f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.255.100.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e89fc2be-583c-4338-a0f7-f77c2f71559e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.255.100.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ddfd618-907e-4c54-b56b-b470564b8ee0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.255.100.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00d9b80b-3b59-4b38-aca8-c4355ea9014a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.255.100.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f44e2ab-b572-4710-a05e-170bf5de317d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.28.37.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--422ed697-fdbf-4747-9746-26109fb587bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.36.81.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d30de378-f592-445a-a250-07d6fddec1a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.38.148.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--138bd8c2-2267-486c-9719-a99df5cd0758", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.41.153.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffda48cd-9a3a-421c-9c7c-2b0e3998e616", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.56.45.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0b2f9b3-be17-4573-a99b-65d1d1700374", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.65.107.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--beb00c16-9cd7-46e9-bc23-f9697e008381", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.89.249.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a033ebc-1f37-4818-8d2b-d19ab0daddd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.91.127.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09191da5-1266-45f1-b2c1-2e45ff089abe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.93.89.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d856dca3-caa0-4bcd-abfc-62a74a84194b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.93.89.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--738eb2f0-d140-4000-af75-27b6b5a364d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.0.195.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63201a26-ee46-435a-98d5-d560d66087d3", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.1.167.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--882cdf3e-0abe-4ae2-801f-14272b5228af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.109.93.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ae81507-8606-45a3-8aaf-c3710efd8b11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.123.100.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2840c69f-180d-4771-afbd-fca814885799", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.123.162.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b91b1327-94d7-4b83-aa51-1336bc4b3efd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.127.150.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca4b227e-9fd3-44ff-9533-f6a9578881ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.153.133.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--494ecf78-bed2-4668-88cc-38cae347d41e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.158.2.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cec3175-efe1-4487-bbde-f5a96434f3ca", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.167.35.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a98878e4-6409-4b14-ad10-9d5a19054bf8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.188.149.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b5cafbc-594c-4961-9037-e729a9c02fa8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.190.215.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f00d57b-1738-4ed6-be16-35d4894b9765", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.192.56.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d0a457d-f2ee-4b42-a1d9-8112b4f34b08", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.201.199.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fa4455d-032d-4005-99a7-8b6dcb1aae17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.208.244.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af65ac99-490c-4f82-943c-9fc4ef698a77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.209.190.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85c8bced-2f10-4b3b-a634-003937d78323", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.209.58.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4615906b-6ad5-4ff7-a80d-c415f595debe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.209.62.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--537e987f-77bf-4904-a9cd-c902534cbdd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.218.214.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa1457d3-9ea0-4f16-9ae9-7921b9411368", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.4.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f038feba-746a-4231-b61e-5e607566925e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.56.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d8b6132-2f6b-4c83-913e-b7810a693d02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.56.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36aba620-0342-4843-a29b-335223af910c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.56.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48093d2a-bf19-42f6-b5ae-3c9a0d056e62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.56.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f1f9c65-d4dc-4942-b3c0-ed7b3af0a247", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.56.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--257993a9-992a-478e-8c8e-d6f8e0e44183", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.56.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e84e87a2-2d16-4ae0-8e2c-36c1c7fcb178", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.56.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--516b291f-36b6-4d70-93c4-05567f57f2c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.56.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e029283b-1f2c-4d2c-9646-8b8c9b57eac8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.56.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ecb4b21-1f29-4227-a88a-96d491b16468", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.58.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dec82d6-27a8-4b84-b828-e51c771aa6ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.58.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b49eded-b716-41a8-991f-90762492e509", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.58.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13512c04-ccfa-42fa-bf09-f240eb761dad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.60.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fabb9b1-858d-4af4-ae5d-3cc0f81129b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.60.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9db0f33c-7416-48c3-ac98-4315150b32cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.61.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5176777-5afa-4e26-a99a-33a60f850b3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.62.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fb59fc6-dc88-40e4-8098-3689c2bf6a40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.62.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9257c1c-8475-4bf4-9b42-02ec18d4d4b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.227.90.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--065923c6-a02c-42ba-b6ce-3c562b46706e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.233.118.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6234cc56-3a3c-4d04-95a9-41afd013654c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.233.184.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb362a15-717e-4d21-a519-d175b74eaf47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.48.228.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edeb17b4-010c-4a84-ad3e-250b5a01b7ce", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.54.61.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5deadf70-62c5-4af2-bbfa-ba73a4599e8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.54.64.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e68ed0ab-dbd9-42e6-9eff-b107ac9ae932", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.55.236.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--866f9544-9334-4f81-966f-3093198447a9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.57.1.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fa5ff54-85bb-4c1d-ad3f-ae55d7c2707b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.61.237.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d7f9695-424f-4002-9909-eacfe4a5b3ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.67.173.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52d77063-b4c6-4e17-b6c4-5b9bc6c1bde5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.107.88.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a7dc600-0380-4664-a0a6-113bd6654731", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.111.158.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9737666-cfe1-47b4-a472-d6e2b927ac2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.131.4.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54d03edc-99fb-4730-afa3-526af475d69b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.143.52.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c14f7ec-508a-43b9-a080-d70f4f771517", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.17.228.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--672825fe-5bf7-41f1-98f7-6fc503512b1f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.174.238.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dc834d8-4e2a-47c3-a6ef-bf901f634873", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.184.122.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99c99a01-af45-49cd-bf9f-6c8cda112cd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.190.113.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50a2aeab-e66d-409f-8a42-1eb10b718dd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.190.192.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81bab201-8c5b-4338-aa2c-d9cbde3888ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.191.2.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d6740da-cdbd-4103-b0ea-7f6084d29082", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.191.8.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39aa7187-fba1-45fd-b776-5b8919bb322d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.208.39.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c7e121f-7f6b-49a9-a070-33bc2e25921d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.221.0.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eb73175-8a75-463d-ac82-318e153ddab7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.223.65.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2394d2ee-6b83-4025-94e6-d9bdb06eeed6", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.232.112.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfd65fb7-90bc-4876-be25-13875a4b2edf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.232.181.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4eeb22d1-9732-4d08-804d-4bdf740d3574", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.251.123.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36c4b76c-6c44-4765-a7f0-6f0559501cd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.49.134.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2e000df-d497-4d95-8491-0e23f60c1e40", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.49.39.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1142226-a193-4d16-9518-b711ead327ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.59.144.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec9e99d9-6a36-48f4-bab0-b3ecd03bacdd", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.61.107.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a98726a-931b-4faf-b002-c16d0103fbb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.62.206.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a30075d3-9bd6-4542-86f3-f2c362d76b8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.66.20.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--078bdd1f-8edb-4317-9c62-8f6fe01d566b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.85.148.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a7e354c-f875-4c9c-ac15-c95f90aa303d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.86.159.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d20f29c0-534e-45ef-a8dc-635a55673e71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.114.47.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0331a2a4-17cf-4741-a1b2-cdf59495657e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.123.162.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--277c9a1e-6aa8-4d8c-8fa7-8f7b2b0d9b4f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.137.233.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fe2af4b-6867-4886-b17c-621d08a3acea", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.161.229.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aab5906b-01d6-4b65-9dbc-57f02875b3c1", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.165.26.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6386fc75-a54c-448d-a84a-b12a9bfedd13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.209.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--848d0e3c-ac8b-4c8a-bb96-5e4cc6804b47", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.248.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--671fa09f-d200-407d-b60b-4eea1d0d750d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.41.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--024268cb-2d51-4f69-bd8a-99ece13de4e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.54.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80c2d657-90b9-4d56-a836-3834ede1fa8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.55.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6ae847a-9702-46f0-9c15-d5616d966ee1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.56.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8baa313d-cfb1-48d1-913b-2fbb429d7680", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.9.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f16f4937-fc66-4904-ae54-0405cd330535", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.19.73.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2b4f8e5-b958-42dc-ac6c-48ca3489cf25", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.213.202.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--229649e9-0ad4-4480-81e5-839b41af92bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a18078ee-8d1d-4176-be3e-7e8d65b9ec06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdeadea2-fbc1-4c95-82d1-0379e1775dce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07dbd28b-2beb-4649-9635-b21facebde9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba49602b-3c13-44c2-937b-4496efed29a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df8ea776-7a04-4924-b7d9-3cf9f379e818", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48dd22f1-1488-4675-bc8a-62f4eecd0227", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b59d0558-9389-4d0d-91d5-e8e002baed74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cee1d42-159c-4024-b942-9bed3b0a2b03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--058b81de-729f-4adc-98d8-882f265f4b24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b398f02d-817e-45ff-8af5-bff28b08ef7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c6dcfbb-664b-4612-aa0b-69062c7f7801", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e47f6a9a-599b-4513-a4f0-95f6d287cb31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdb47a7e-d4f0-44fd-baea-35f7fccbadae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b1aba2f-4014-4487-ad36-8e85220753b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d27b1e9e-5060-4bb0-9eaf-1e3202a7feca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86c81464-d252-4b3f-a319-73449f4db794", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.44.20.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f67bba2-c1fb-40bd-a017-e203424c51ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.44.20.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9033841b-a17a-4a60-b0b5-85ee1349ff55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.44.20.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e2d109f-5f7b-498b-be7b-7cd5fe965d2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.51.212.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b85448a9-1562-46bd-93d1-f5f45d9635fc", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.65.93.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82e298cf-6f8c-4a76-ad1c-745481cd5079", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.92.79.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cf996e4-e1ff-4552-8fd5-2198ea9583f7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.146.71.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aaa46e4e-7f90-42c9-ac2c-11d752121969", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.147.19.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f78a702-0f96-48dc-920f-56b5da7b58e1", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.150.88.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43e80da9-edb3-4376-81ba-a2865fd96570", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.189.56.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0e23164-8404-4467-a7f8-4576bbf366c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.192.48.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b3fc0c4-9715-4493-9c1f-47fb04550816", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.224.236.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--442b777f-55bd-4137-81ea-42df5d71549f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.35.249.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3f306a3-b380-4a36-bb77-40ea1448f1b0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.4.3.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee79e519-03df-456e-bb25-4b8a54de8092", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.63.160.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86627570-7ff8-471b-b278-76c12aa4f1f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.68.81.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--accb45a0-1101-491f-89cc-2a1d83e64c76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.7.125.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d6b8def-097d-4f3c-a54d-40f5dca93b2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.76.131.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea668567-44ac-4ea7-a4e4-3cfd2b7680b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.84.238.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cbed472-437a-4e0d-90f6-f7aa45f4da48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.10.164.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1325d9ad-237d-42dd-ae93-cc70820adfc4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.108.60.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--507a52d1-cacc-4a9a-acdb-c07af9c87f45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.113.89.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82522c60-61fb-4662-9d3f-f7353fe9a73f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.113.89.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--173b7144-6af0-4102-97a5-d6c13034ebf2", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.120.253.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51a798fb-c4c0-465f-a97f-ffbe73a26b08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.120.254.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9d65dc3-c071-49ba-b765-1ca251d0d89c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.121.151.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e16caaae-021b-4b5a-b50c-208574e926f8", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.121.151.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--575b85aa-4c1e-4774-a940-6af864e8ef14", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.121.151.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6322ef2-a3d9-4a8f-8cd4-4310bb98312c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.134.139.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2848532-c26f-4d07-a086-b733377a3d79", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.135.148.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee60b0c0-9c7b-4532-bc7d-ec4f072a6a43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.14.248.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63999955-b8a4-41cd-b19b-f46da00182cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.154.201.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51926f02-a7b9-4061-aaaa-690d79ee0700", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.181.141.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ba70b50-a9aa-453e-a894-48cb5cde8a47", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.184.222.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf65c7ba-9957-460f-bb2f-f8754f2b0db0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.189.48.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1c1b847-976d-4956-bbde-4d64f98f4ce4", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.203.12.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c1b35e6-78e8-4ae6-999a-37d41aa8a137", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.221.152.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b481ea2a-0016-448b-9a55-9958190daf2c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.242.109.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--882321e9-de6a-4488-8867-706ebbcc5757", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.247.31.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97a1253d-241d-4622-99c0-61056da7dd47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.32.116.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--269eb532-dd57-448c-9a22-512f69ec322e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.35.161.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4772a110-9f6e-4108-94d3-a88ed62b22ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.55.123.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bf10be1-ca7d-497a-85d5-f1de667f84d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.60.61.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbe4c582-9c25-4b5e-96f2-adbfea7b174f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.74.123.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00473cc4-b013-42f9-8ab8-ccd10de1742d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.8.172.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a261157d-c1ab-431f-a735-9c2dff25af7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.83.114.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8af06559-ea01-4865-9308-b4f334a38b88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.89.30.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9a50474-7253-4c08-87f3-2f819dc48cab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.97.232.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe9662d6-198c-4632-9373-2bce8cfae442", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.97.246.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93fbe39c-3308-42d6-add1-c05d94ca0fa8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.10.8.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7147e62-be35-433c-95c2-3aa9a3196e1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.101.33.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba358135-ed14-4950-ad60-f34674aeb09b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.101.33.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef8d5ef5-e09f-4067-be26-9f7c1fee3bca", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.102.130.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b03d10a8-7bff-4897-8618-a00b28068329", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.186.16.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0830a78-d4b6-40ee-813f-86431c0d2893", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.241.66.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96ce2e17-ecfc-4688-8eb7-29e4dc6f6455", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.241.76.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d843b89-70ed-473d-a23b-f53009705fb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.34.89.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--189fea1f-27e8-4411-b6d7-1d52d2bce0b4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.35.128.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63c7744b-3d0e-4eae-8e3f-1bef1bb7dbdb", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.37.76.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdddfc34-e627-4581-97eb-72246aed4ddd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.53.158.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83e0e98b-8a2c-47ed-8057-9b914842e7a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.6.233.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47e51a96-68d4-4cae-adc2-dc75d52b6504", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.82.96.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d19dea4-88e0-451a-81dc-026522ff36b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.97.0.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee0903ec-9880-46cf-a807-651174cc14c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.109.200.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30dedc67-32a6-4d53-88a6-9a8e7c6973b2", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.109.200.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--472f4f9f-30a0-412e-9c26-cd52369b48b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.119.111.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51023f23-7549-46f4-8555-9d1b5d58b1d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.155.81.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c4afa44-baee-438e-8ab5-baf604e08427", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.155.84.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72eb143d-0608-4157-bdd7-ce7cabfbd9c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.155.90.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f8de285-4830-40aa-a27b-bb1a1e0cc59a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.169.226.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c82a007-d1e2-43e5-ae73-e1bc85fdfc33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.200.149.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70ab7e58-abf0-49fa-9acc-fa3acfb81c31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.210.194.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cf13e37-50c5-4af9-983c-a018ed0c4830", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.210.198.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b6f3951-139c-4e81-b0f0-f855530186f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.227.183.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa7ad11e-7ed9-46c0-9a80-508d7e916155", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.227.249.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edae4f53-7055-4c5e-9ca3-59484003fea8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.241.130.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87b215da-fa7b-42a4-96a3-eec638eeaafc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.241.154.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0c0503e-4fc4-4614-b7f8-d730c00e4b6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.241.240.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16c677a3-cafa-463b-a251-7b884533c6cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.250.225.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95e776cb-7a34-4165-9f96-6cb5a0b722c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.253.248.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--356ef249-bde8-4300-91cc-cdeaafeec87d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.253.248.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b1327cf-6d02-4818-b014-d28a171e4a85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.253.248.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3acdbfb-8c39-4494-bd4e-d846f615ccd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.3.90.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b345724-f850-4e5a-872d-25ce3f35f579", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.36.109.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be2acc65-871c-450d-a236-729379ee3c67", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.42.116.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40657a6e-916e-4396-92c7-e67b81977353", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.64.86.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e612ee94-26c7-4514-94d8-290d1c1cc252", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.81.129.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efbd47f7-d651-4646-bc6d-7ed689b0bb8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.81.131.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68b4255d-3c30-47ae-9d7f-262dd72a94ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.95.10.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a04eb0ec-8e3b-47ae-8c07-3dcdae302e14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10e7e914-3e76-426c-a2df-9ff33a43ebf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69b3ae3e-1d34-4a3d-b64e-d9fa39ae9ed6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1eb76ca-c1a4-4996-b535-be0118aef068", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80c291e6-1ff0-43f6-8983-075e800d7451", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf969b35-9106-4b1d-aea2-36f55835784c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1c28777-46ce-4b02-89fa-a411963c5f91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c616bb67-7901-4c75-a516-6c83b48e8037", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bd04f97-d5f0-460c-95eb-db6cef69bb91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d44ece95-44b9-4149-87f6-52b5e7b90412", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63bea027-aa56-4210-94db-707183fcc293", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53dcf824-346b-49c2-944b-963defaed9ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--129f5789-11d9-4b95-8ca5-fdcdf4ce3c06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ad7ea70-b2c4-4ae1-b414-c9074cd3b9a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f055a605-734d-4e04-837e-8ecee32d0773", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0db63a0-c9ce-404d-9bf6-289188eb6ad8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1964af1a-552a-495f-b82f-21ed1925ed97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46e14c68-eb35-4eea-a532-5b7d7ea72563", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a7e2d2d-2de0-4af1-83e5-582a39df4a7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b1484d3-7ffb-4877-8c89-bf4bab0e8164", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--773dfdeb-feab-4fac-987f-c452b156482c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f35f490-015c-495c-9883-b1d7676730b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.142.43.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0942d012-28a5-4200-9212-a10828f6a204", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edc0fe7e-4b68-4f63-ba62-71189dbed3de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecc4211a-57be-41a4-93ba-937eaffe920c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33addd2d-35db-4b80-b600-8c7f1caa6624", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--582aa067-c70e-44c8-a8eb-1aaca8225ec7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc8bc98c-8c26-4e52-8156-7c3dc5452a3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f105d142-bd9b-453e-b1f2-5ab150396a00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1570c1a8-f31e-4d89-8f7d-49542ab8d053", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aee62324-3347-40ff-9326-2ecb790c6c68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4376c24a-17c0-48ed-9526-4a1651b5fbf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c1b7f9c-ab0a-4f58-8371-34ff3b964c15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00c3a2c7-d396-44a5-9163-12c1bb168e31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58167fb8-7aa1-4546-9750-0ed2b5d438e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f58341fc-fb26-4389-8dc3-5fb37b5c2a38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8ebfccc-2028-4d96-a5e0-0b94f83c7d2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a393c76a-2e22-4576-a3db-508704d83b54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8ec85b6-fa9b-49da-805b-e5b4bb3ce686", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d7857ed-241d-4622-bc87-5504b3279e87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8e4c44a-7133-4d0d-a214-910330e0445a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b044d83f-7c01-4754-85b5-08d6e96c125a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--514e6cb3-c706-4ada-86e9-149b964685a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dba7e688-6557-41aa-a532-9b78bc09e51f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8979dcad-d183-4f70-a113-2ee4399924da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49a7e50e-35e1-4896-9e55-6d1a4f3a084a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--339bd3ac-7e59-4e5d-b45d-8f017fa40679", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acf5b0b8-e024-4dfe-891d-a6be883ac0dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dbd1c53-017d-4b41-b78f-da3c945e82b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cedcee0-58d0-447d-a9a1-2e09dd16a639", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a77f2a7-74ca-4a0e-ad18-078ec2328e04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab55ce3d-dc41-423b-a336-45d0a7266197", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48a588fc-fd44-4fbf-87f3-c8336e44006c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--642fd107-c536-4a8c-801d-3ed9d0e0cc84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b089778-2d2a-47a1-be0b-df48eb27db3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5016cfb3-82de-4145-ada3-e900ae20c2d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47a29860-7d81-4f30-8f23-8ee6b7e924fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9513cd9-69e4-4644-8d23-c57fbbb9891d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b65188e5-3fd5-4e65-b63e-ef27c5112992", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f79a9dc1-4729-4e8f-a65c-d022fe3bcda5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d359d21-4c8d-442b-9a38-82cd29582c23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b2ed35a-cba5-46b6-9a62-a8c3261b948d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6e06c83-b297-4bf9-a923-0469bc481f43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--192848a4-4c53-450a-8034-b922eaa65302", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a1eca17-ffdb-4d51-9657-09eb60588a4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7d8965a-0938-4b03-862b-1b0cb03828c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--254499ac-668e-4bf0-b777-c2a4458352d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0acec9b-ab04-426c-93e9-2a2d53760e8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99d8334d-373d-4aa3-9394-a56e9b57a3e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b25dcec-9b7f-4147-951d-4f4de18a8196", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8495373c-74de-47f5-919a-50219c0a5890", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54078fcb-9445-4661-bea6-4da4e577c6b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa23ee59-15b8-4556-941c-09d862fe5ce2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26383d5f-4e3a-4e63-ab1a-e3653116d7aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab0115b9-f6b3-4096-9e64-93e58946ef78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2ad18ab-85fb-46df-b43b-577109b04ec9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b5b4cdf-e343-408a-a060-d3aafeed89c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--654585be-0773-4fcd-88c4-b780ecd8cb69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9add64b6-7e8d-4f21-ad29-df8d9edaa824", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12a35a2e-2ecb-4ee9-bd10-52e18fb51ce9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--357d8cb1-e42c-4169-941b-1cf1b1934118", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31a1a882-0f82-47a6-82ba-d337ff4ddb49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b18a7a55-8eff-4d54-87f2-0016f164ee8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--778bc66d-d41b-48bc-8146-54c23dbc157a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--416b36a7-32c6-40a4-ac11-48c372406a1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8938abcc-eb56-45dd-a863-85eb4fc92a1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0495f770-9b2a-4a6c-81bc-b03f7f531d68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e62ddce7-3c96-48f5-87ad-f5d3a9266663", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edfb5530-179e-4a84-8716-57cfffeb8710", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82474084-ec45-4484-8ee2-2147d2768237", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--258159f3-5dc6-44e4-8973-c2a329f01e2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddd3a44d-3dfb-4770-adf4-306fb82cc8e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d3b82d8-29c2-4e21-a123-3e1113987e56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4da6bc29-e962-485a-bb94-afab8c1f5b64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.169.194.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f37f084d-74a9-49f5-97d6-1f58e0404bcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.169.240.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e1e91e4-ffd9-4843-898e-8d5bce38ed19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b79037f5-71d4-4b08-b31f-4a4b419611d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20bf947b-80e6-4571-bcf5-3152bc9bbf78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ad78812-24df-49dc-b7b4-e131558b3a0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e00929b-2060-453f-806e-e9befade8575", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fa07b5e-e93a-473b-ad08-c5a57c7ae566", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f068d149-4a54-4572-901a-6a0898b15d42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe791dd8-d33b-4956-af04-e8ebdf23f129", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ead9d574-8485-48a9-9439-ac3b8c5a623a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f7db883-da2c-44d2-bf03-4e9962fa5f19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cfc6e4e-f893-4ce5-89f1-ad14e42c9c04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5039937-b59f-47dc-b24d-1433f59c5a15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--287fe404-3d7b-4164-9b40-d2bceb20c68f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77c68f77-817d-4922-8479-e03a547c2c45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fdbfeff-81a9-42b6-bd95-4c6bed2f4a00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08110048-f477-410a-8f87-2999a576429d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d7b8a27-0d0e-4fcc-a692-f8d5ec58f4c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07aea0f4-85c6-4f4f-8269-cb4be34241f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff38c387-5114-45b4-847e-1b62266c2258", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4159c939-3f71-4f3f-a9dd-39b29fa1157b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74cc3c14-8a07-44bc-b004-e371cebcde2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7001068a-84e2-4235-aad9-8ef42520e2ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82c290f0-5c71-484e-971b-cfbd81016060", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4ba0d47-2a27-4bd1-af1e-feeb00873418", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b51a6bc3-ebb5-4a02-a739-aaac5c4f2569", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d69465ea-6340-417e-83ea-cb706a5c6be3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--740f7496-3d99-4bff-a2fa-87cf8ca47c60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5de1d6b-ecd8-4224-ab60-0e17c35e7089", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df936031-7033-42a0-868a-147d31f6d9a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff9f4041-5830-4898-8043-bf73f6af1cfe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc8cc5fa-e6dc-4b9f-a0ce-2dc5ac6bdd68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9ea9434-5e6c-49a0-a43f-3076f7958591", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b8fd8ca-5f3c-4824-8a1b-e530e8a9302c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cfa2aa2-ecc6-4d38-96c2-1a166de2883a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d182e5b-5f42-4bc4-878b-3048f5dd6e92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa106fbc-58e5-4afe-8468-031c67c4a74b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9bf3e3d-106b-4a3d-b28e-4a23c180812e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60109cbe-36de-441a-9467-ab0a200c44bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06b05352-34a9-42cc-94d7-38c537121fc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e255106c-5c15-47e6-b576-6af37341e2ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.233.201.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e001ee7-c568-491e-94fc-991dd0ba51e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.24.123.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4568a1c5-717b-445c-a295-28a2986d424e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.24.211.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22fcd516-02e7-4301-8bbe-14398a8e852b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5c342e6-0a1a-4c9a-bc69-5782107fc183", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39b36d87-db3e-43f2-829a-440e070e5f40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b95ab4e-24bd-4306-8783-e7dac286edf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04d6ebe7-0461-4a4a-8bf9-c813f38aa0ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e55950d-3810-4c70-bc81-d3178e923e0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08ef299e-607a-4bb3-8c2f-07aa2f9a2d53", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.162.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c610dd49-ad69-44c3-9fe4-e3401171a0f3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.162.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78f22173-584b-4c56-a678-e8f6ab1fb4af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.162.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffc77503-3ba2-42fb-93d7-46a351e95ec5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76a2fea3-d46b-4aa5-910a-0d2c8c94f122", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--690ec5b5-e50f-47fb-88b3-5fe4de35388a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0530a7df-9448-4faf-9faf-252211a37b48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8c7d443-ab5b-4919-b076-b441b39b5463", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7a66d60-a2ed-445a-a940-4d08bee6d283", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d7d98d1-d18f-44ae-bf6a-5c4b820e611d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b51db354-86ab-4e8f-a916-059dbeae1304", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e333729-802d-4849-967b-dfc5d5ef9352", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2445bd7d-cb13-4273-b756-866e04a4393b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6464d222-5ea1-44c4-9729-1d40a89ba2d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--819c3c1e-f37b-477b-a23f-6a03061fd31f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f08d9bc-8d88-402d-9a2e-614f93e0e94d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23c51474-e962-47c7-a14e-1dd40e109be6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d86d86cf-e5dc-4098-8a2c-cd9105a44ec4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b412d031-f636-41b2-b0d1-27fb4e4dabc9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.46.255.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6d24a31-c638-4846-bfe9-59aee08bde9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.70.122.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baf6f7c9-a995-43b6-b373-c846af2cbaed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.77.182.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d83f7cea-3f0c-49d2-8a88-cab21c0b023b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.186.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--955f8e30-cbef-4389-ab3f-73a7382e3258", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.84.3.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da5a7bb0-e6b6-47cc-983c-f92901e331e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.12.85.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11841e88-a7ed-47f2-8183-824480f3c4c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.120.230.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--732a4871-80d2-4b34-9932-7502bd6eda2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.135.34.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c139a4d-e32d-47c2-8598-8d33702cedab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.147.93.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9464573-37ec-4a66-8412-86d65d8f14df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.15.52.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58befedb-d230-4c3e-ba76-ba64f230b7a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.163.160.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c755effa-d44f-4a3a-80ab-61924a255c35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.164.107.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39fcbc8a-57aa-4f31-80a7-9754ae256662", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.164.107.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff8bbf5d-a517-4c75-a80b-f0b2f161d7ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.164.107.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a052e132-a10c-4f52-827d-7e777bb70a96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.180.48.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d21ff0ee-6d92-4fb6-98e9-125b12c2ccb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.176.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6301f63-ef19-4a1a-8b7b-ad8f0343c750", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.176.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--582f12a3-12e5-4721-bfea-ebab75789df2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.176.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--157eb524-6f42-4beb-a0a6-51b2e11fe6a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.176.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--056fd635-da2a-49f0-9358-4c4f28a305d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.176.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f5b992d-81ed-4c2a-b649-37d217bb4a8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74d0e539-1c5f-40eb-b39f-9cec5737da82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07e452b4-e66c-4901-8b34-8732761ef126", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c128daf2-75f8-4bf3-90ae-f7357705f83c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff7bf118-3cd1-4f4e-88b5-3cf8e6b02ddc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--193e889b-f98e-4764-a963-ef29728c603f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.195.210.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7a0d60a-001f-44bc-86e7-530e65ff40c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.35.227.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29299289-abf2-4fb9-a1b3-08cc3e7f40a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.42.205.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f0fb6ea-0ca5-47ff-a579-a136e3337b1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.44.90.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d2f0ff9-4f3c-4a75-a4ca-5a1d3ab88fb2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.5.82.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--671c5311-e4c5-426c-b774-9a5cd4a95d54", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.5.82.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9d14d98-9917-4ab7-9ff3-937aa0bad138", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ec63860-86d1-4db3-9816-c13cad148e58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e88554f-f50f-44b7-b2e4-16b8fe538e87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6262f79-4099-49be-a06f-6f5ca6b9d5a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f890b722-095b-4844-87a3-abee830396e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cc57cbc-a620-4cf0-b388-5c1f108c9496", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c4c2d20-d5e6-4679-aba6-a8729fcec3fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96c6ff44-21f9-4435-945a-4b995a438627", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e77f401-b419-4fac-ab03-c47172c0ad4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20d2ce7c-bef4-47f7-93fc-349609b8cf9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a26bd85f-af55-4672-b492-ed35a2ad1ff8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5892c873-4aca-4a64-aa4a-60fa647bb9cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3ad58cc-5fa4-4e77-bc44-37aba0c4de70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.59.206.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3076a26-5d87-43d4-a9bc-cfe284547960", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.62.107.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d96f175d-4a54-4323-9923-9e2345e5982c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ead5c424-41d6-4224-8a82-e79e08c0b728", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22b8b0f0-3db5-4f59-be13-003748c91b8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a11558a4-30a0-44f6-9625-f46354d7a282", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e8234f6-2fda-4386-997b-b22d87355d0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53b792c8-086f-4849-8ba8-c22845da1475", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bf03c07-d55a-4268-8ae2-eee5e05801fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31de6431-277e-4cae-a06a-dd7819fdf666", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c393b792-40c0-4f07-9589-ef96608a5b14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79ca49ca-2b4c-4441-a86e-5462aba43d02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b790f4e-4d77-467c-b037-c4db14a3ec76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc2b716b-c989-4e52-9b4c-f42f24057281", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7b05684-aeb5-4d08-bcef-005fd665053f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b597956-a222-432c-9642-0727836088fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efde8c96-33d4-4fd4-9d3c-f63baef77708", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c237758-9572-4adc-8dfc-3cd2a3b923fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e323446-3c15-43d4-adf1-5f30ffcdc5d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bcd5fc8-2e4c-447e-b452-37268d7f81fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32156fef-2bca-4762-9d67-887d37f379ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96b93e5b-b973-4b19-96f1-3b6fd8da4142", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41e1a1fc-7205-4041-9d7e-7165e6bd5ed5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c96127f-598f-424f-b76e-1a68cebc3561", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41fa3c1a-4418-4c53-83c1-8c26bbbbcc79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac35e619-59a7-4c11-9e13-9f19f949d771", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--308f5351-94d0-4fcc-b884-96def62df2b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2af6da8b-eba5-4d10-a795-77dce375299c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.123.210.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2715da06-7c6d-417b-8116-5e33a63f146c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.123.246.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5be9355f-f2c8-4a74-a90f-fa1fe868e6b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.133.23.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37c1747e-981f-4eae-90ac-b3aeb1f73edb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.140.214.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42174a24-05e2-4cb1-adfd-a66a7eb4c2c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.140.214.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1308edad-d890-475d-bac9-5022b4cd7f01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.140.214.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e972f5d8-7fe9-45e7-ab9c-1f9e87c9bf92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.140.214.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdbfa711-3954-4e80-9e62-5c77e4779719", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.158.4.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79d86595-2301-4a52-9ef1-7eac757bb23c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.158.88.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d6f66f6-eaa1-409b-bb41-894fccc27b2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.160.220.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61e01852-3e32-438c-820d-5ecc7c60f2cb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6443bfc-c83a-4c8c-947d-10a673a50f35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa8c0350-7d0e-410d-a7ac-4d7b6425ecd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d8810bc-90ae-4ac1-aa54-ee7f522a5563", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67d2c4fa-70ba-4066-9e91-31aeba3d2994", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a342afa-9925-4c0d-a60f-4302f98d689d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d1f2619-d868-4a03-a11e-f61bacdc99d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5bdd85e-fd76-49e6-b4c3-b934a48257dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--899f959c-f8c6-4830-b9b4-f063479abb58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4044905-6390-49d5-bc6e-b952eb9263c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31fdaaa1-d85a-4d3a-918b-dc65e4f25f12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e005593-b353-49a5-b2c5-513fb8dc46d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ae6fe94-508b-492a-be47-854c8083c8cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f90e982-b636-471c-aaca-46b2232471f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--202bf79e-5e48-428b-aee0-ec241a0a3c73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64c5a273-bf3a-4b1e-b8c2-6bf88cd271ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa2bab34-99de-4d95-a3f9-866a481298d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e905030-58ae-4ed1-90e9-a672de722f32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfd473ce-f46d-4487-828e-c901b2f4e2b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cafdec61-925e-4f51-abff-41f457da453e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf754064-ee10-4b86-9905-ed09525a3409", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8976d8b5-2abf-4bbe-98a6-d76523711b9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6f944d3-1521-46f6-bd6c-bd155a7abe8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea6392bd-6ad7-48d0-9488-690c8f355698", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5589ebbe-8a57-4311-9c1e-4c6754264310", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e49ba4e-e7fc-4365-af5e-44b308151138", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2aef6f8-085d-46d5-9ade-c81e5110bdb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e863bf6a-a1c2-4d04-b3c5-0db843c125b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13a5b575-b17c-4512-8411-0f4fe526f863", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c74c5e00-5005-423f-817f-7df0b453a7de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70ba420a-a9f8-4583-917a-28d936103a08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adea3e39-51b8-49d0-b1a4-79ede020f8e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecdead00-cc25-4f23-9718-559cdf83cf73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e506d313-04e8-4fc6-baad-3a1502d6af86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--197bfdc0-2482-468e-bbe8-db1fbd6d870e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2e95f15-1d64-41ec-89f6-d510e57e54ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--744a173f-41f6-468a-84db-ee7e512a5bbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.163']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f14146c-8f6c-4478-9c2b-4d9301d43228", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49148d5c-b311-4a62-be6b-45007c5c6ef9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--385d4bf3-cd42-4500-b55e-bf1bd7a869ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e43aad0-dabe-4fe2-9497-cfc48eb69f0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea62b5dc-f662-4ea6-b7dd-2ad28c6aea72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00f21374-094e-43c7-b9a0-5f43d482fb11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--606eea74-77f6-4423-98a5-2271f724cfde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2baffa69-3089-42e3-bcd7-ef19777c008b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ea1ec13-a0dc-4537-a4b1-bd834141e958", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f29da613-34d9-4ebd-b743-e6f78dabddc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6870246a-38d8-4751-aa46-06a40c17cdd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e8c15d0-edb2-4f23-8eb3-20bb12bb2702", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80a35a3a-8469-4dde-9195-a280726851a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b8d7f52-f193-4349-b1b2-5bade3dffe75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a343117-f569-4f92-bffa-754de43392ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8bc6a36-707c-489f-9434-f94c3b728b8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60dfd46f-8804-449b-8a13-66a9e95d1673", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--130fe905-55d8-4c00-9fe3-fdc18843c650", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f79bbe92-9f16-4185-98fb-26fbe88c2f9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f49e8449-e0fc-4b09-8992-c7860c8ccf64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f562e8b7-50cd-43e4-9e3e-a6fe12503dbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebfd8e64-0d95-4304-a61f-b0b3f4563d7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a062626-9d69-4b0a-9ca5-f42aaa2d2716", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03f3c396-cd3a-403e-a4a9-fd3441b3303b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92ac17d6-11df-4f1d-aad0-4c3e4505b41e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a7070b2-77dc-4d7e-9249-88e497b17620", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a88734c-9315-458e-a990-a67dec054fd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76bd4fc2-48ff-48b8-9d81-0d17399256e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73416d20-74e5-4776-92c4-e5b8727a82d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b32c891-19b9-4703-8056-4b8934a3934d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26a88e8b-d295-4443-b276-307d20836a47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--045dce9e-b281-4cd4-a5ea-07ceadbf8898", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3c7016f-7b78-4815-b1fb-b7cf62745531", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--547c8f24-4330-4931-beea-6388fe1890c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f97d626-14e6-40b0-86be-d88407bf03ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4c9a116-da34-4d53-b595-5abd7428f283", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dd10ab0-9afd-4851-87d2-d36b5bf5b0c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdea05b4-de25-44da-b7e7-471e8d79b59d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3ca2531-1e03-4d6f-982d-41b5ac5e1237", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dad9dfd5-861c-4aba-bb80-21546e2081cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3132ce5-d141-4399-ad73-b15eca393a60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ed3d7b1-7990-4153-a59c-9215462c1fa6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90d02314-14c1-42e7-9742-3cb56c0092d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8aba008f-f5dd-4415-a970-80d1a9a8fd7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cb47c99-02ef-491b-a4ae-40074097af25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bed4796-cf58-4a93-a40c-5efdb4280e60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaedd405-08d4-49b0-95ef-adb087a7748a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54749a68-0de5-4b87-9ea8-2bc556517df9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d720e625-b5c0-49a2-a307-ee14c7c7f7aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b00670b-2e7b-4b16-ac2c-1bde4e74e2dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc967e3b-047a-4aff-9e53-0093dd3fbcac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dca87105-7840-47d3-8a25-275598ea23dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4d7d638-b80c-4e5c-9051-92596b1edfc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f65ca87c-3168-43ca-935f-42d6e47c2e30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ef5f05c-fb96-45e2-a475-5ccb8d0fdddd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1c8187a-eace-4b20-ad58-49aef7f586c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5779bfd2-a286-4df8-bc0f-ff5a761917e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9170a36-cb00-4493-842d-fcf449dcb3d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af404e73-385b-4189-9b46-079b55372feb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b5c44ac-4f26-452e-ab22-166640ed0ab0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--561e299f-a0ef-4f42-8268-4fb673e5bab7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1470f650-9ee7-475a-ab54-dbb0a2c459f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6164ab16-dc67-4228-9045-307d15d8a9d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8c56e4f-832f-4ea8-95d9-18015e5c3bc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a40ee96-8986-4722-909d-25a5eb007a68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de1c1705-dfe1-41a4-9fda-9102fdc7eff8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b271422a-9c66-4b30-b56d-855c97664130", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca648b5e-5cea-40d3-a497-8d8fcf31b123", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b97b7db5-224b-47e2-8d14-24aaab48ec2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2dc2d83-5775-4b02-bbeb-505ffa450625", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91e6850c-cbb5-4044-ba25-7a493f2cfd49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--181a60cd-555f-490f-b734-8c29d5d24506", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db1cf4e4-2e11-4c61-b49d-44c4ee93d864", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7920213d-e92e-47e1-93f3-03e5fca146ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--168970f0-3bfa-4b7e-a4e1-af067ade70fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8171d785-05c9-4116-a74f-b7259eb48f64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5941a3e4-d9c2-4aa4-8a7c-a0270b690c7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d6e90f0-d5eb-43b4-a34e-0bcb7938cc37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f31d669d-d221-4ea2-9150-632b5a05188e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b58e00f1-30d3-45b8-83c2-d4d96ca07589", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b99c2b4d-0cda-4456-a9ef-2f8e30a0b1ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24de978a-84f2-4098-8334-9e30701fc2d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36fb4c9e-9827-4806-9510-33566970f46f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0ed0526-344e-48c4-9d21-f2547d227d8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eed8a6ca-a5f0-4789-a713-97c8ad369ed8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--350f045f-f9a1-4cb8-8f9d-c08815c51bfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--188e3ef7-3b16-41ef-9a4b-da54f94edce3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2689ac14-94f0-4099-a2f0-e0955c064685", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecf7c8f2-f417-49a6-b959-3eeaad8603eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--263941c3-c5c1-4d54-bae9-16b542440010", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.200.18.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c413909e-f051-4134-9099-68fad549ce70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.201.140.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5eb719c1-75a4-470f-9df7-d1bdfa4742f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20e645d3-e12f-4794-9eef-6434183210e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67dc87a7-1b59-425f-a369-8885efe4ffa0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d7d2edf-3a7e-42b0-80d5-c488ca260c70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d23e4031-4369-43b8-aa2c-383c506d57af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05edf198-7aa3-402e-ab9a-92cc7ad6cc28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a8a0f50-169a-460a-805f-944f98a5ab0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e675f11-173e-47e3-83be-159bab1eedf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e46a695-bf85-4605-b6ad-ef617174fa91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c27d36c4-775d-436d-84d7-cbd77a1897ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f80f4ee-410d-4469-bf3b-550a2f985469", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--172e0eec-1d74-4a6e-99fb-aac9907d01a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f13fa0ff-c108-42a4-a0eb-d9bdf313363f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f28e2361-d96a-4f0d-a06f-fc196b56c0b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95d751ee-f9d1-47de-a3da-cf4186f2561b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4ace771-c81c-458f-8958-077e6ed7b5e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.211.96.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c54f7ae-092f-4b36-8e83-a52c8a1be079", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce560472-8539-463f-8418-21d7b78dbb8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f67eb1fa-9e7f-4531-b9a3-738e1b29c017", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df129667-9192-49f6-bce1-b8ca1eb57c0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0543db3-b8ab-4340-bfed-16e5d77fd7c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--658c63df-883d-41a5-bcdd-90f1d73631c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3981ff2-9793-461f-9265-86d8153c3716", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4eb8808c-516f-4ed2-a2ef-0646a4fb46b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34fe3376-fe96-48b8-9a9b-70a17af30702", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.250.79.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fb2f65c-ef35-4657-baa2-4d62f2843fbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.26.18.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bec17cf2-6a3c-4455-a8c6-965541131745", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.26.248.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d93c970e-e4d1-4a54-af90-b58934f6cbd9", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.3.220.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--062e01bc-ecd9-47d2-aaa6-5462993079be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.62.32.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5ab92a9-a5bf-4896-95e6-749b703af2f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.88.211.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9f7a8c2-aae2-4b18-92a8-fbb9d38ffa9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.88.211.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6b0d2eb-5d78-4463-8fcc-9a52a40a3e75", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.94.151.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f02efc28-65dc-4f22-9713-2b6b24e9a33f", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.177.180.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cfad26a-4535-4f8b-8755-02f55c81251a", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.177.199.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb710e2d-21c8-4689-a5b2-8415651231e4", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.188.236.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9811ffd5-e45a-46bd-b904-fbf1b8039b50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.188.56.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7550c746-17cd-42b3-9d28-d342b8a25ef0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.188.93.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae23adcc-c963-472b-a851-e306184cdc2e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.189.237.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a91b4d32-1c3b-435a-aa90-cd8e8e890994", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.196.53.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5a735d4-9020-4319-a83f-b51cefd15750", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.206.139.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac44de69-c161-4c4a-bb2b-94d4d5069a12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.207.151.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b729a38d-0e27-4bfe-81ed-25193c2e4be6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.217.84.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd23bca9-b67b-4be1-bb93-c287820cb429", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.218.240.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81b99089-32c3-4a55-9808-a484bd539022", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.238.48.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c086f9c6-76a6-425c-b57e-984b46a5de0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.74.129.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78990f65-9dc7-4899-8525-21fdef7eca74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.13.21.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc3ce167-a90c-4779-8c04-d22394b3576b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.17.32.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0289a874-7267-4e95-9008-7e090725795e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.17.78.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae726e06-7d1a-42cd-8b76-086ee5f1860d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.234.117.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bae5fc3c-0dea-417a-a262-82f0c080b958", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.243.0.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb3e457d-0e79-4512-a6d0-6855bce13e01", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.44.15.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9089c155-b6ba-4f7c-abaf-1cedea46461a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.105.213.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--558c95e9-75fa-46de-aeee-2ef26af48dce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.11.177.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--645c79ee-2b8a-4354-a520-5eaa41a5f935", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.163.193.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65fd99d1-0721-48ab-ac56-ea39b73c2bc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.199.104.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b9948a5-f2d6-48e8-8e67-91e81c804c8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.199.81.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b15f9281-89f7-4843-8786-2144eb4c31e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.20.104.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7db82a41-4a87-437f-a499-4855e1d71510", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.20.127.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf6fa16e-a886-4de2-aacc-1655434c6956", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.20.127.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf6ff127-aacd-4244-b3a6-66f3adcae20d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.20.127.163']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a42150c1-74f9-4127-8e74-cabb391dad69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.204.253.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daac0dab-da9a-4680-98ea-f62bb24d95e3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.23.150.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bbec3f4-d46e-4a47-a274-d03fe24ff541", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a93957c-e3c9-4ab8-8877-4d35442bbca8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80a1bb8c-873f-4c6c-9fa1-d8d3f29b0ea7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbb81323-aa22-436d-80a1-dc5dc212023f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fe188d6-d8db-416a-aa55-b7caa568f5ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--019f4297-014b-4b10-a0bd-211e2f38861b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--918154a2-242c-47f9-8d4b-3752539c54ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eebb20db-de74-43c5-abcc-4725b8914028", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27bb0b05-82ff-4d93-889c-bedb95d3af58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--142b0215-878a-466c-bd6a-1fae15e11dce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10ed82be-0e49-4980-a011-39fef800509d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f90ebcb7-3e43-4671-b67b-783bc864cfa6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f2db2fb-68eb-4a38-aba5-1497268e9334", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51b5995f-8cab-4b6b-b6f7-129268f8ba91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ba73f2d-748f-4ee8-bf0b-870f64d28b57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f255016-8a88-4fb0-9c6b-7384aa23b4b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c356f9ab-17f1-4371-9ad7-279d4cda631f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22d0b5ac-798e-4d67-8391-60556b614d28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28269f60-9583-4dd1-bbd7-b82b924564f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82bca353-d89d-480f-875b-204df7f1b435", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44921d46-381e-4e8e-8d62-e2fc6196dd87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4667dfe7-febf-4d51-88c4-85792db6027c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--298768ff-52eb-4038-bb30-b6f3a33280a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efedf643-d911-4eaf-aee5-78b2d72471f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7cdf22a-ef66-4f0d-992c-ea574ddf9a75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aea33a0-4d3b-4e31-9fe5-b93fd277e334", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc7a6db8-6824-4d86-9a86-4930df5fec2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d99f5fd3-1fcb-4a6e-b11f-7a804e7a85c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6ff2a92-11db-4e51-8d86-892705d57a50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92b2e7d8-eaa4-4bc5-a3b3-97b6629d77af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1e70e03-4b33-42a3-a742-b18079d039c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--369fe4ca-171e-4f8e-bc9a-13f5d28ddd25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af3a28f9-253d-495f-bf93-cb8426e815bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9109dfe2-0673-4b16-bf76-03bdc2dab89e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--494cdb20-a21c-474f-a658-59d4e46621a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e3c14b2-41e1-47a0-9939-7d409b28592e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--caa5cf92-5f4c-4a13-8ab9-69d9e2a9b434", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a943ce6-f10c-4a4e-8152-ddf9ebbca7e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fc7198a-423d-4635-87e5-645ee95a0c32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c415c857-41e1-452c-9656-fed1ad98dbfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae03cbe4-a16e-45d2-b646-e77670ded019", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31e4d3db-3b13-4cdf-8190-579e103ac978", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52691135-e8b6-4d8e-8703-2c74dfa41cd2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4cf0ed2-e12d-4d03-827c-c065b1590a5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de912293-f1da-4b14-9b54-a01ed6f66dcc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c598189e-40f3-4a16-85ac-b77091f7b7cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8f7e424-0003-454d-9fb2-9322c5b2d8e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fba03c0-ada2-4a9c-afc7-2c98b89380ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--337828c7-06b0-45b8-ac72-37c74aae5a46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b0a4377-1812-4f96-98a2-279ef37320d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e86a7ebb-e424-47a0-a237-719868882176", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--930e9dbd-a891-4f23-aedf-86b750f649e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a952276d-b11e-4ff7-a1b0-52b16760bf0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61df1d80-35b7-44d8-b16c-6408df5e6175", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa0e43e2-53c8-4e41-b3fc-4828819fa8c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed1fc3e3-e40a-4a02-872a-9e73a5c38b2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1261ff2b-34cf-49c1-9e7e-0f87188f4488", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab2b0b1e-94bb-4b6f-98b8-abead8398542", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daffa19a-c5fb-4b4c-8ab4-a23a8f3313f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60ac5a20-3c19-4c19-9309-9ea0746f1857", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ec55df2-b2b2-4c10-a5ba-b4bb71c62989", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80584896-313c-4c61-8e17-d68cfc71af31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4bb5c1e-fb2d-410c-8548-f5ce97dd70cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f7e98aa-ba78-4fed-a464-850a138a305d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e0e20aa-a71c-4f94-922c-57487ac47a1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa5c219b-dd71-42d0-ae72-21acae4fd510", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e24c981-72b9-434f-878b-6a32313450ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d27dff4f-c5c6-482f-bdd9-fc9ea6b089a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74776e73-2169-4c44-af0a-c55d649be6ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a02bf3a4-25c5-4578-abb8-7bdc132fb740", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82bad397-7efa-43a4-aa0e-1a1a76ae91d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf541db8-fafe-4642-afd5-d99646e182c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dfc6f59-6837-4e04-9ceb-32811c6e4479", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df5c9f73-dd9f-49a4-9b99-4a98161a495e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77e7d30d-8ba9-4ad2-928b-022725572ead", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad465f13-1bef-4b0d-8a59-6d754a6d53cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--358642db-1fa6-42c0-ab15-137801d52268", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64c68ae4-5707-4b65-8165-8344cad110c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd5b9bb8-0109-44d7-9aa1-b2dd81c802ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--238c2678-423a-4391-8817-2faa22302490", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cd868d2-6a27-4b8b-8099-33d871d9bbf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f84b725-99b8-4592-9e5c-88c710f1f875", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21a03e39-aba9-4b92-9b67-defc34ef99cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3d2ad66-3d93-4695-b308-629ad8ee7331", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e73db8a-3602-4dea-bc35-45ac88513a38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14d3bc72-4ab8-4413-961a-0f95412d232a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c85b3c6b-fdf4-4a3d-adcc-79ed64f5416f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--511f2638-476a-4a42-9ea5-892df440c88f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eff6595c-85e7-448d-b908-377683a91d10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea0afe73-29db-4d40-9c17-cd31a36b123f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66347d41-e034-45cc-8da1-27d7cc8b8e16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--529b93d7-1987-4699-82b4-389b0dda5297", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93ad8da1-1ab4-4ca9-8221-14189d49595a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed79632b-56b4-4ea6-9304-28ed4924b8dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47fe1f03-4cbc-4080-ac38-b312be7bad60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db06ebe5-942b-48b5-90e3-d0a1a7b0701d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--565245bb-fc98-4a97-9c38-f6519408e06d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--536ac58a-739d-4a55-a12c-a7475b81e3cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab0d8108-472d-4506-b026-10fd14c06373", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d1b597a-9c59-46fd-a53e-2e4f2f9e23b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ff6a6c3-d851-4562-bb36-e157a0db232f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2e41626-977a-45f6-997c-b0e83ae486a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1ce80af-a7ee-440f-a634-aee1a6ffc38b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--559c10b6-282e-4efa-9f25-d1112f0e3087", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b0d8103-8cab-4e07-930d-e48cff8289c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7befd4e2-6263-4f1c-9f50-da8de20d7239", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c570fbf-e335-42bf-893e-bc6774caf5ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f30dc180-92a9-49b7-9654-245045eb8c46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--354cfa1a-1632-48b3-b1ad-59e2cf35d6b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fae6661-28f9-4914-8d65-cc69f4608b89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb7f8dd7-9cb1-4a1b-8da1-5539194eb1f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c3d5997-0180-4b34-86c6-d258ec3a049e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0133df71-c198-4d03-bf5c-2fdb65ed39df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41e4cef1-ec16-45de-b6f3-4bafc45351fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0090278-a942-4bb9-9bbc-bdfa9406c7a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1abb047-eb40-4c54-82c9-ce15bec13947", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--230c7c5b-d561-4788-9cf9-6aaf50009fd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1b5e1c6-a781-4c96-b6f7-3294326deef2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c92df231-d101-4868-9326-414a0ed94b4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b19d4783-482f-435c-918c-f773663acacd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--033b6453-662d-45aa-a0fc-94fa811a271e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cfd759f-619e-496a-801e-231b3e812f5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92a2a4ec-2257-486d-b7f4-5e1ca6773272", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.244.240.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c507962-1443-4d8d-8c0f-b64ed76db154", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.38.85.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd652365-c261-4d76-9863-14cc7b7b325a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.38.91.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15e17a6b-eea9-493b-9345-2fb1b5d17e0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.46.134.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7dcbd73-d086-4e8b-b0e0-a22749f64543", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.46.155.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4f40f8b-92e0-4775-801d-4195bafc7de8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.46.199.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8dbf3142-b09e-4433-b103-3ade21363b3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.50.140.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3619fe8a-d384-46be-a30d-283c80060f18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.58.118.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a7bb0b8-0aef-4b81-9f3c-22e17e16a8d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.58.118.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7803e0e-4106-4500-849b-d7b3c542ffed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.58.122.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0e4e525-855a-416e-8f45-ed1d100c2f6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.58.122.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fd907e1-1386-4a4b-82c8-458e51b8a9b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.74.50.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--281cce84-3bf0-4051-b607-096b438c5ed9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.74.58.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01890a8a-551e-4dc7-91b0-f20fb0cf47c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.98.55.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--143be3f1-45fd-4114-a9d8-3269f5456f1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.98.56.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca3e8a80-5768-4007-95d0-7682db9e25d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.98.60.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2519ae6-e7db-4494-ad6a-191444255d0b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.103.57.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e02aa481-d6f8-4698-9c82-d141f2004a2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.127.60.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--282a605c-47c8-4150-9cbd-79a80d39c920", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.127.62.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--619048a2-34a3-4e1e-9b3a-181dbb0a803a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.127.63.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8f683aa-06eb-49a4-bfb5-c22497cefa91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.30.231.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--707ba541-618d-44bf-9131-c742a5642bef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b8537a5-c26f-4720-807a-80c1e2e4d55d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--652792bf-2fa8-4537-b550-913f9f35ef6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2da14706-7236-463d-b8b0-df59501a47d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73a2393b-15b8-4bee-b622-941ab78bef13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41f67cdd-8a92-40cc-858a-d5535673e67e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--307f3efa-cd4f-4cd5-a9f9-93d1f6dc71a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46630790-2597-4178-86e3-2bf87e77e833", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddf4d88e-7bd1-43a4-b015-3b22dbffb0bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--385eaa90-df17-4776-8520-d0fada2de106", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9072222-d17e-4afb-a6ee-bf3a6fa5abc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef9d0f8a-da69-477f-9a2a-c126b2641fcf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8476b84-2065-4aac-b867-0ed75bd8875d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a1b39ae-1bfa-456f-ae7f-b635917a755e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0778241-ae63-4383-adb6-7abef1294ca8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d38a3a06-c341-41a5-ac36-c9d6f91d6071", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7baa42e6-54a4-4f23-9b14-4f89b7f0564f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc943d2b-af6f-4a0a-880f-7ec283aa15bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c712417-e786-4aa3-a6bd-e6cf40c2fcc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ddee4a3-8d94-4dba-9a39-722e08c0c343", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfea175c-1254-4f16-9c9b-f503bed0ce98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc2de688-d3d4-4a15-8450-d023f8b0b538", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21ee9c6f-2afe-4888-a9fe-4f5f68bfb4e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--496c3bbc-6cf8-4bb5-958e-f2c8ec442b10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db52e0e1-2d66-452d-9dac-44b283e90e44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--241c6d28-c09c-472b-ad6c-17145488fcff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fccc931-1623-4749-b76d-666bbbd78dcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--374aa6a4-6e1c-460f-99c8-4092233cbf3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0748b956-6df0-4738-969f-206df4d97ef8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--839ed4f1-f37b-47b6-92e5-7ee7ed1fd585", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a865782-0803-4170-8948-f25cdf19b1d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8fbe05b-53cc-4f6a-bab9-f4d2015e5d46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b44dc1ff-7b7d-471d-89e4-40e23db0a387", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebe95040-67bc-43ed-8c51-d58ebb6fed56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03484565-8888-4c60-884e-dfb3a9ea75d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b5fde7d-b496-47b1-a0cc-62e6c5f56a2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7079efa1-fcd7-448a-9227-9af7f2a30567", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfa75592-41d1-46f0-b7e4-7dde9803822b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--620e5b87-0733-4a6a-b811-306b513487f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b770a4c-e8eb-41c9-a2a6-6e3789948c8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c9109e0-3389-45d6-ae0b-d7f184748010", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--985fcbff-3dcd-4209-a50b-9dc30a52d1a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da777f60-fea5-4fb3-950b-40acdd2de559", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a99ccdd-4c26-4f7f-a593-9aa8f07ec8f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b156573e-5dbd-4e3d-a208-6b4c1f06bdf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52b0910f-4f8a-46e2-96ba-c32d910b1988", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0978e748-3d11-4ac4-91f1-e82e11641680", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.71.214.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd59dc99-2f5f-415f-962e-064c63a59b3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.71.214.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b017e4d9-c324-4242-8f0e-77eb03f77ef2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.26.103.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baa7df2d-2030-4d70-8aa7-a447b9b44951", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.26.252.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7b97c55-1edf-4ebb-b6c8-124a458df436", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.27.36.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--385ec501-f6ac-42d9-afeb-8787f133f5b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.27.36.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d64596a1-e973-485f-b386-430fba247f12", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1791e81-02fc-45f4-a79f-4bb2a2f650f8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85509412-c996-4346-8965-941546b7f96c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--941644f4-08f4-4361-af9e-cb8c72dc3ff9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--063d6e75-8840-46f3-80e4-1031d88cb6c3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f19a7a3-abc6-45e7-b221-51d5c53c3e44", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5d49a21-6858-482d-bc6a-727694272bfd", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8b0ec87-5b81-4929-8816-defe434879e8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fdf258b-1a30-4dbb-9e93-702a2be6db07", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd5ab9c7-a816-4ecf-b07d-6d5cd1622e10", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f6a1047-53d0-4d03-a0a3-8a6bdb753923", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19fb19a6-f6df-4078-9a37-9d92e8930a93", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5aedf8b-3312-4332-bd60-86dc0d6635fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.59.22.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c76901a-dd37-4049-a556-e07499472a10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.63.211.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0301367-41c1-4bb2-b97e-c64198ea3a13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.102.115.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b0d3f37-6ea6-4cde-a48d-14a517cf4b8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.102.89.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c69fe8f-1fa3-4b76-8800-a9aeb331b08b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.168.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5844640-5c8e-4c15-94d0-b694c51e666f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.196.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76e65a54-c3ce-4ecb-8dc9-ac0902861ddd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.49.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37cb7e4c-c07e-4cf7-9a67-032e1f1495df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.56.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--930192c5-89fe-480d-9cd7-21947bb9ac13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.56.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd24ae99-3482-46bc-8dd8-1b6e6d969528", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.56.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7a4a774-bb80-4ece-9b82-b71f8e8cbaaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.57.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8553c6d7-c467-44a8-918e-9fdd40f9b3db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.115.90.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e892c151-dd63-481b-9ece-f933ffd2027e", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.115.99.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38a0d882-7990-4493-8d9b-db4f32b5fa07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.201.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13783ff9-84b3-41bf-b68f-c681a08fc36f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.217.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08fbdd10-eb09-4687-bc99-b5b03ce0bd36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.24.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5af51779-6efa-4c6a-817c-4e82ee84d8eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.240.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7568c16-d980-4c40-8f8f-7fb2b176b1b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.240.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9c5eea3-3756-46ca-907b-72d105e62dc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.241.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--002be210-a7ca-4396-b0a1-50feb023be14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.241.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ae4d272-987d-41e3-bdeb-c5c8542f2121", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.248.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eeb10480-cf3d-4136-b01d-5345fdad38c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.32.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cc54ca2-81de-4038-9dbf-5c11c5e15b51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.12.240.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d99bfa8-021f-4588-a249-fe3014958cd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.12.240.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6e25be8-0b98-4606-9224-2838f87d36fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.12.240.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8f63242-ebcd-4718-9913-a2af6a4dd73d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.121.139.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9797076a-7081-4dae-8325-b42ac0547ccd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.121.46.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--614cd3ac-0507-42f1-8939-3e13de5a3c84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.124.87.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--489a1764-c326-48f9-844f-c7ca01c97b74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.124.87.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86683f28-e08a-4d78-8fd5-ff3984893c9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.153.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b88cc30c-1de4-4b86-8f3e-11615ed45855", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.157.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b352adc-d7fc-41ee-98ee-2279ca9137a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.195.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59ee7273-8ba1-4be8-bd6c-0d6e915ca744", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.202.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbdecd79-cf67-4db1-b41f-8f8799e68817", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.202.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ab0f4bf-3859-44d0-ae2d-c93c712b93ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.203.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c8a3e6e-3d9c-4d3a-9922-719489c0c31a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.208.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8380e76b-2610-420d-9779-692906d7b372", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.220.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6155d9ad-55bc-452d-9fbe-fc482955b027", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.220.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9aabb188-369a-4830-b4cd-8f66ee6f3d81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.224.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47902ec0-729d-47bd-8545-48214ad4c8c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.244.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--487fab6c-97b5-4c30-ad29-322cf974a8a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.73.1']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--521cc2c3-be03-48c1-be15-151aa1c2afa1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.74.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60066f0f-a570-4917-a258-71bbea68ee2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.74.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a630ada-5733-40bc-b428-dd8287bf3671", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.78.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c990e47-58e7-40df-9b51-5313392d12e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.79.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c96bfb53-e152-4f46-8e68-1c8a1b155cf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.79.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66e560af-ba1f-4f07-93ef-7e7d7f289eac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.81.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--070b3fa2-a889-4e8a-8f26-9b483467c8bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.83.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f89ff36e-b04a-483f-a85b-40953ee7e608", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.87.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88709e8b-924f-4c4a-a42a-454816e61519", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.88.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ea1e777-f0b1-43ec-947a-553d2cb497e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.89.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fefdaee-b99d-4d31-b762-b66d38665850", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.94.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfe369d4-352b-4df7-be2c-a350833878a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.162.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74885290-ceb1-4ae2-b17a-49add5133428", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.162.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2964587-b868-4194-8de8-c47be643a7c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.163.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5eefa6d8-a573-4382-808b-551d154b6c64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.164.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e21b349-1f78-4958-bef6-b3cd02010031", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.224.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b763f521-8614-4432-bafb-aa35de4ebff7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.224.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b0d1c8a-220d-477f-80e7-4ef3536bc1ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.150.192.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11cc09d9-8100-4594-a091-12d748f8b4fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.150.193.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89dbb182-9f71-4406-8a8f-59253229ceca", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.151.131.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4ef166a-dc57-47da-84c5-6b972cb484b6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.153.204.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4bfd3fd-b687-4f8f-811c-2d8e06cab714", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.10.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47bd6284-6cb2-40c6-856d-95c687cda76c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.13.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f2d2dec-fc0a-4761-94f7-4786d4ff14e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.14.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6ac48ee-c1ba-4249-a180-5c6f8aceac4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.14.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd0f79d0-3059-4900-9af4-48c23c2811b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.14.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--737d06b6-9fce-4557-8b5c-545ddbd98725", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--711ee24a-f0da-428c-9c9f-0640ff663c0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09cc1afa-4506-4065-b189-a0ffdde25044", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e004515b-1d8b-46c6-8d0b-a9d718e1d3a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8cfe1df-8cf9-4725-a549-5c3e4fa28086", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4b7629e-ebf3-4227-bb3f-af4cdba63219", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a88ca26-4d8d-489b-9174-c8b96a391ca4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db5c642b-f2b4-4329-b2c0-3a55ab0a8eff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b7dcdd1-513f-450d-af76-026a11fe1ca7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cfbbec4-a23e-4672-a010-3e36ad6c8a85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d1943f6-7ab0-4087-9c7c-6026bda67b34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e16a836d-4a0f-478f-9402-eaf500d9a5ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--678fae0e-85c0-4591-bd63-e1542418bae0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.2.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09c47098-5e98-4caa-97f4-33efe6e32173", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.2.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b1d463f-76ad-4982-849f-ae36a08f3770", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.27.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79cd3c3e-a2ce-4c99-9c0c-065808bc8df6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.3.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba46d5d6-b35c-4a65-b032-da75b5aacb62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.32.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d8f862e-78dc-4a81-9415-5eb0d8706e75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.33.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9d4fa60-8d1b-4206-9c20-06935d07154b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.34.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dcb4d9c-1b83-4556-a8ad-5b9925664144", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.39.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0fe0789-0cd0-49c6-b0c5-68fc7f7b7e5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.5.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d2ddf86-0588-4a26-89e0-f963be9dc1e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.5.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff34f1f4-8311-4744-bf37-6bbaab88d416", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.58.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e90765f-9bc6-48b2-901e-4bd3457e19d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.60.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc2b4ce4-fec9-412b-862a-932fe67d50b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.61.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5808cb1c-f2ee-44cb-bb72-fad134997202", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.74.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4492c5d-c7c9-4004-8971-8002caf13315", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.74.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51786ad6-3cee-40ba-8c9b-4dfbd59566e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.76.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0234889-f58f-4554-852b-49e9b6380583", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.0.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--776c7cda-992f-4191-a5b5-274a2b6a439d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.0.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30ea3e3e-d03f-46ad-96ab-628fd226841d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.0.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ece483a0-b746-48ea-b2ef-697c9b9adf27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.109.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae0d7bf5-7b76-4586-a862-949487e3a4e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.113.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c716d366-c0fd-47fd-9073-b56e83fe7019", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.12.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41a13c83-474c-4018-8112-f249cfc458ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.12.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56bcbbb1-db06-4915-abab-5a835b63ad98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b51044b-24ae-48ad-a908-daa305abae16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e19425a-1105-4508-bcb9-db6760304fb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d272439b-bb88-4655-b936-a7a4e6b83b57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff277831-64ac-4a48-8372-34d8d24d24e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0279116-036a-4f8a-9b4a-a9be38594e67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e05d77f7-f565-403e-a95d-52cb6c2ddaab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db4ea5da-6c73-4a29-99c0-a028cbb7750b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83549d80-30cd-40da-9039-bc60347bbe9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.122.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d59738dd-6679-4376-9423-3740fb6f9d6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.122.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d714b14-513c-46cd-8ba6-873528781553", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.123.1']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c83d657-17a5-45f5-9bfe-266b76c2b55e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.123.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--048a2442-0079-4901-8537-5102aaf4d1e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.124.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c88a583c-32ef-4ea5-a80d-46bba9076167", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.125.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0724e28d-b997-45db-833a-a3ac79c0b7b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.127.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d2ebb4b-21b2-4178-a7b3-a42aaddde89c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.6.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b27b491f-9153-4496-ac99-0b5a8dfd1590", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.6.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a2dedd1-c140-4935-b84d-16c1bd707268", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.6.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8da054ff-b2f9-4bad-80eb-0d744e83ca53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.6.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8277e4db-c8bf-4773-bd83-5a99e3ffd332", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.7.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc63c3b4-4675-4f21-a7c1-ac79847ce9bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.7.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0782e81-90cd-4e90-b1b2-f5350c0520fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.8.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e5a752e-00f6-4892-8d86-186eda93cb56", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.104.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4650f297-50d1-44b7-b4e5-0c144b155dd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d94b23b9-0f63-4488-946c-b7debe150e89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ef5bb6b-1122-464a-a87e-4974d4ec2e87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9af66a0-05b3-4896-a6ab-f6b5b31d62dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a36c1ff-c98d-4102-b170-088801bdad31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cefa8126-21a6-474a-b2c9-c3942f0bc0e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.106.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd978eea-02de-4578-81e5-d6d137da76c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.106.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91490fad-d5b4-4135-99b8-4e6aff9231c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.106.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9197a9c8-246b-4ece-8f0b-8e53a1862710", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--235e2a73-7189-4fa7-bc05-c7abf6389991", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--166a91b8-5a74-496c-b926-881117be21a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e65f8e9e-2906-421f-bcb4-4598db19f2be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc3f0788-0a47-40c5-89d2-2965ae2259c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--132f1acf-c525-49a1-b982-e8bd3b669951", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a73b5f57-8bdc-46dd-8134-c2d2429b8f32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07eb7733-8555-4642-899e-b4e580598311", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3132c6c-3898-47f3-985e-98f830f0117d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.48.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68087840-2eda-4f04-ab37-fd9fff80da58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.48.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff9e345e-5cdf-42b2-9eea-13d960ea8390", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.49.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a53b1d91-4796-49ef-a094-f13802a54e6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.49.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56abf054-ec38-4de7-af5c-bba5f3345c30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.81.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fad81cd-cd90-417e-8277-73f1024ebf41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.83.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da08923c-22d8-446f-9e8d-fe24ed54986e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.83.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01c41a16-fdd0-4286-959f-adcf59d81064", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.83.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b029cae7-2de7-48dd-b4e6-9736c55da141", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.85.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--433c25e6-3142-48cc-8d7f-076a344a2655", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.91.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--652e8526-21de-4729-b85c-e154bddac1d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.91.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bdfc900-8c66-45fd-a836-f13c0e85c342", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.25.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed83b897-6c79-47a2-bb03-ef0f45907191", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.25.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82853cf4-aa27-4f5e-b334-539e20265b49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.8.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72bc4e90-3596-4dd2-b25b-eea794bba8b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.8.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--823fda64-1982-4dfe-b833-1d3c57ddba03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.172.67.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--080560d5-6939-4e66-bd59-e5e6c634b326", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.193.141.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0471af5-d234-4776-8bc1-02e79bb84c19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.199.125.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b90724e-a0c1-44b8-b02f-1126666fe601", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.2.152.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fa96b00-8d9a-4582-8e85-1e7ab9f9a2cf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.2.83.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e75749f6-5aaf-499a-b036-de5a483cb387", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.203.42.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9e20603-2e9e-43cf-8ce7-647692d8f49e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.220.221.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--341dc24a-281f-49a9-93c4-a6fc6b97ceb6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.220.233.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5618f400-bef6-40ce-ab8c-6467198d7908", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.221.57.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33d3087f-beb3-44bf-8f10-18f8a15f0f8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.221.66.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--472c34a2-eb53-492b-b976-c71b5c0afda7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.221.68.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1db56e3-34c1-4fa1-9169-49bcce964740", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.221.68.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1458d728-92cf-4e4b-a3e3-e143988da5d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.221.69.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--849cd845-e6ba-4e26-9783-1b6d66e4e144", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.221.72.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69129e5e-b648-48ef-87ff-b723688f82bc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.228.193.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8e3b7d4-3771-47c2-9e85-2f6ad313ad82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.19.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b66a83f-3d06-4c24-9a4b-ecf8ce32bae0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.22.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8818dff6-a63e-4c93-b0b1-77bc50f7300d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.23.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a480a545-b4e3-4f08-95f3-462820c130e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.23.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec7a2908-7ab9-4d10-a184-c4ba9e9f33f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.24.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad25fd97-85bf-4c1a-9aaf-7eeb52affa36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.47.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca9858df-832f-4a5e-89dd-1b79cbc55c96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.57.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43288992-f21a-42ef-a94c-135cff19c25f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.57.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8438afe-3ee5-475d-9f58-98d539428ae0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.57.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0c2a7b6-b79d-4683-9d5c-78f4a3cc9f97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.8.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa018da6-d61a-4fdd-8c0d-2c15fc00f52a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.38.32.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e498882-7c86-46f0-baf7-cdb3f16886ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.38.33.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e936fb27-8aa8-47df-b733-fb2cc94c7754", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.38.46.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cab5a9e-f8a7-4890-9fb7-e8f65cd15c2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.40.218.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48e6f6c3-b896-42b9-aebf-d3bb5a958247", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.40.250.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--689fe434-c303-4629-8678-60b12dd4db49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.40.250.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f88770da-500e-462f-b686-fb67b4708e5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.42.108.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40bb45ba-1f5c-4fa0-806e-df0dfc951a41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.42.95.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88953823-f56b-4912-9c3e-8123cb11dae7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.46.228.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cdaa2be-cc13-41d9-96b9-5f733f56cddb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.48.166.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffcbed88-1554-4157-a68a-ea672ca59621", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.55.35.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83433657-e5b9-4104-a8e1-b1ab402241af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.55.35.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77b38c04-8ffb-4922-b6cf-d47d3d8b77ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.55.73.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ccf1666-68fd-4d11-95c0-db79ab40cbbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.55.84.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83a19ef3-f21e-4625-83d9-4bbdfce2997e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31ef3192-a307-4b98-8090-36c500a7dcb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26e2b6ab-b7c4-4aa8-bda6-077065cc6bd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--103d4da9-9941-4373-b501-3fecea300ba2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9183f395-4d22-480f-9660-904a40f1857e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7be9c7ce-7d35-4dd3-9233-38ec874c527f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6ab5e2e-b6b9-459c-8153-9a1f8c4eb657", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--768d03b7-0e0d-4137-ac83-b772596339b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--486f01fd-74d3-43b9-aebb-545c1cff4eee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42affa3c-b30d-462c-8e18-464eec5ed952", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df496118-b5b2-4f25-ace2-bab9bb48fd64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a661cda8-8aac-45ac-8dce-a48e23efd1e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24a0dc65-f777-4906-bd9f-4654e7875a4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--652bc48c-6a1d-4eb0-8567-fba2fa6f9482", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f88ea7b2-0808-484d-b5f8-458f1b24d70d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d7a6da9-ea24-4837-8cba-c48ddf6de098", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.106.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c28bae4-89b6-45cb-87ac-2a69afbe0047", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.106.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e963e58b-d5f5-4cf7-9207-9eba92ad4a4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.106.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be67d830-ec91-4b68-9d05-5f54c6b520af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.138.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a770d2f6-f0f3-43ac-8c9c-58e408eab8eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.152.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--965cfbfb-542c-43e2-ac82-fd06c24c93df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.153.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6af4d196-111a-4546-8fcb-6f296e29a062", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.178.1']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2720729-3803-408d-80a5-a9bd4b0c8392", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.192.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0531c64-094a-4a28-b108-4cb9b1512998", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.192.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf852065-11c1-45c3-a017-9df8b371bc07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0d9b60b-f9dc-43e5-85b4-6f5841c2b38a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ed01a6c-8daf-47df-8d1a-aa7785d53081", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c2451e1-c0bd-40a8-ae3b-9ce6172e3e88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3173e9b-7efa-4900-961a-1508a6e3165c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.163']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--592b6290-533e-4a33-8fb2-6ef5a4782d34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d37d0f7-963b-44b2-a6af-bcf35521c438", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--920e9c3b-8395-47d8-831b-8b80d8b7ab89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--246e91a1-7651-41b5-aa56-46989f18af22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58855923-f412-4342-b314-d2535da22d85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59d3a91f-2e68-4587-bba2-fd57aad8f838", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--563acf67-d3e6-4479-8b70-4c84b4c837e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cadb991-33ff-4967-ba39-31afd323e2fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.255']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fd0137a-ab11-4b8b-986e-13e43bdfd81a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cf691d3-14e2-4179-a61e-3c170f9b502a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--688bb833-9c17-4ab1-b947-7feaa310ccaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b1ab3fd-4ec8-4e43-ab31-dcaa5cf1b071", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea3d3e57-18ba-438c-86f4-e6de0352a6e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87e2295e-fa2f-4d2e-a63a-220bd795cf67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6421379a-c9e1-4743-9762-6487efe3e9ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b01e2a15-e7e0-4d3f-be24-8958138cb5c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15ca9136-dc90-4225-8c56-cef39c05b318", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b52107ef-af87-45c4-b2f6-38bcc2103bca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd8c9f7e-a3e2-475f-9249-00d5bc7d15e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--259108de-c930-41c5-a382-e108c63f615a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d48e6755-af68-4bed-b375-003831500c95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85863ea0-1a67-4928-8750-7796b65fd277", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e461766f-2715-485c-85e8-87eb27a1273a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--265d06b0-6253-4c1d-b329-57fba6440cec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94d03ebd-3e61-4022-921a-42f99980ec72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b54bdb4-df30-4df9-a2f1-3f1cd5930798", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2740eacb-5a21-48d3-9bd8-df8eb2d02aed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27169f48-1d13-4e99-8bd7-ab0063b7d238", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30c4b9de-79fa-4386-97bf-ff53fadc7a75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50c247f9-8938-4513-a5c6-55b78d93efcc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.217.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--610af9f2-2236-4884-95df-dae867e99e8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.70.200.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d358dfd2-59f4-4639-9505-d005b911ead0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.80.104.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d53163b6-fd54-4739-8b70-4fc916c98522", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.80.105.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--583f26cd-dd46-4093-aae5-d3aee4a9b869", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.80.72.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e19a0270-d15d-4924-97f3-1145aff3caf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.80.72.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e989182d-b66e-4be0-92e8-258e4918998f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.80.88.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95cb0703-02e1-4284-9413-9c2c0bd8caed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.80.88.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--caa0f598-5fcb-49ac-a1ec-81863da24e16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.81.46.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e8cb37e-5b20-48f7-aeff-134e5df93a8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.83.165.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48d85367-8dc1-4e94-b5e5-7dd227080544", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.83.165.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5025a24-83d6-493c-b27d-f7640104461b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.83.167.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ed52d6a-b448-4e06-ba67-4148a43c6330", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.83.27.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d32c7dee-d8a0-44b1-aa21-57c64763083a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.83.32.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32107bef-1eb3-421e-a5a8-ee8aa9e7b26d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.83.32.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2473ed7b-ca9c-495c-b752-bab0900ea22f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.83.49.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17817a3c-f7a7-4dc8-a3ac-35dbcef8199e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.83.49.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ea03466-c015-4b0a-8e4e-a4c98b2345f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.145.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80e593d4-1e54-4eb1-ba99-33c387735189", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.162.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69edb109-6b9d-4a13-88cc-740a386c431f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.61.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d31d0fbc-be60-46c4-a94f-ab328f7f6c81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.98.128.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e3fab9d-c3a7-4b49-8fee-12721f44313b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.98.152.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7db2451b-8b81-4bea-8444-4ab0b0f26212", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.98.165.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cd845b4-6961-4303-86b2-c2213d58c33d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.98.166.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb93e6aa-70f2-48b0-877d-346d910e6ef5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.140.205.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0f3cbf0-6597-4ce5-a1fe-34267c25f1bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.149.98.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43467d34-ecc3-4b54-9bdd-8deade14ac4a", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.153.166.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d6c426e-ac30-467b-b48d-8c5c063b8475", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.195.226.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4841d766-8045-40b4-abe0-be44e5b28a60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.201.136.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb9071d1-a395-47c7-ae00-d65d9bffc521", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.26.188.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2463053-3a86-4004-858f-77f2a1cbb97e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.50.192.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72db6fd1-c29b-477c-b30e-1dc68b23d769", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.89.69.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6b68146-10de-4b5d-814f-84599e4c265c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.92.160.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00cbdddf-7966-4dbb-8dea-928a1681f304", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.123.252.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96cb6958-8690-48ca-ad93-57f53516aeec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.140.123.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--956142af-c748-4c04-a45a-bc9fb3d8c409", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.146.11.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d06ad40-a020-433d-b7b5-b457a7405ac1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.179.53.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--400ce8c1-992e-426f-afb8-2e9303e0c34f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.220.188.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8389f70-d421-483f-b4cd-b7ede4b319cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.254.225.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--489eae9e-63d0-440e-8edb-93ef877a7e25", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.55.113.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee98baa5-79af-4b24-ada4-4743347a461d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.71.192.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ce3f7b4-7ed2-4603-882a-cbdca4c6e6be", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.77.124.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10f63841-def5-407b-9ddd-baed7d30dca6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.93.117.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eefe9ee5-e5d6-4166-aa0e-26f8e2b94d60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.1.28.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a9178ae-6865-410f-87ba-900393313b31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.1.28.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78a8682a-5e41-44ec-9a54-58d8f85991cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.1.28.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f728f609-092b-4b71-84e7-ac9eae0b0502", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.1.28.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d759e35-9bf5-40c8-9942-93c6a71d9f73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.1.28.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2acd792c-6fc6-4c53-b70c-cdc1bce10843", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.1.28.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--913ec81a-944c-4feb-924d-5b3fc2697ec8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.112.47.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74d143d5-6322-41d0-a88e-b8add44581e5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.145.0.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7740bfc5-6f87-474b-90af-f797f4250d83", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.152.204.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dad6fbb-f77f-40e4-8799-801b1827f155", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.166.164.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04f03b41-3039-4cc0-881d-9e8f339e8c21", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.178.125.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07c31aa8-8554-4992-81c5-38eda0f0908f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.183.141.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d22af61-59dd-4fbb-97d3-63e081c4b331", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.188.47.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fde013b-22d6-47db-9b96-9a77ace465b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.71.141.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3846a148-fdd0-403e-a781-3827e4140c9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.117.127.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baa4bb03-e8a0-4601-a722-b977127204d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.141.157.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--540da561-bc9f-49a2-86a7-31ee09c5296b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.159.90.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c91d98e6-09d3-49c2-85ae-ba530d891f8d", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.168.79.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33d179a1-73ac-4e08-ab87-174dddcf89c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.177.88.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f46ce94-da94-4432-895f-ada27aa5f624", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.236.109.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a6d3469-3a0e-4fc0-8576-12355799fa65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.55.131.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66da04a6-9847-4e81-b385-1d4a1d195f64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.55.131.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa4afde9-9aa8-4a99-a71b-29ea5c269e11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.55.131.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b932a1d-7d0c-416f-9e0e-9d7d0878052f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.81.238.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f89ad9e-6819-4ddc-8830-c47a352bd24b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.76.203.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f68f48fc-0e01-456b-b412-e60eea054da7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.76.203.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--679d354e-2ee3-46ad-924a-3aa72293cce5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.76.203.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23a38782-161f-4b03-b0f6-350ca76b3276", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.76.203.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e40ba9c8-aa18-4f47-859e-121aa20e102b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.76.203.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8316c36-375a-4491-b16c-2ddf910ad8a3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.169.39.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50200631-f960-42ae-93ee-92da549bea56", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.169.39.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70826838-bbd3-435b-a610-2e00339b0e68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.185.117.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3248d41-73f3-48f4-8e74-ce7f693f6227", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.185.118.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7708e27b-a818-40b9-ad78-a710a2a4e683", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c20b5d0a-dc27-4cd1-bda2-48ce696a0c55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de7295b2-7690-44dc-b42c-4b71cb536034", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d198956-4f92-44c9-b5f4-9217be53a34a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--865158ef-29bf-4c58-877b-d27479940b55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2df1edf0-863e-4f8c-b9b4-e6c88026d3c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--348b8e2a-30e3-4286-bd29-11a64323a22c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de195f8b-376f-4ef5-aec4-4103d7e1f159", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c71d0bbe-33de-4b93-8d67-d2ca206fd110", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6681b26-5741-45bb-9dac-c6fa09889405", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddfa24d0-c8f0-49c2-b3d3-0b415c7b5942", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4724b6af-a2c2-4f81-8b95-9fb52c1eaead", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dac7dd04-555c-4e69-95f7-59afc3d470f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a97613a-12b3-401d-8b9b-9d42848edecf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5463b5d5-d91a-498f-97b9-19a9c391cbd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04ab1618-d0cb-4b24-9766-89e2cbc62123", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37355929-94df-4d52-95b3-2e631f4bff52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bcbc279-2855-4a84-aa59-28d0e62e8c7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a77eaeb-6190-45f1-ae21-03d3f6206a37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c317c504-846d-43ce-af5a-6bbab57b211f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--247b8081-8ea4-4a30-954a-d14dafec94ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be0d591f-d954-4f37-9eca-eb79161e5641", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f71aa9bc-31b1-4b62-aa68-41a71cc14a03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f5dba4f-081d-4845-9be7-3f3dd61aa15b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8dde707f-15be-4050-965f-8d817a908ca4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ddbb817-ad33-4781-b0b1-3fca547b77e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17d1c447-0918-46c2-851c-7ec62a712bcb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--503f399f-347a-4cb3-904a-98f847bce183", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcc5dfbd-0586-41e2-b979-1bdbf9adcf67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11bfc565-00c5-47c1-b7f4-fb640ca49387", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4d10d22-d40c-4988-bc96-b54f63d3f6af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--914b05b4-9711-472d-a732-847d641a3d34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49e34e18-c2f8-42d5-af31-8eb4411dffce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b90b06b-c3ec-469a-9408-b1df373f949d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--421cf8ae-89ba-4dab-8f13-3bb3c85a05f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dab15fa7-a434-49d3-b273-92cbcb8bc90b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0907230f-4ea0-47ef-a77c-6a52a2b9e529", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ae61aff-268b-4ae1-b8e7-3dd13d4ca850", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--901688c8-fb76-40ec-8b14-60f94c5a2f47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4601dff6-2fde-493e-9b62-27f50c01b4cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c07cfe5b-1e92-4c60-abc8-289326cd4e57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73d1503c-020b-4460-a8c5-ebd24767c2f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--256e4a9f-6b28-402c-893d-9f997bb0ee0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a492a15e-6f93-49e0-9fdf-3a99a89e5579", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c17c0ff8-8ec5-4ce9-969b-11989fde612d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68436190-1bee-49c3-b9bd-d9b97e32f8f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11731c36-6a3f-489b-80bc-4189594d7a4a", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b4ac486-807e-4f04-97ec-85eebeea742a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4db754a6-0613-4d5b-be6c-953363453f1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc1a203f-2b75-42ce-a7b5-4f2fa2453e41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6fda080-7203-4d07-8e76-e69fc554333a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5734071-0a67-44ab-bf97-2de1e9a3ac87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80cc2413-abde-4451-bc98-febe1eba4a8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bdbc217-ac4f-4a29-bf11-578d4dc8551a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f258b0c6-6a53-4ae1-8036-6e1bce7d4e0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e22bdca-be2c-4c07-8422-a124483a02c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79cbf4e9-eab2-46a1-9025-a7d02087e844", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02c3482c-5fad-4bab-a2a5-7ff47078ca87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2eafc680-53e5-4921-b83e-decac1ebef6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e6835ca-372b-4270-9501-75a291d306fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--321a2841-820e-454c-a3fc-bebca75f6e4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa56e07a-db93-4a1b-956d-10a496739558", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--459b5b8c-8601-4cd6-9a00-ad6a26c3d620", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4ab30b8-674a-4bf6-9334-1d47f4a29357", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd173590-2460-49d0-bdeb-bede100ca6b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7306b03d-b4a8-4440-bba6-6a3ad2bb1d52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76dc9e76-b43d-4da6-8cf0-75c2a6866661", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2dbdf03-e2a7-4229-9ca1-f5c13c9a3945", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--057581f6-7a57-4c17-a1d5-919e8e580863", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72c3b7c2-47a9-4c16-94c8-b1bd90d1f2bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f85dbdc4-7ca0-402b-a455-57dd4841bfb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08b82249-07e9-4d96-bf2f-f8c2e4285c79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dfbb647-68be-446a-8fa5-79fc79c00c85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f872aec3-5926-4fd4-b734-66c697a9d7f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d94757a9-071f-46b9-82c6-785505fd6446", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac57673d-1c3d-4b23-a410-8b4dd1ac1810", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71e84552-1df7-4bc7-9bbc-122a53abd606", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b75da907-6a1e-4d09-84f2-a9aa87b92fee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91ede994-336c-4506-b925-d6d60c8163ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--294a28bd-b6c0-4c6c-83a5-a70bde183f4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e116313-1031-4322-bcf3-5876000a6646", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e33e2f29-c81b-4d23-8a89-8d19477aa5df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.255']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7db7105d-a13d-44e9-bf57-57cfe8d5a6ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43e65eae-2c99-4491-811c-a3eac1884990", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42776a47-1334-42bc-a49d-e2ee09aabd2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eafce416-8c2d-4401-9e14-bce7feb0263d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d831d13-20be-47af-acfb-31cddf32d4a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ad1c068-821f-46f2-a65e-edc5d102fb4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--affdec39-2a9d-472b-adaa-2691b5581e80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2da79e2f-58ad-4267-8c2a-2d61553499da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eda3376-c0fa-491b-bfcb-a7aa56e26e56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--140e992a-5568-4107-ac5b-91295fa9c293", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73d3d916-e01a-417c-bce7-8ddc2fffd93e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c1c1da9-3f14-4260-9564-6e547cfa1e29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c249884c-3995-479b-b11d-18f705b89390", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd074828-ffc5-45f2-84d2-eea518838c02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e45cba21-e5a1-4909-81f3-75c29b271fc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ce3c95f-abb8-4625-a0b0-794963029a31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02b7b502-8285-45d0-b10b-5a6980a90da8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec3c815e-cd27-448d-b1b3-62afabaf1781", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30a3a1b3-ab8b-4563-92a1-f6d374f64e76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da69fd53-43db-4c01-ac04-6f909384e74b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3206db78-2d4f-425a-9431-52227a67e00a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f29607ba-ec92-4f0a-9e51-443a13eeec27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cf1774c-1aae-4af5-b565-4c6ce9a9d163", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0ec3cfe-f597-4fe5-b62d-1d1cf8f8b21d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5683df7e-0607-47ba-b67e-eeabf25cb9b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6553e31-bcd1-4650-b7ec-7b2509b542eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b83ea79c-25e9-4a72-91f8-930b2197e625", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65b90c28-6fb2-471b-ae27-30ba950f69f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afff9ef0-a10c-4ae5-b41a-3c114580b148", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43d05898-3f16-4fba-8d21-a75af922c71c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40572dae-8871-4433-866b-00ef8a507ca6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0a80220-3904-45bb-9dcf-9337a749dc58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2af53557-5847-47be-8fbb-573f1fdc6c7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81648ca9-512c-4c55-bfc9-895a4fd48ae8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe053fd3-461e-410f-bde7-3834211a7cd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd89ec4d-18da-4cb0-8127-4890191af8df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c83cee1-f706-499f-8bb6-834b0c47e516", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c505c58f-8969-435d-b3d3-b16fc2e84126", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18e33b55-d9d0-44de-8e62-ca5c89a8c048", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d021258e-066e-415e-a9be-27ba3cf07cbb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e396370f-2ebf-48fd-ab35-5ec28fd41b68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.250.39.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--186fc2a0-e9e2-4f6d-aede-68c5e962b6a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.135.171.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f05433f8-8849-47f3-a64b-2ffc972b57cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.120.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a030862-cec4-46d6-9d95-7b5d988484cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.132.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0731e1c1-4387-44c5-812c-ca3bf56e5214", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.159.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--690b1739-bcb5-4dfe-9853-f9c1805fcd13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.174.255']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ede384cd-a4d4-4879-8704-4f097abbe472", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.216.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02888d6b-6c98-4199-b6a8-f2cabd015435", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.227.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--833b0b53-9ef5-4a8d-8f76-42762618d644", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.228.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ccef552-6c9c-499e-8b53-92264364cdba", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.233.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ea5808d-cbe9-4ba4-abb5-8428ce395f3c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.235.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14382334-c9ff-4828-bde4-5b81fc9ff3d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.237.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--893cf551-1aad-44f1-896c-11ca167484ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.237.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbf8859f-d0fd-4769-b63c-3e098ec38a4c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.37.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67a6d6e7-2384-49fb-bb69-4a99fd7ee070", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.74.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8af81e8-9470-4e2b-adf2-7b4d7180883c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.93.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64a34a2f-66f6-4088-a3b8-ea45fb0ec3ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.212.242.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35704670-dcb7-4ea3-97ae-9a687400793d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.212.244.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e7d54e9-5ea9-42a0-b12f-c4330b9d28cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.221.176.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c7a5e30-f5ca-44a6-acee-9124361b0854", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.221.176.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e89e48a6-9c66-468a-9137-8e0168e42643", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.42.19.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e9ef3d3-29cb-4e02-8a5c-b77af22d4e15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.43.200.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e6729da-c518-4e72-9e4b-ce17b01adec2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.62.142.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a71fda4-85bb-4bb7-8b5e-1686e2ad92b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.81.30.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--629fe9cf-6838-4218-bde8-cfad8d9bddc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.154.192.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--084a21e2-84c3-489b-8ea1-5c06482c2ddd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.154.230.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b05f8edd-15ba-4b17-8038-3bfd61d417f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.154.239.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcf0979a-a734-4d0c-8d92-b0c6e6ca43a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.180.197.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b954b43-179d-420f-a210-3a59524fb851", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.244.251.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--947a1b57-c48c-4f51-9f9f-93915c08919c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.248.9.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b885087-bbe6-4669-b916-e70b589ffb33", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.46.13.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9ef8de4-3b13-493e-9809-11d8c3a2a9cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61bc5ab0-d927-4109-bae1-16c142b12e9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1df3a263-b385-4ec3-b2dd-4af39836e505", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6c7b12a-55bf-490a-97d3-e785b84911ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3b58e46-e17d-49b0-89be-b68548ff987d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4ff4f81-1a10-46dd-bf00-515c9b5d31fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2846e343-93f4-456a-ade2-351b7cf06689", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--836857f0-1c32-401c-8195-7a33cb5ae55a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.109.232.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be694e53-2f53-4711-b6b5-e53fa82f34f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.115.214.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--322fbafc-e7ed-49ec-924b-ba9c0052b2ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.87.242.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b40a3b55-9e03-4807-957f-fa750a84816b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.87.242.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c257a784-dbf9-4e80-92b3-0db7808c5e3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.87.242.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58b466fd-61b3-4cda-a9d4-cd01ea5bd031", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.87.243.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1252f724-bd7c-4656-990b-560f9324d969", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.87.243.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91554c0f-3003-4040-8d51-1473f217547a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.126.2.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dbb6e8b-f5b9-4112-8948-06ba88be1495", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.14.89.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d39a1ec-9e54-4a58-a720-d2909f99fa60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.141.33.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fce04b3e-0110-4e3e-9b6b-08f8ca866d6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.141.46.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8cab6b2-17ea-413f-a218-8ef1aa0a947e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.217.225.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6bb33a4-568f-41d3-b436-a2470fe3b2e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.222.101.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5fc2873-aa0f-4d31-a89c-097b36762eb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.237.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29ac1897-da99-4200-8265-b33b0aec5c4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.253.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ca979d1-4fce-4aca-a53d-0313d74cadc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.77.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59adad58-3d20-4390-8b97-4bb7951faf92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.83.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5460ac20-7821-44cd-b960-1d85d9d4d064", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.83.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b75edcdb-6cd4-4987-b8e8-d4502c624429", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.83.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2231cc7-f39b-451a-913c-7bcecd550359", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.74.79.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ddea052-a530-4dae-aa06-490e180c35e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.97.135.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fca4c6d0-6d11-4206-af4a-f49f58ae860b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.99.185.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--581d5be2-d391-4294-8819-028055fc3d89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.99.189.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd3d058e-2bff-48d5-a5fd-24716b3447bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.172.173.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac99c280-f339-4b76-80d5-3317f7c2ee46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.206.8.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c19d8b12-31a5-4c7c-81c0-80d9fa5a93c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.210.155.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c26bf769-5423-4857-bccf-a37dd64ea024", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.79.142.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a902eea-f0e4-400e-9855-473c31e00902", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.99.112.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--625b9d8e-80e1-49e1-8bab-bf49e3372c68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.180.105.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d699ac69-6346-46db-91ba-f0d48ec0078f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.221.196.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df4e9c1c-7c60-4900-8bff-af56f7aefb93", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.223.41.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85cb1932-20c9-49f7-8d27-1a6f4011c069", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.228.62.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--598915b1-fc1d-4e04-95dd-e99d9ab1284d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.251.245.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d569af63-15c0-42c5-981d-f30751f4fb14", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.253.37.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15ac81a3-1a2a-441f-abff-5d9fa8dbfccb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.40.167.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63190ff9-9003-4551-a4e6-aaf89cd66627", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.48.162.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0805841d-7edd-4399-a3db-a5d22b63642b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.95.159.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96c8f7e9-d49b-4d63-a951-abc3fe1f78b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.102.40.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4f51964-ea27-42a3-9793-d851758d721c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.132.127.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43a0f54e-75bd-4302-a6be-0bcf5ac431c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.192.240.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0de49f7-4bad-459a-8a8e-fcf2dfb55adb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.227.125.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4eb6de3-f065-4970-9a9d-c1534ef5734e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.227.145.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea1e7cd7-5de7-4df2-bcdd-2beebc484018", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.227.153.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aee8044d-79cc-4331-a5e7-169aea377b5e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.227.253.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14f2ce80-5d14-4799-ab05-45205f05cb7b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.237.122.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--199dcf3c-e828-4f99-adbb-b7c6e69bc948", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.33.235.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a2971ad-52de-48e2-b0af-177058246bea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.58.120.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5cbb506-aabb-40bc-8307-f0bd31f3118d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.58.184.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5df2e15-a85a-4c30-9fbd-db7682f7062e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.70.119.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c07acab-8e28-40fd-85c8-8fafea7a3e75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.8.251.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--366f7e55-a15e-46aa-8e2d-943fe4d1adca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.8.252.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87ec5e87-5971-4f44-9013-a9b5169c92b1", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.106.121.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e08ba9ef-ec54-447c-9480-3fab852c80cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.108.3.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--131e7220-a78f-427d-bd9f-6409adb92b91", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.135.155.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16fb6cc8-e482-443d-9cd7-385a61d1c0b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.152.185.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e3f712a-4510-44a5-8c32-25f6a1c70020", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c43ceec-b79b-4d08-a1de-2af07076b2c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3660686f-8bdf-4b81-a13c-3f8914e38a74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6e20c72-68dc-4f1f-ab29-c0cc354eee3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea314936-bcd1-4cb3-88a6-6e08b196ec04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--293fa372-f087-478c-b2d0-0fa31fb8cdee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbbf3c07-f4cf-4933-a9c7-2ef561cd1ac6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7170ada9-205c-42f4-b6e7-244aa0a52c27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a0d438b-103e-4564-a8df-28f0dfcfb9db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf52b35a-1e7c-41c6-a690-9237734e534e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5238e08-0f8c-44fd-893f-d2f65d7a8c32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69479640-95e7-4815-969f-e90e1e9cfd90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.174.21.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f858db8-512a-45ce-b9e2-1c0f3b416088", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.183.63.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5786c88c-b258-4b4c-8c39-23ef68ede381", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.199.59.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89915d88-5e66-4b66-a2c4-6573911572fb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b8f92f7-59be-4eda-b16e-76c025211c04", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7612550-e8fc-4157-b947-176b06765b73", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f9eee96-fd41-4d5a-97b3-6249739ae69e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.230.87.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e43629e-2277-4746-8dfa-aa3f1027772d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.230.92.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--593e715c-492c-413d-a888-63f3736ddf53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.126.236.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8113f97-08f8-42d3-b586-86a6cc4a8de6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.180.246.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b965b445-522b-4cc6-b09a-6f94d3fa46b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.180.246.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ed9a7da-bcb3-4387-b31e-756b7c2c6b11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.180.246.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bbc6462-9f10-4aac-9a63-ea09042316b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f5935e1-b37b-4c77-a12c-05cc565b7ee7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7faaf7d5-9b5c-4b48-964d-e0f49e8f5d97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--673de82e-e272-45c0-b0ee-4fd1bdcbfc59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cee60735-5e88-41f3-b340-e0fdf4022a4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41595fe4-bebb-4882-aadb-9164c4385898", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9331746f-041d-4025-93fd-c0633c132aad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a89ffb4-e03f-4167-ac82-eea2f2c6609c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--607eee20-f417-4d32-9f30-f339dc5e8194", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cfaa3ef-8a6b-4a0b-878a-d7cb45cba594", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42b86971-ed46-48cc-ba3b-b981d0ae308c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc824761-a466-43df-b1c3-dc03c6d6b0d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12216b9b-84c9-4a01-ba06-8c97bcd279dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79245bfe-d383-4e35-965d-e2948be65fc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3272cff1-3f55-42a5-8e27-a3eafc5410ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e013f832-7d8b-44d7-87bb-8d07a1a98ee7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cff29ad1-126d-4599-b136-d2ca74635cf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5704ac2-ed0e-4b94-bd7b-5a2926831fff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4108a9b2-87b4-4299-bd2a-f5e387023789", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd6538d0-cc8a-4ae6-8d5e-2bc923d2955f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ee586e0-cc33-4186-95da-692f1fb8c186", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef1aea4e-c7fc-41e5-8174-6f79decba3dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c70d5d97-56b5-4e08-964d-5b4983e0413a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ceef7eb3-c7ef-441b-b14c-0b9806da77eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d5512c7-e419-47d2-a584-a9b6cc2fc8ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcbeb7b3-2cd8-400d-8622-e1fb546ea51c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.226.76.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bf5ae1d-c59d-42c8-84e2-212e09bb210f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.226.76.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10321154-01fc-4fb6-a97f-b15e1c9b0e38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.226.76.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e562d9a6-f1b8-4243-a34f-d29796d1286b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.245.216.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b6a69b7-3a9c-4084-bd5e-dcb5261f3fb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--818df662-ffcb-4739-bc3c-efd85566b0d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6076e848-b5fd-456a-9c92-1aa260926d28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88cb34f2-e077-4376-91d9-444220f97038", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--265419a0-f617-4a73-8c6f-438b49c1b0e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5ff79ce-bf81-4e68-9c71-a9e500827e1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdc01f6a-a144-4ef8-bbe1-75cc827a2968", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac7595f9-30a8-4c2d-9cf1-059819e48f33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b70b785-01b5-43ef-9f73-d35762ad9ec9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--553623cd-55e2-4ee7-816a-6f681725463c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90f0a8aa-ce63-4b62-b894-3a51a9c2590b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf12a416-44df-4f20-8dee-01ba02d48974", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94eeea51-0916-4e63-9c73-495a900fb186", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9568d16c-64e5-447b-82ed-8a5d38c7400b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f158786-d9dc-4b0f-932e-c70280d7e2d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44bc2206-e3a4-43d5-9df2-8a1e0ca40177", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9a3b7ce-100d-4452-b541-890d0f7f4dac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29f4907d-9cae-4c1c-a05f-5d3fc1392034", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dd4d75f-3b03-4d11-8695-639e4cb0718d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--beb2be32-0337-4ec5-beb3-1d89fa46f362", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9befbd82-390d-4918-9434-18089007d742", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--100a56c6-1e9c-4cf6-ab49-e3196159f47a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a879348e-5d20-4a38-a1e7-3823a9667fff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8571388-a813-46ab-8b4e-d3b81615b6db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07b27f5e-2514-46b2-bd1b-57fb26c44a6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af4c119b-610c-40ab-9758-df1cb258703b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b30cfde0-7591-41a5-927c-d14f9caf92a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8154e3e8-a1da-4d14-9e0d-6b2453b93af8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0f6b73c-6d7a-4525-98fd-a6b7acce15ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a536371f-2cfd-48a8-8ad5-75e656c1d38f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96bba6b1-ecf9-4b21-b376-949b18684b03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a0852d6-71b7-458a-b40c-0f180ba66d2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02988116-a942-481d-beed-46edd0c85d4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5ef793d-eb71-494f-8e7c-cc7f6cc22b4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34685c10-8f2a-421b-aae4-2002f723f833", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29326a19-3d24-42f1-ab17-50208543782d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45e25e08-dd6f-4da4-bb56-2da01cf8947d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f57227fc-68f0-4afa-b061-26fed141236a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afe6fbe0-b495-4be2-a361-2dd2fd467649", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--403af9f5-fb28-433f-b400-df7b77a944d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71257c29-0158-403a-9a06-fd165f6e92af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1ccd469-758e-451c-8136-6d06c888bbca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e060b208-04e2-4dd1-9db6-127babfdc2ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38d50f13-56c4-4273-bd58-652672a18145", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e8a3155-580f-43d8-b1b2-8de7f3b88a07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90daa9c5-b818-4cce-b6f0-ccd98409e5f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aee145d0-e226-4c27-be22-d282f2bd1a81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82c0bfa3-8d72-43f2-81a6-d047025dec80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f7927ea-c93e-4d2a-85ae-4216133db9a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4eb680a0-a8a3-4ee6-a01e-81b8bc2d86d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04857a4d-d526-4eab-8e61-cf788f916392", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bd9df27-0936-4c9a-a359-f6086d2d6947", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdcda54e-5426-460b-b3f7-325490d01c1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a8046e6-d854-45ba-b9b3-3c0155d32e1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46ab0053-4189-4966-9ffd-a8d1b963eb1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a75994d2-25df-4b8a-90fa-c040190c2594", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--758b8b2b-30ef-49d7-86ce-42a4f49dd3e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3bdfbec-8366-4036-94ad-4c3c41824e67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84886230-c97b-4972-8ea1-62a45b1212ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae0a1e73-86d6-4f35-abff-561ed79163d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88625693-c1b5-4231-a41c-286099959aa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e364136e-efdd-4805-9888-f35f84954940", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b75ed59b-e3a0-4d34-a93f-3324e017efff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f59c5f31-5cf9-4446-a21a-7f297bef81d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--375308c5-c977-413a-a157-c7cd82e7b4e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e93bb9e0-b821-4a90-bd31-5c76ba105385", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eefbeca7-16bc-4576-8a59-997e93ae923d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00123454-3b1b-47f2-bcca-029d2c7b5645", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--699f921e-ce6f-489d-a80d-44191c0c4ed9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8901b957-0255-4b7f-b3ee-e6512b68eb58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a69866ff-03f1-4fcd-85c2-996de3f873ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2597a88-3807-4cb4-ba99-80ffa3407d62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78cb30fd-7a7f-4358-9f45-fa9cffc6c2e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7389aa2b-c084-48b9-8768-36700928da3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dc91123-f79e-48ca-979b-bdf7003395ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eba8970b-07e0-4ce0-ae36-1ec83e7e0cad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fb750c3-31ff-47b1-9bac-3f3a09c94576", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--941c00d3-9ef7-47e4-a89b-5d89e5552c2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b09320cb-8428-4747-b533-7d21bdd251b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b73f092-ddc9-4271-b48f-8de5d467fbcf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c89a11f1-7396-40ac-81d8-fd80c4402ddc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.252.238.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--194dfd22-69b1-4fdb-b462-2f093160e6b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.59.16.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--834ad36c-2cc5-4fd6-b206-40ab1865e32e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.216.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6375b05-dbb9-4593-a99d-876496975e4f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.216.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dbaf387-097f-4989-baed-69ebb5a0cf34", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.216.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c156c87-bfff-44a2-915c-0f8cb8983329", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.216.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--664e71ae-58d8-45a4-8516-a4473314e1ac", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.217.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efd80a44-8d1a-4afe-9499-db366fb9be4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4195840-87dd-4b1e-b483-1152f4d5ff82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efd61d3c-704d-4aa0-b9ee-3d46787fcf55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a0c332f-68c8-429f-ba99-3924691e07f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16cb8677-624b-4f28-9bd5-1748340cf44e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ad9abc5-fa54-483e-a16c-050fba68a4e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f978d304-be9b-4602-8fb8-c354a9e9a561", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6c1ac78-5aef-4e5c-9dd2-436cddeea68f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef3196b9-64b2-4766-bc12-6735eb9cef66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e0a98f6-88e4-4509-be09-0f48b6c5c384", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b88d75be-64c9-4818-8855-09f6b3c58493", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1b6e3c2-f773-4406-8442-1dab014fa972", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a5951dd-0970-442f-b50a-232ae6d370b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.154.145.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--349a3493-bbf2-443a-aa80-2a41569888a7", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.154.35.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63a2acd1-d918-407e-b0e0-6fd47ed40b8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.156.66.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e391c1ef-db82-48d5-be45-225418122b78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.216.49.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb2f0979-1e05-48a6-b4aa-9858dbc96f29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.30.196.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd79fceb-81e7-4c6a-bfae-4f944f816b59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.60.186.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33d7e491-5876-47ef-93fd-be0955e5d17e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.64.147.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed618554-2e6e-4c4f-bc36-97b040578e7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.66.22.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4643c9d-8273-41da-a015-1343149447c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.17.184.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--102beccd-56d4-4efd-a328-b4a8a4fcbcb9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.56.160.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78b037cd-ad27-439d-996a-af09db65806c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.78.104.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8a62823-c062-4318-a4f0-3f3a2bfbded3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '219.151.176.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85a49753-d233-4ffe-997f-49d93b7ca209", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '219.153.103.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a234cd3-0161-47e0-af7d-fcbb2f49d4e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '219.153.113.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ece70bf-1afd-4f06-955e-658427edbcf4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.121.206.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52a7697e-85b3-4078-b616-c802897208bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.135.110.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad9097a1-ea4b-44be-a345-b7ac6800ca7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.167.232.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4631020e-5a9a-458f-8050-a5e740711046", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea64232b-cd83-428b-9e38-c8bf1b7cfdd8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b32dc9e3-ac6e-46ee-9bcc-6f29d320d31c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d00a8ac-12c9-49e2-9f08-8a858c219014", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2314e2a2-b65c-44e9-bbd8-aabd71e83954", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e259d744-d769-4867-9a53-1eab94e1fffd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.197.78.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67daca06-fe37-4e40-9293-76c28274ac53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.197.78.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2558c395-4b4d-46c0-898c-d8a36375a0bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.250.10.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab920a9b-17fe-4f32-925c-53bf98e8ee85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.78.6.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ba10fd9-b19a-4023-93ed-1212bff25b55", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.80.223.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0776dbc5-7839-4ed2-b685-6c7e8ff94eaa", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.163.5.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05af2bd1-5ecd-45c9-88a1-0bdc0309a32f", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.164.139.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4448b9d6-80dd-4944-8cd1-1c55bef0a222", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.105.60.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ac02e36-776a-4875-8be7-f7681a8978e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.109.205.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d0de90b-eb42-46ff-b96d-42675206fc16", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.118.59.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46972c3b-0b66-4f04-9592-1448453e06b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.137.117.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a5eb85b-1644-4a8d-ac85-ec8b03e0feb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.186.13.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00392688-6d45-4cd3-b2eb-bd04d4d63f56", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.222.168.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d06ae2d-1115-4e0d-a16d-c9d4d53bf703", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.73.56.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc123c8a-3d67-465d-a0c3-21ca0e9ab339", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.89.169.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eb97387-44ea-4b3f-9a45-b246b5109c41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.94.32.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56d0c148-8abe-4fe5-a71b-274214c9d70e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.96.44.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2846e13f-7005-4f43-8ab1-44d416d1d405", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.123.124.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdec616a-1193-4581-8828-15745767379e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.123.124.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b36858b-31e9-412b-856f-96ec1ac3a9bb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.197.248.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c684d5e8-bfb3-446e-862a-55c6cfaab64f", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.24.161.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28f12005-3346-468c-aa8b-0091f44891f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.240.94.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4e0847c-1f69-41cc-9f1c-c06b4656e0d6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.247.218.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6ff6613-5fdf-4360-97f6-79bbfd02edc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.4.131.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9fb8ad1-3323-4c46-8369-2dbc8b3cec7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.4.212.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e8a62c3-af58-4cad-8fca-e375ab71211e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.68.7.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--463be211-8f83-401a-9b23-a7e8ba66fa74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.74.189.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee784d79-8045-426e-bbdf-fdf953868bd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.131.184.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dff3c328-81af-4d7e-ac60-65766cd0898e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.180.120.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ef2d9e9-23ad-48bf-ac17-068bdf18d1fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.234.111.163']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93d05ae4-5cc1-4cb7-ab72-a2e220444f02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.237.108.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d09a9a0b-180a-4d14-b0ab-6891077cf1bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.237.192.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b564bbf-d651-4385-9f4e-cb75a3531e7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.239.29.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45e30fb8-ed81-45b5-b697-2ab9bebe1ed2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.239.4.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c102c6d-ae8c-4b85-a0c6-b74f5f10f063", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.239.96.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4b79361-bf8e-475f-a355-15e0e418361d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.254.226.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77cae88e-4818-4dca-8e6e-0ac9c39d99e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.92.27.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc22f2df-6208-4761-838b-7cb8414a5c6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.92.27.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64d02ee4-66bd-4ca8-989f-d4d582e19556", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.93.227.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3541d613-8bdd-4553-a958-bd896274a555", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.94.14.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e448f27-5266-49f8-a6f1-e9c564f12979", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.94.155.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43dd813d-253c-4c24-899a-4a2e50935d1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.94.200.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01639248-6778-46a7-8551-9f251571b04f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.94.23.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e158678a-b2e7-4be6-97eb-3cf3082e5802", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.95.20.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9483b61f-37a3-461a-beee-cd6d2580c2ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.95.67.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ef5c200-d24b-4eb3-aa1f-2d16b154ba0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.97.62.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08d66171-3fe9-49f6-9050-7b02d2020788", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.102.107.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87ed4db1-b096-41dd-ab1b-19aaa2bb2e39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.133.14.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--faca9ab6-6f64-408c-9043-18498dcfa08b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.139.32.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c728dae-a885-457d-a683-4e5cb98aa838", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.144.120.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbcd4678-1b43-4086-820e-fd101f69b9c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.144.84.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--247478cc-5426-4106-a7ac-9896fff27288", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.164.85.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7b5f20e-2842-4d7c-a90f-65fa15e9d356", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.178.165.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09f4653f-008f-49da-b058-b8135d1dda1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.199.97.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--518d47f7-cd24-4030-a9ff-294fc2ac3692", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.199.98.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e8c25a3-b952-478d-8d90-50a294747330", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.251.221.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--171c9c97-02d6-4883-a01e-09f6a9a21b85", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.21.24.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0986a2e9-fc2f-44bc-9d53-d63707bcca88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.218.148.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e9aefbe-5a48-4f2d-a857-b53b664fbff8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.47.24.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3dfe421-4e0f-4ecb-85ea-efb059451678", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.47.27.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--854551e6-f55a-434a-b40b-7bbc68a52dd7", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.79.4.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ebbc850-242c-4dc0-9cab-c2583af99305", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.79.40.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aebf2b94-61c7-4773-ac78-790a92bf53bf", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.79.6.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55b72e05-3591-4707-9c9f-c8e335940db1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.79.6.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20d8606a-679f-4bfa-8e91-bdd1d27e2817", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.130.168.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27fdc402-8c0d-4515-9561-1048fb006d66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.131.220.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96551dd5-992f-4f6f-8612-fb7729d3b148", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.131.24.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00897efb-17fc-4dd7-98c1-9a0acc3f090b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.132.26.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--247436ca-9a0d-42db-b388-64b97bc25c84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.133.88.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--000f1579-852d-47df-9ff0-f2595658fb8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.134.216.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--620cdd45-708a-4f32-99df-be0783b2851d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.137.154.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd2abad6-8904-4d28-9827-83c26f1e61e8", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.139.242.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29978461-4d2a-4e85-b665-996c64c14df8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.142.170.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbfc0ec7-6bf9-4450-94b1-0f0de44d0777", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.143.162.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4dec4b1-098e-4365-910e-6951adb20556", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.151.241.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1480cd0-e27c-45cc-a0e0-08cb25ce1449", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.219.215.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b57f88b-8b1f-410d-a3fa-88f433f6838b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.227.192.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37e9a581-4ea5-43ed-8fc6-8c7042abc4e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.74.234.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6a95eeb-ecda-4f61-9e1c-33d5225a3265", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.80.189.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a81f8af6-5b15-46ed-9868-84b2d32b9467", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.80.204.163']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7017a2b7-3e92-429e-8a98-2f30775747a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.81.224.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de60b77b-0b5f-4ab6-81b0-161a7a415599", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.82.191.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b699cb2-f469-44ac-a8ae-3e2a68577a33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.83.106.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--beb60ce1-2dfd-4601-a5ca-e7d793c8ce0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.83.245.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--610485eb-0ef9-4b8d-a93e-9d4db9b5226c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.83.33.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02295e72-eaa0-41d3-9065-ed1480b0e456", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.83.53.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a379e43f-22c1-4225-afa5-ce8e47fbcc3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.84.4.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df26d445-6d9b-4bbd-862d-de7fab979d25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.88.3.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa7c033a-6aa0-4d8c-ac1b-d3629bb64a14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.89.103.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7368c61-306c-4921-8888-92682f7925e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.91.20.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34b4f486-e168-4544-8f5f-93f09aefcfb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.92.182.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa808ecd-fafa-4a73-aa97-9ac35b4a0d5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.92.198.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--136491be-d714-4754-b297-b3cbf1100639", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.92.239.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99f6fca4-5613-4729-b2c7-b746c8c17908", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.92.61.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36fd5ce5-7418-42f3-8a54-6e0435ce3ff4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.94.201.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32869f93-30e7-4d77-9783-73495be7ca08", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.134.93.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d1e7c5b-3716-41b9-9b35-64832588a2b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d11fd02-43bb-454a-95f5-cd7881d0fdbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--343ef2e8-1a14-4030-86d2-e6f673d3dbc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b778cbd-978a-4f6b-ab09-b561b20fbf8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efe68672-6c8a-4ecb-8e5f-b8cdd3d2c438", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0545d6ac-d866-4484-9acd-e8729030007d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64ed0439-fb3f-4626-9340-5800d061dd6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1799b320-0998-4ab9-a993-0b1936364115", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93485f38-e28c-452c-99cd-dbcfd18b77df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fd3f534-6707-41cb-b800-e7f03a06a497", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61726493-4d15-467e-a868-95e358c73674", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6171799a-f8d5-47bb-a3ee-10578dc51706", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34268c34-2f9d-4b57-979d-9d5c9078d929", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--863b3fab-70e9-40be-9822-a57f3a8c7b74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7384c067-76c4-4c04-9844-36549e3fd99d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f146f9e-9d8c-4302-a1c0-1468c31ca402", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.148.99.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81cb73c9-38e6-41e9-abfb-6aab5d8d4a90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.151.157.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cd67df4-0fec-4b71-bc05-dc237da290f8", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.220.0.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b8cb68a-2ac0-451a-95a4-b213cb1eaf6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.40.19.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3120e5e-c753-44a3-9fba-221d2ff2d9f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.42.176.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b974474e-1ab0-4d92-92b7-644559e19d33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.42.184.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da2a1d2b-34f1-4c44-a52c-7dc03b25d59e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.42.188.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db352eaf-44b7-4eea-a98c-aa1cd79a701f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.43.49.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e965db6e-206a-4d5c-bc16-f7a83c017d23", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.56.196.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff7e003b-28e3-48cc-b23f-0470d77aa9c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.56.209.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d2d05e3-32f9-4a56-9de4-9d352354ce18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.57.184.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56405129-73f4-4114-8064-2c77b6f2b71f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.57.184.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26618470-e197-409b-a68f-a4b6d4d0bbac", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.57.216.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ab24ace-2034-403c-a450-8cb776fdc7e4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.57.216.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90dd7b05-f5fe-42bd-9fd4-fcc32ff23595", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.57.216.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d26e3a40-04bb-4ddc-8936-0d920a93ab22", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.57.216.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7eddcb15-665b-44d0-94a4-9348823f4dde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.58.144.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9384871a-bfad-4746-b79f-2fdbb6d4383a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.59.118.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48926649-a131-486d-b774-1ddc4f5c3177", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.70.91.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4387f899-8bab-4294-9948-6ebcbdc904e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '32.192.75.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9295d5c-859d-4861-923c-2c3b43c74f29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.101.140.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--153dd6e3-9563-4913-b545-fcc66cb87213", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.101.239.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4884e03-a965-42b0-a1c7-c1e4b13b96b0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.106.79.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89e368e3-0625-4bca-b77e-f7ec3e126e80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.106.80.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33caf150-ed6f-436f-a1ac-0e38c5ad78d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.118.62.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64d68435-94b1-40f7-9885-5c539481aab0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.12.140.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84491b1a-83ce-401b-95b8-cf12d8291afb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.129.166.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d4b98c9-f63b-4c7f-b378-4a773d391791", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.13.198.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad3c9f3d-138b-46a8-9fd5-042123d04500", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.130.12.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efc8a8cc-d787-4728-8c78-6db55dfc6d48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.130.219.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d6ccbaf-d4de-4954-9fdd-0184874862a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.14.111.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a398bada-dc68-4a1d-8c14-f4f229809b34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.14.112.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2b1d218-39ef-41c5-b48f-6475c023daf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.175.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41278d85-348b-4f9b-aa88-f8330b068916", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.178.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4934087b-fc1f-4799-a3b3-bb8a4fcf71b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.238.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66752c16-4208-4606-bc19-40f9f753761c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.65.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a82d7a01-53c1-4747-a107-82b10f07002d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.141.97.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8085bdd0-365a-4ddc-a0f7-c82cd242d496", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.142.58.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a493a23-0db6-4a92-bf82-4c716782edf8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.143.217.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--979c6800-e426-45e2-8dff-cbad798d00dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.146.111.163']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acd85935-6f6f-46af-978e-9ba4a0f2d55a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.151.127.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99bdb915-3840-4dec-aa15-4fc0c1477866", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.151.150.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5453698c-8a3b-49bf-a108-8fb017bebe59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.158.25.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39061e38-f0f5-4bc1-9787-f93cf5f65c33", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.162.162.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91d7f500-19ca-4057-8dd5-59619defa59e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.170.188.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1125ac52-db00-4ebc-9d06-de044cf1d3df", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.174.199.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48bc039b-e817-45ea-9881-f09654b3ac91", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.175.94.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30fd4535-cd85-45ee-a03a-178b68fe14e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.19.166.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61f5963c-d185-40ca-9dba-23b8eb69e942", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.197.70.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65add945-9d54-4372-8e40-8d9ab0d46543", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.212.124.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26a52279-fae2-42b4-8b12-b6ebc60c29ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.22.158.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60c31ce8-d955-429d-8577-dfe4cbd7412a", "name": "Malicious Host", "description": "Observed: FTP, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.22.165.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ftp", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--563da8ea-d892-44da-b6cd-dad2ba56bb35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.22.172.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98b5fb2b-817e-426d-b171-8604ef33407a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.22.205.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2ae0c09-e5b5-47f2-97ee-4c9f67650710", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.226.190.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81ac3f67-1b47-4ef2-b86a-559c4e334940", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.228.104.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6ca267a-0e3a-4755-81f5-955f1e3fb884", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.228.9.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c7598c9-bb7f-451c-a000-78ba3550a505", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.34.151.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d1e80e5-7a87-46e7-8516-9fad171371f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.34.178.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be76b750-c40e-4ccc-9df2-0acb14233965", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.38.175.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--caf1b5ab-9147-4e72-a534-cb61b17f549b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.38.184.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--783f1a28-a028-48de-8e00-27c55e1eff7f", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.38.201.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f76c722e-e51d-4d10-bc09-911033fcab2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.38.247.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d926516-d6fa-4544-8729-92db2f43e55a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.39.179.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10aada7a-9e75-457e-864b-d2eef88955da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.161.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f63a733a-14a5-4546-aed8-89147746d86e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.174.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67b42611-e6eb-4b5d-a9b9-7feb7cdcccff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.178.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ddd0f25-39dc-4e99-a710-0dc80713dcaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.179.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de34f907-661e-44d1-a37d-75d3a80c8eb3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.53.178.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6942ec4-611d-47e0-b973-bdd134b4c3ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.53.201.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8b8ee48-4a5a-47d2-b987-d7a5d5fc2c5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.53.218.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d95027e-34e8-4fb1-b3b1-16f1960b00be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.53.242.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--901ae743-8113-4dc5-80b4-fb7a4716d81f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.102.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd77bf25-6195-4647-b198-33850d451cb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.130.1']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e62001b7-3345-4368-a212-67882176e99c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.138.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e1f79bd-4c6a-4344-bc56-28eebeab7378", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.144.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--486dc322-b107-49e0-aab2-2b8eb487776e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.150.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da5d2ce5-a1bc-45d4-8b44-d4c3d15565a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.208.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5a9e65e-b012-4e5a-a09b-567a08ea0b80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.225.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7df0722a-46da-45f9-aea4-65e17261c742", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.61.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe71592d-a386-4142-89c9-f9b2a8851e12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.67.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2405dba6-ecd2-431d-933d-3e58e39c2ea2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.64.109.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--320a2d4f-fd73-43a5-80f0-c196af59c019", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.65.239.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be891f98-442a-4e4b-9c1f-284d0820bc12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.68.139.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--969b9405-39ed-4d8b-a869-ed59d0f5ba23", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.76.165.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b5e4256-61a4-4bb2-819a-842d1670e4be", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.76.17.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23d2ad22-a425-4499-8a3c-839e88c04249", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.76.41.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23764e34-7b56-4d3c-a457-ff0c7842d0c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.77.139.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--214bee49-39b8-4bf8-8ac0-1125a69294cf", "name": "Malicious Host", "description": "Observed: FTP, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.77.191.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ftp", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8472814-f60b-481b-8d98-992c62df5115", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.77.195.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e20fcc95-44a9-42b8-8c4a-9f2dd4f335b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.77.235.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3c1c8ac-9326-45a4-870b-bb275b6c3426", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.10.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bedf941e-b1c4-4cec-a7b6-f7d4807185a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.173.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a5fb71d-82c7-4b52-a00a-bb42d31f5977", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.218.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fde46749-4afb-4efb-9372-01ebe1940796", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.226.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b479b6e-a405-4e22-9707-4f16e571de02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.23.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86ca217c-fb3b-48d0-8859-8b96d76f61da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.242.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7a9f3aa-a5c2-4216-9704-b60310a72ed7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.243.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da9d159a-8660-4793-820d-e039054a313d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.45.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb4431cd-e805-4ca7-abac-28c0acb41b9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.79.100.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e4f7270-8f2e-4aa5-b4cd-af594702bbf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.79.242.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e43373b3-c24b-4915-bffb-20597c97202b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.97.195.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9239eab-d2b4-44d1-b8a8-fbb62a8da2e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.169.206.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d871ca06-8e32-40f6-913a-3af4814a6393", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.171.19.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a75f13ac-62ca-4cc7-8240-9eab3f547b6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.185.91.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f5b0d66-95c8-40bd-8717-2c628849f800", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.187.108.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--434e710e-938a-4e6d-b7a8-943d83d50718", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.187.172.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfb30dc6-2736-4cc6-b0bb-df3ae3c9ff5e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.188.112.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b43ddfc-2e0d-4da6-978a-8ae106f79113", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.189.197.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4088da08-2ecb-43aa-a3ba-60f2c3664f59", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.189.214.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ff6ba25-0a25-4791-b0c4-7001d18e938b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.195.144.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e389cbb7-2951-403a-b7fc-7db75b86bea4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.195.23.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65f618b7-e710-4be6-a487-067a257da543", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.195.231.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b22eaf5b-5e3d-4bc4-b871-ef1e6f2d8763", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.195.60.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b4ea3f6-ec51-46be-9d7b-968265c9e31a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.202.31.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39d129cf-51ba-4ad4-8227-3e4e4eca4f4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.202.9.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0696088-bf11-43e8-b6cf-b69c6e60fb5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--719f3727-ea34-4cd4-bd61-a22540882a06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea45979e-103f-42c9-a04a-4579b2f6c62d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbe5a72b-b2ed-4a20-8060-f1da6b9bf572", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39fdc319-a472-45b6-859c-af24f3490b0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--211fa6d2-8bb0-4237-b9bf-6844bd93ed5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--430ca9eb-bcd9-4bda-aad4-624da5f6d6a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27857ec4-f3b8-49d5-8926-0b4aa48b1ee4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53bbe818-1595-46a5-bff7-5589af1cc63b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b5951f2-bb15-49eb-b75b-f25ca1c2c00d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcae7e2e-6e1d-4ba0-8958-76517a03bce9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77ad31d1-0dd8-475d-88a5-a2bb03d81eca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f0fd4a8-380b-4f7c-9b4e-6915d3b62135", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a81591d-f3bd-4953-a90e-1babeddd8f75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84dffcde-c16a-469c-b8b2-683da2fa4962", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--275d5fac-db2a-43a6-99e1-0e0805a12c51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e968dbb5-5367-4133-be2e-38ee02fea70b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6d5073d-9457-402e-a6af-6ad1fae7586b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22998ba7-f4e8-409d-947b-e86ec57aaca6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa4878cc-4b55-4e7a-bef0-69a541e55142", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4274d7b-9a3f-44ef-9163-04a2abb503d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53a28c29-6f44-4d2c-a1ee-f1a4d45a7891", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc1a2177-02ae-4c74-b486-f7b83c842a57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23fbd2d4-3944-4e39-a52b-7dc0be8fa2c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--874bf4b0-05ed-470a-81af-2f0b28ed38d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5028b0e5-5af2-4ff2-bb87-a58349b8cbb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8513c2f5-47eb-4a81-92a6-0ad5a5a30898", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ca90669-9109-4de1-8b8b-0a90d438102c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf7e13ae-3608-4ceb-9c3c-c5c54c0bbedd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--946f16b0-9ba5-4430-819a-0dda8a1eb271", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f69b6451-6796-45b2-b517-cb40b0582065", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5055f519-3a1d-42fc-bdc9-1e6dbda9a4cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bacf999a-e039-4f04-9f26-80fa475c17e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e1800e2-d12a-42a4-a203-d0e54c6f8373", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0a084b8-3097-45d5-b7b8-13b230261263", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2634918-a2bf-4e70-8ce7-5162fe0b646d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5beb1088-bcd0-49aa-968d-997760f08b9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6c5a5ab-e1b5-4dfd-94a6-252ba0157336", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09f8db26-1fc6-4fcb-9ec8-4fb4c465ca43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d1bd5c6-e613-43ff-8455-ac497e4b6579", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6c8abd5-2bf2-40cc-a6ed-2e0788df4551", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20ed9ec6-d765-448c-b6e1-339f8657b6dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0ba9f47-771a-47c9-96ef-846fde55741f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7777c64-99c2-48b3-af21-3d0c3d57c41e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2592a093-6e34-4daa-8f68-83bde43c02e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.163']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f83c580-c23e-474f-be2c-56cf4f59a1d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5afb3be2-ed5a-4560-8de0-573b11cee149", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8ad44dc-940b-4be5-8bb1-43e8f147d6a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--863153bd-36ea-4b15-9882-21aeb9440df9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbccaf0a-d97f-4cf9-9046-5a26cfe945eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85999562-0050-4ae8-ae9f-ea652d780574", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63b2b112-8d76-404c-8ebf-e75d83770c62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e47b3048-3bb2-4cf2-9137-e4a9b42b6c85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a163790-f34e-443c-b5f8-d705d2e87bab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c58130e8-4dc2-4e12-bfea-0a86795a4b09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02e80861-cbd8-4d91-9083-bb6f00165565", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27317ca5-fb9d-4ac7-8f25-526472f48622", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--702eb558-542f-4784-949f-464dc409721d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1e74221-2959-49f7-867a-18c7ff894c7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f386073b-65a1-4b07-9805-3fc9e50f1ce9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7bde680-2a05-44b7-96e3-7a100eca159d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36db638c-438f-4183-87bc-967346413784", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ba81413-d53f-4613-b37a-b58bb0e02b60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51dac38c-09af-4c70-b67b-81bda1ec68cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33e9de8f-e489-4252-b126-7910d4304310", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b9dea29-808a-49de-8e38-ce9b154e926d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69ff5a60-d291-4184-a780-19e8efff40b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c692d34d-b35d-4ef4-a0e4-173f153eca4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e6b3d7e-3196-4890-ab89-88cc95782676", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fbbb477-a6ad-4716-8326-7adc22e1985e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f70767c4-b6d3-4199-b010-8643baf4086d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9089706-5b44-4252-8d5a-d7cccd043963", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--073a2edb-171e-46f2-a585-3fab5f5ac6fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30dfec1c-e89d-42b6-8ec4-85ab5661b3da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c4f5461-bde0-47a8-8c97-5837cd175f50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36ad797d-116f-47b7-b889-7d3e66e48d16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4ea29b0-dae4-4c73-816c-052ff4c2f963", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8075fc23-3d56-4e55-84a7-5c4ed0974052", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--090ce52d-02cf-41bf-85e8-83ce087c4b6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bcaa115-61f8-4827-9925-e23be3f112c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--318f2fcb-1e4f-409e-8644-9b43f4b3a7e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c331f7a3-7125-489e-a0ae-a17fc628db05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ad3b648-3d20-46e1-9035-297c3b7fcb05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12c1582d-61f9-4db2-a8c4-e7df59aa77c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df22e13c-96cb-4af0-bd8f-1bafa3c53d73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0de1295d-8199-4f61-92c3-f41dd4a9c964", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7213d71b-b744-4879-9e33-90caaa17926c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--662e8d15-6e0c-4f08-9c93-208a527a5647", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9717a8ba-21e9-4345-8c9b-f883a528384f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e68d3b02-01ac-48d9-a09e-ffc97fd8c582", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa54fdda-969c-45b9-8ae8-3b6fc36fded7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb4f0fb1-2fde-4a6a-9686-59a556388a29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90487f0c-29c8-4b8d-ab2c-56a64fe6eda3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cb3f324-1b28-4189-bc37-eb17306ca4cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94df2c6e-b95b-4c3e-ba51-9bfc982ea1f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1965aaf-3e11-4b75-a5e1-713e80dae125", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--402b835a-74e1-4d6a-8ca9-1454e19d0285", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a067191b-91b8-4883-91bf-a7d41bac7dd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c24b3dc-419a-4c6e-9b51-4f0e7e8ea65c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36c7c9d3-6b3e-4323-94be-e314213c1cdf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e1fba43-2ef3-4a89-9f1a-e3bd550b87ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5139e78a-edec-4132-b5d2-2eba74bc019a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36408565-450c-4932-9ca8-dda765624b61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdf83737-0a31-4f4a-a367-89b1f04d849e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01c69094-00c4-4b37-8874-6be97f2e93b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b21a8e5e-0087-4255-9997-ad5824d930c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b705cda8-dae0-4e86-b02a-1082ac29bfd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e9981b2-ae69-4800-88b3-b9521cca050a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f49ed40-ddec-48de-8e94-e987c35062ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efefd721-8d05-454a-989e-6ee387d95824", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a558194-9486-4adf-8cfb-448ea98827ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fe0222c-f3d0-4d76-921e-3619cfca7ca8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b95c636-8ecf-468f-bcca-c02a675ba899", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--362ad921-bd81-465b-bb33-5bea1d5d8ddd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--459c1a18-e1e7-4ed0-8da5-1554302493c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a5efd61-7155-479a-bc2c-76b59cd1950a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25c43b13-d24f-4b65-abc8-a31d664269de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65e03eda-8f0c-4a20-99bd-489878943281", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2e04dbc-402b-4c92-9eac-3ddeab6fcc96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd4d8bba-f4a9-4117-8b55-e88e2af4d868", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d415738-b411-4112-8edc-4283a845219c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--063a0e2a-3d6f-4809-b9a9-7e1f91958b0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5f37779-5a6b-48fd-bea4-7c37c46b8a37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--247a1b87-dce5-4252-ac08-817ff7c01ce0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a140b520-5fb1-418d-9f3d-1501bffd5bb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fd93337-43bf-4bad-93f5-24cf370b0616", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f5eeec4-d1b5-4f2a-b396-844de1208e4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19d67f4f-40e5-436e-9a33-6ad8e72aa020", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b02bce6-f953-44db-9e6f-c9f85049a06b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87f572f8-a04d-43f4-b1d3-4ed24c8956a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f81ca757-9682-4a1d-8792-fabd8f418ca5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22c7fb41-85a0-4ac4-8fac-30504e2c1663", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--812ef713-9366-425b-9042-18f28676ceb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e727512a-ab2e-4db3-8d12-8482a2626222", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78f4f1ba-0652-4de6-8295-8963a22f9759", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e83ce6e-9a00-4d4b-80ba-728e13e4e6c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a24a99da-42a1-4c1a-ad30-9a0ef677e61f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f17b8be-5cf2-4504-bb83-fc118061a9e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6495387-9929-4f29-9d8c-f923ad811303", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1f00e97-dcb1-4445-b3b2-42c7a5ec8887", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25108ee4-4f2c-44c7-ae88-c0aa627d69b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74a555ce-9160-4e57-94df-20b7b3a1387a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d3235b0-7edd-4fbf-bb49-098eecd9bf08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2231444a-c2f3-48d4-a89f-60fbac7ab00a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c10f42e2-3fb6-4869-bea3-76d60cff0b5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6de55a45-9b08-429d-adcb-7e3a3bf14292", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92800808-e0f3-44c3-97ce-dc72030d3604", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dfb6c6c-a979-4667-8a6e-15efbd09c4d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7c0e6b8-7e45-4dfe-968b-a5e9442c3f57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9bdc9e1-fd02-4d40-92ea-bd284b1662a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84288bf2-500c-4198-9de7-2493b790a1a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75c60867-4d90-402a-8164-78c7cb42c197", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4761ca17-df44-4258-a00e-70967e6fd04e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2459b1ee-5628-4d44-b446-ce1f8827cf68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c0a4d86-2bd8-4860-bf08-cf525c648478", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f562fcb-1a24-4ee0-b3a1-36ef3d8eed8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--722f2a7e-742d-4c8f-bbea-498c69f9e6ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2470d9c2-521c-4e63-9877-8e3b67220fa4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3438c511-b773-4927-9464-66060f60e2f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--233d356a-3d58-41d2-8403-e949c786dd69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75c7fb0f-44e3-4932-b158-43a7e5bddebd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9db248d-57cf-48b3-a700-395afce1881d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a139f9d-bff4-4ab7-843b-78731bfae381", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c75954f-e0d9-4bb5-add9-f21667461f48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7f9604b-7f52-4f56-9aab-9be6fd22e8d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--673f58e8-5e80-441a-8f5f-8120e5129224", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0d2aa5e-0e4a-44e8-a1b4-c9daeada404f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5853cb22-fb0d-4f8f-9626-9bdb76aef030", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f51ad70-0af0-4a38-9772-912f7fa92d2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc46e138-ca60-40f8-8218-e516280e03e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79acb6c3-24e2-4e40-8fcf-99abe2bdfc05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--511ade9d-054e-43ac-9e05-be39a1e2f760", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04495f30-bdde-40c2-90e1-42949f7cd981", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08004caf-ebbe-4310-8980-30a770f528fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9b622ff-3ac7-4664-99f3-694cc4147e17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e1f146d-ed58-410f-8529-7148994135f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e75b6a1b-779d-4ecf-8777-eccc49ce1b26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a801926b-26e6-4aed-944e-1c98fbf9dcb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24b23d6b-0858-4d05-a7ba-51b07e8e2675", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9ceaf46-e632-4c4d-bd88-62ce73d791d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97f9e82e-0b23-4e9b-8330-ee64c588309e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e02cf42-4828-4120-a344-be6829f54847", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26615823-d7f7-4225-a81f-e80dded9d836", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52128586-a2ca-46e1-882d-3c9d121d0ce3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aae904ae-bad8-4d88-bd24-477c9d8486c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eedb7457-ab7d-4042-8259-c5c65974c9fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bab0a6b-f87f-4ef5-ba70-2d866da3191f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--074ab64b-40e8-47cb-992c-5d0a55341e8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d3c4e9a-2884-4b8a-b14c-775fe157166b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--097d6c69-2e97-428b-8622-6d5d68ec2070", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c1772b7-e60f-4fbd-b115-d9601299cd24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d12efb3-6087-44ca-8bd5-8c1c5b85ebac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27ace7ad-fa14-4882-8572-8ef891359fba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6430ec2c-4e85-414b-a64a-18fa6c540ebb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eae7d747-b73c-48eb-8273-a3972d2c5a3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef5619b7-cbce-4bff-a03a-e36522a17291", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fa13bf2-212f-4c9d-94b9-19bdba9627be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--192b19b0-16e3-48e1-be00-62a68133d011", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a5bd9ed-5c32-4367-9373-4d2a85ec7079", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af9188a1-8b5f-4686-b710-6aef3cf156ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa731a5c-5229-4fe4-bf50-9eb66d22e533", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69d2cf01-9a81-470c-a878-2ff877c524ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11f745c5-422a-4e0b-b19f-d62e760807e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--074d130e-d98e-4ce2-9ad4-09b0eddde800", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56a7ed79-5fca-41cd-9865-8f616f56c572", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cff72e2-f47d-4df6-9d44-324426165cbb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58f56a91-9431-4824-b8a5-7ef6200e6b9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca11b07a-8878-4e47-af7d-466900dbd34d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--897559b3-2819-45c3-8bd0-ae34fbf6a016", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--443ecb56-1787-4878-bddf-72505202c6bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc71e386-e471-4898-88ce-1ded732e6ff8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5b13295-3be1-49da-a1ff-f50001f66feb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6de07ba4-1fb1-44d8-9304-130d4d44c460", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a894050-a82f-4c76-a6f3-532bde9dcdb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.163']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9476f8a-39d2-4fc6-8ec2-1a2a0c884130", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cff45094-896b-471e-b24c-d77321ce3ccb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91ad3f29-92f3-4f9a-91e6-a0ae40894a69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a15cc94-de5c-464a-8020-cc85f3d435a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca418ce7-b677-4b00-a69c-576bed01493c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c34b7d3-593d-4973-b9c4-06f50ba7ed0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45bb8960-75fa-4aa4-a778-7e78181daf86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f1f24a5-9e8a-416a-9f3d-6af4db4c447c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e57dfd69-b65d-4576-ac34-db35f5c8ea61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6fb0ff8-76c2-4c82-8053-b58005f34dc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--059ffc7f-e091-4043-888c-9aa4080d96fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b0c96ed-de68-49c6-bae7-84c1d5310fb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94b20c17-cbeb-4140-a802-299cfdb46a1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc51a3f1-a450-48bb-a218-4b260e3f0f9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92f4e21d-cf5c-44cb-b783-c26bb6813045", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab54cbb9-7641-4c97-869f-1e42b2ba78fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b10f06db-6e85-49ae-a736-20f000c98329", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52db0919-2181-4c75-a4f3-e6fa66bfb94a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebff51d6-21b8-4ee1-a766-0c485c98fcab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cff840af-81b4-4d5c-a93c-2997baa8e26d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28d106d0-dd8a-4439-81e3-cf2bf920bd29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6baefe1-48dd-4486-bb02-76f5db4b1b8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd1759e5-1e82-4ee5-aee4-ac4dc3c73690", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea3b922a-0f6e-4e34-877a-b6fb814a4043", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d38a284-14af-4474-9ab6-6d0bde982d07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d63e6e20-8bfc-4a2f-b30d-99eb21990669", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0a34e3c-dc33-4208-b01a-b2a9248f7523", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3ad3d8e-f1bd-4548-848a-fc1cbd8e8c82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf283f61-3e25-4a18-9961-9b594be8f4ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23e55c91-7c2e-475c-9a4c-799bf0c88638", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75a4ffad-af13-4e6d-9852-b74ab1b08264", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87a063af-f6a2-4cdc-97a1-c05279c2e576", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a4556b6-1cf1-4cc2-80df-774cb1329c16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8519088-8efe-492b-9cc7-485c199e840f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1ab3fb5-8fc4-4c53-85f5-ee09a1a75a51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69730f9c-af70-4f32-901f-3e9f8bdceaad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3047cd5b-39de-40f9-bade-2e7c75a1f0b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c6e575d-e36f-483a-9de3-45c3d2992c7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc956092-df68-4108-9254-9130f1181ebc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7985b11-50a7-4470-b6b9-6189d77cd8a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0abe7711-5582-4210-8b02-4422dfc67bd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3606be6-9f51-42b1-b2f8-455f6aa4d25e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa870238-4fc3-40c0-86d1-ac0c3f427e38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc419c74-40c1-47cc-925c-04bc4c9fcca8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb2298c3-3986-4316-a0af-66c8c310b1d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3eeae70-9dd4-4303-a3f2-d5cf928b8856", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ff0ec24-c2ac-452c-b02b-084fe22cf195", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--224904d3-590b-43d0-909a-4dd0cfda5988", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74ec45a4-eccb-4208-968e-08075a9e3922", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3a59fb2-1239-4e76-a7cb-1dc8c958b649", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8285ffe-d566-4d06-86a7-ca6a6361befa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c8526f4-b1b2-479d-ba96-b2953c06e874", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03650b49-7243-4da9-9766-0dbd381b00c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51eca55f-faa8-4d60-ac78-911a5e5153cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e846ebe-1882-43e6-8cc7-af675ea7771f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a4ab2bd-cf3c-4184-84db-d61870ebdd1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adc67551-90d0-4b14-83d6-dc81e3ed23b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41bcd8f3-0988-4fac-9991-093a15acbc14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d097f9d5-e25b-4294-a2fa-67ea07b84ee3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91256338-7ddb-4582-93b6-12f1e7f2c46f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f40e9fce-68a6-4077-b510-a5ab71a9a658", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd37c497-32e6-4c2e-94d0-a21df490d614", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3ac80d7-8399-4397-be47-182032ee96bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c02df9e-f51d-417b-824c-85a4d377b9dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf42ee93-280d-492e-8b98-899a2477a4c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab86f43f-b1c1-4070-8344-552b86c1adea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d298632-f821-4e71-ab1f-4ce3099b3ae9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38ae64cc-386d-40c9-b170-b03a86d826c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d33c184-78db-4171-ae1a-bd1326450fb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ab6e88a-6e0b-44e6-b344-433a158b5989", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98951060-a8d1-4e61-ba1d-29acd760aa1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c158a31-ef9b-4c33-bef1-5a648b593088", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a80fbfa-aeb8-4079-86b6-ed59cf9e4d9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b85d9f50-d420-4f3a-a641-c6198a026a4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42068803-adfa-47af-9e31-bb247a229d8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--933c0a93-1033-4f1f-8d78-91586530e2bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5edeb3d-c0b3-46e6-b48b-46359470ef07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f92c6c6-7669-48da-8a1e-34b7c646feb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e230c6bf-4c99-4958-b97c-906019f0405c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c82c1cd-7c3a-41a6-bb5a-2305fd9503e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--297a40bc-562c-4290-b6e3-6bc5f0de26f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a108661b-d6e7-47a7-8e87-2cb3697c40e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bc69176-5555-4997-a10e-2dfdadfe46a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--532e1ff5-5e9e-40c1-9248-3aa002f1fbba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a53b4ecd-9ea9-4b1b-a9cb-b3d7b73044e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f420cc9-0361-4a98-9f84-450f5d403702", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87265890-f5cf-4df6-9cfe-e32e16c06078", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--989cb8a6-9b93-4416-8113-c67b24eb0dc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1ff3cc0-0833-4b04-b139-9c0137f29639", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17fe53b6-66a9-408d-bc58-d6322d8b1b43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74260206-2cf9-4036-89aa-406948e26bad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ffd7e2f-3e54-44f7-b550-20ea1fb20675", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae1a5dd2-d143-43a0-98c4-da20c5d6268b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--582e5f31-d2b0-4870-a33b-49505d526490", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f0af1e1-6d3f-41e9-8ea3-187f5dc697af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e951ff53-490a-4cf0-98a9-ba1a82385f74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6c419a3-61ac-4da9-986b-516c94fb9bf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce54623f-f7aa-40f1-9fba-0f10f0ab2b46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75470436-7d0e-4979-a284-7c5d2fb7c796", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da4e1d68-6200-4918-ab7b-18964e6b374a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c3114db-afe1-4645-ab20-0a69a39465b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8acb80a3-3aa1-48fa-8581-7a720e79bb9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bf6c991-c39d-4336-ae0e-04fdaf31e2df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b12971c-f5cd-46b9-8794-2700529a122a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f790f75-635b-4287-95e8-d358bceaef4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb116791-ceb6-4b02-908c-cd613cf4b64b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c61ecca0-f429-465e-80d3-1d7dbd937dea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f1354fd-45af-4369-882a-f7046038ebaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1a638b6-6226-43c5-8809-b6a16398752f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bb258b4-5f72-4e1c-82b7-2b15699e7b47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--258da500-d40d-470e-bcba-868aeb0d1016", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6859c783-dac5-4c81-9854-9a3c624d8ad7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0de94cf-5ad5-4d4b-ab59-b8d041e7bf05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f508913-6076-45e4-97b1-bb604bcdcd0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5facfd4f-fffb-4e95-9545-3cbbc31431bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5098032f-c3bc-4a3e-9b05-302b30ce90a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf2c332f-43e8-4c05-83d4-e45711dbeb61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--445cb299-3c40-4759-a920-4110f7157856", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1850ebd2-24ad-4c18-98cc-a35bdceb7b85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7104bb21-00d8-41f0-94cf-9a97687e429b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2481e62f-2132-4963-9a2e-e67b2f4dc6c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a460e41-0b14-4ef2-815f-f24718b7d360", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fabbf6a6-124b-49ea-9f6e-50a6b30b599f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.205.121.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92196f05-cdd0-4275-a031-8ccbb2281263", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.205.136.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8abe751c-f451-4539-b6b1-9e206c750c80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.205.189.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81f54cb9-ae18-4e46-8337-2aaada4148f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.205.6.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e31db5b-7eca-4ae9-8843-e3daac1e4ca3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.205.73.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--156aaf8c-e469-4c04-b270-1966d6878f09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.144.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ebe9954-a85d-4650-b2a3-bf943739a8f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.189.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eee629e6-54f7-43a9-a04d-f2cc1872d918", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.201.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3162269c-d145-4a40-92cd-d4b18be340d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.234.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfd3e200-d221-4eb3-bc4f-47fd5293c597", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.254.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09f4dc79-a89e-47c6-ac7b-d338c97e73ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.233.42.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68009fea-76b9-4006-9190-6681fa2c898e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.233.50.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29bd01f5-0126-45a1-a7cb-6546b925cbcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.239.242.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0348491a-ebf6-4ce1-9909-7a47590b057a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.240.47.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70504e62-c91d-45e8-a785-8ced436215ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.241.246.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0e6059d-cce0-44c8-9d23-858c64eb1f31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.241.84.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c629587-a7cb-4639-9ddf-67eb078c2f20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.246.100.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c9da44a-e889-49ba-937e-8b5dcb1f5f58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.246.66.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--001a10a4-3796-4469-9cfa-6beb7c3205b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.252.90.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f3bae8f-4437-4e8c-943c-e496dfcfee2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.106.166.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c240af1-01d6-4875-af0b-b3e7e0e61887", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.112.158.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57d2c043-c80c-4988-a072-ee20351e451e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.137.121.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ba1804f-cc35-4d43-8fbe-8c84309e2bf3", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.139.7.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6bf296e-414c-4d19-9b2c-88040cfa17d2", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.140.10.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec45d74d-5ec3-4d7e-bb13-4097e022c1c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.22.215.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79b4de61-56ab-4f84-a59d-d087aa77f631", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.238.178.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7295a4b8-edc7-4ab3-95d0-d6f5d18c1295", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.24.196.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbfe4456-5839-4ffd-889c-281b5f6a43f7", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.25.94.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db4001ea-1c4c-49f3-9917-9ea56d49e75c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.50.40.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63def53f-f012-434e-beef-397794bf6580", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.70.68.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b5b8a59-cc56-42f1-b66e-f10b133e1154", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.71.45.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2185e9de-3faf-42d7-babe-2e5c3eba52bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.76.135.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--349b6527-e76d-4d69-83d4-daef67a95345", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.89.252.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f96dacd0-cac0-4e0e-97bb-d9f25396da4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.10.113.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0f921a7-894e-4170-9fea-e97d0ffac816", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.10.113.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48b09f56-99ff-4e72-b929-07d328cf54ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.10.113.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--517d1e23-75c4-4e2a-bcd8-74c5add343d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.10.113.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69a9946d-8181-43b3-b6c3-1bc888751384", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.10.113.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ba40725-73d9-4e59-8ad6-d525e843ff32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.10.113.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55f13f45-fb31-44eb-bf79-fa820b12cd0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.10.113.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da4a744c-26e7-47c0-a47c-8fe793a48510", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.10.113.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--354ca802-d38e-435f-8a64-89c7781807ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.131.200.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e86b6ec8-d4b8-43ce-b97a-72365e7fa050", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.139.23.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc7a2fd1-a089-47c2-8178-9ffa0d9c5492", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.143.61.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--913adfad-8c75-4433-818f-2630a992440a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.186.125.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b46600d-45bb-4075-a3e6-79f9c43840a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.27.7.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d2faf31-68f8-456a-b4d0-fb02dea939af", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.59.204.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c5f15c0-40a5-44d3-a043-87d218bff237", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.67.192.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--519fc590-03e1-468f-a674-8f5fa0a0f8df", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.133.213.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b4e3667-8241-4aa9-b91f-daa0267c426c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.137.236.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb381c02-0c81-4108-80ce-47130ffdd1e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.159.57.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3222a32d-2a08-4dbe-8b89-6cb07b641fdb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.17.150.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de87ef0d-be5a-4301-b7e5-b714ba556629", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.17.196.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b106e51a-6b3f-453e-8979-1dcf7e81bdc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.19.227.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a17e949b-7516-40bb-9cb1-0ab88a132bae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.199.205.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f97077bd-3319-4b79-9308-198cc9dd651b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.41.41.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0e0f172-0cb1-4585-8efd-17872306e069", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.41.42.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--336bd2fc-8867-4c42-8734-64a3404f070f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.41.42.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3572baae-8bb0-4874-b882-250bcae12336", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.43.205.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37fa1fc7-302a-4c58-a2a8-79d42ab56544", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.51.234.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da8aba15-274e-465c-88bf-1548bf886ff8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.96.178.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e9be7f9-ea18-4d7f-a326-bb4bcb58efb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.96.178.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eff905f5-d108-4943-bcc8-2d74ffcf7c80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.105.157.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68afef1f-1d1b-4c9d-a434-510e7f0b5cf8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.105.23.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f07f38f-a5b9-454b-ac70-938643a3a024", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.106.61.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--117fe93b-01b4-4c0c-9697-1f1e03688925", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.113.77.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--090e7e36-6f9e-4529-892e-09420cdb8cd7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.175.52.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6eeee88b-7e06-4b7d-ab37-08f8c818c5a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.61.46.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f59adcef-7a72-4a2a-a2fd-72be54d2bdc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.83.76.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce149999-4320-400a-9a78-0d09716b158b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.97.54.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2764ad1-7a44-4219-bf63-1485395ecbc0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.186.40.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--137f02f7-c3f9-43b4-bf1f-fe8617bdced3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.210.91.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2ece16b-c22f-4d34-b001-ebc213ffe99a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.227.178.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e4ba8c7-6bcc-4136-995b-1f9a4d15c296", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.119.33.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--398cb162-5ade-4742-97b7-31e3627cd2c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.119.40.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3775f436-1c21-4954-9b17-22d10bc50f16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.119.40.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--658f6e9e-dc8c-4b85-b9fc-5c8a60a42caa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.119.41.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04cc480a-825f-4704-969f-03da3ba7c5a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.127.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc32954b-657f-4181-ba9d-1d013370f48d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.171.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72fabf23-ea2b-478c-b3ac-5d9d7bd0c0dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.172.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a41dc45-9610-4466-b8ab-721da88bd9e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.172.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8c7e030-efea-4c62-a556-3bbec3b361c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.173.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27580748-6189-42b8-b85b-b36a4f128998", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.173.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3de7dac3-3b78-49ce-9747-d92f1117554f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.174.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1804ec30-7384-4f66-901a-e7ff6523a1d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.174.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93848b5c-673e-47ff-93a8-0515584b0c41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.175.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dd55c68-a641-471f-8597-f7a08fa63a2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.175.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--492663d8-2a40-4935-8ec1-702361dd65a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.175.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a575193f-d645-4ea7-898b-a2c52952fef4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.175.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3e2d2fa-6e74-464d-bfaf-c99f01b43885", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.175.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85cccdd2-0f10-4afb-a9a0-a02b8940f64b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.185.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--054bbd37-ccb2-4318-ad3f-e2b7c0dece16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.186.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb97b803-3fce-4769-be20-560e093e56e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.186.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5423fe2d-6b81-4c46-9c77-52ae8930dc23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.186.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c59a0cce-7f0d-493a-bf57-f5b369c354f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.86.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2979577-e22c-4f94-b433-a194dbacdf1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.116.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--853c8f6c-cb35-43fc-838b-31ebe75e4630", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.116.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dba57c8-a2b7-4ed9-b08f-0ce242e8ef1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.124.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d882463a-123b-4146-a0cc-3465c0afce9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.124.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8dcb489a-bc9b-4156-a0b6-5debb02bb4cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.125.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60569e9b-3a05-4aa9-813a-ee765beab43c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ad639cc-f506-4737-8709-95b5186bf79a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ed529da-c2b8-414a-a258-f85e0d57f661", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc8f5495-e602-4b93-9a32-2db000553c4f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--631092aa-c610-44ac-baeb-b8f9fe1881c8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1338cb85-b2ce-4a6b-9a29-61aed6108e53", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31907f98-bda6-4d6c-9cfd-cd55c38ee35e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c1dbf8b-2c58-43ad-8756-3d919f666579", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bad20268-54ae-45f2-99ce-cbf278a1b19d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0aceedd5-f959-4c01-b590-1e52cdd84bcc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c550a40e-2bf4-40ab-aed4-424a203ae0fa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc5804e5-f0e6-4fed-bd36-ad74e73b3457", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8360752e-d84e-4edc-9a70-aa9a7a17487d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba30ecd5-8381-4f32-83e0-b9c72c52c32f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9424ced-c22d-4e1a-b678-fdd15576de57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.80.200.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a24819a4-8c8e-40f6-bc16-0c757a0e6519", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.80.204.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c96604fe-fa32-49bf-b2e7-76274a7378d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.80.207.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc2f00fe-1dbc-48f8-b1e7-172dbf9cca4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.81.230.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b948b0f-44c4-49c4-8756-21e620190a67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.90.249.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce88b3bc-a190-48ec-acdc-d1db4e2a4492", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.111.162.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--433d3a1d-5f45-4851-9a6f-29157400abcb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.111.178.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c8359f9-9ed6-41db-bdf1-587b43fd48dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.111.215.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f604fe77-6b72-4306-8771-203de3d67982", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.140.136.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06a173a9-1a86-441a-af60-72975a36dcc2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.208.147.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e99152d-296c-405a-841d-c51a417a6606", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.208.169.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6ac9801-80b9-45fe-9361-d33c297d55eb", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.216.177.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f07058a7-f6e6-46f0-bcdf-68b152ffb794", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.251.161.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d33f7e5b-7134-4200-995b-b6762c4cc8c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.38.195.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76d86ac1-c0d3-4637-9a1f-0e5e85f41038", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.38.195.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38061e1f-8275-485f-9787-70afb9352be5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.56.206.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59bb6d83-1f5c-4a3f-ba4d-99ef37555a65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.83.114.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8099dda9-dc94-49da-961c-fb73c14f8522", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.93.28.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6b23717-437a-4d24-a982-b446ab3a794d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.200.78.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bbcde61-2b51-430d-848f-b321826c6aaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.234.148.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ff5fca8-4e5a-4729-be9e-2275942785fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.48.38.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b19f301e-291f-493a-93e3-2fb791c1a5d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.51.40.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--253399f1-0028-4052-a518-6b1484e3bf90", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.51.41.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--178486bc-f50e-4fcf-95ac-4259c6a92f9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.128.156.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f71eb624-3e5c-4b57-9d22-6639ab6ecb1e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.102.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78c53b49-28a0-4fe5-8209-3dfbac96a0dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.131.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--429ad5eb-6319-4cd5-887e-2e025a873859", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.141.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10b56d43-39d5-4ece-aed7-25e2fad8e6b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.15.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dc4de49-7c2e-4341-b1d2-50273fdafbf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.228.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dc00365-c454-486c-a678-964133997a77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.91.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64a1ee3a-6956-4922-be61-93c6a30e7855", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.131.243.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8177ff4-8861-4e3a-b134-aeb21f908add", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.131.39.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5937d977-7e2a-493d-b8e0-e20277b5a71e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.185.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aefda670-9b4f-4b85-afe0-528c85d9fab3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.41.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97502a43-d845-49bd-9e94-ff7f1fac19b0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.92.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d663995a-9584-460a-8bff-152f054eac75", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.93.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--970859e3-3ae1-4e67-9b42-11fb2fc76372", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.152.72.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db734b8d-f40c-4236-8a25-90af4965e4ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.102.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcd3366d-d064-42cf-92c9-8e9a4723c73c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.135.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3f966e8-9e64-407a-8d06-e2f7c56150ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.26.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--faaf7d01-7ad3-4919-bee6-a68d4eb6f58f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.155.129.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f341434f-1a52-4e56-b045-93c71619a621", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.117.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35e75b92-e795-46bf-8245-c159676ab6d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.168.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e7045f4-c48e-4ac5-a8cb-290a70c9bf14", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.202.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12b56556-5e90-4cae-97d8-dc9b70b39007", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.44.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11c0be27-d1c5-4d70-88fa-60c3c792e3d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.66.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e43420d-7478-47d3-bf1c-a2aeb85aad80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.168.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9558753-8598-4ab9-bb5c-e506aac930b1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.62.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1bedcc7-148b-45c3-8b30-dd600e3ae398", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.128.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce76efad-e0a9-4270-b424-c670ac2ddb84", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.141.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7017f4dc-2254-477c-9dd8-1b13a46f3937", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.63.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--368e9b6c-4fd4-4374-982e-71c19cf8a403", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.160.225.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d97e97a-17bc-4668-8014-681c5cf6babf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.160.249.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--619525a7-142e-43e5-81ab-0d3530012c0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.161.217.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8350dd57-821a-4087-b073-f15645e1e94b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.163.4.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef413b03-079f-46ca-bdf2-2b7636b42fb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.165.125.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4677857-618c-47e5-b769-1030b729c3b0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.165.126.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee05726a-0a35-48f2-a743-0eaad394875c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.136.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c5e609e-60fc-42d8-945a-bb123f0cf97c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.167.188.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67f7c474-34db-41e5-9668-a65c4a9b1ce3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.167.198.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7777726-15c6-4762-8c03-1feb86e44351", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.194.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07ece1dd-b608-4e67-bdea-dcaf9e681e5b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.196.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bbc9400-9f0e-41fb-89be-d04da9646f7e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.198.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61bf5f7d-3a3c-4bc1-99be-5f00b3db23a3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.1.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9258cd2a-5a28-4c37-8206-a3ad1d4b6485", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.174.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d86a9ebf-0bc5-41fd-a153-4b2237118098", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.178.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4aa2789-b02b-4938-a3a0-79d42db3630a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.178.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97b28616-e98f-4ae4-89a1-7dcb9c5bbc9f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.182.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f906d23-06de-4348-8c8a-de231395bf20", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.182.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--969e20f1-fd81-4c89-92d2-0f1e86b7b51d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.224.126.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8604fb51-72e4-498e-aec4-af1b9204b501", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c42634e-1533-4ab1-80ac-a01023cd44ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81725510-a091-4c59-80ec-b8ed46ec38d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ebb3b57-b81d-4121-b072-dc361c86f75c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2819db4d-bfe2-40d4-b7ed-95977bede084", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.243.142.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03127386-1810-4ed3-96b9-1bf3198e74aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.248.109.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a473a9b1-f3ad-4876-ab41-0d84455ee773", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.248.69.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d32e5c6-4c1d-42dd-bced-e62f62010723", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.255.118.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27c51ecd-ac87-440b-8395-a5ad68059103", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.201.164.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78be6b43-dfaf-4353-9ade-80093b4ef2ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.202.55.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b98d70d-7be5-4922-bed8-3f1d483cf62b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.202.56.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a6425e2-6ff7-4b2a-b441-4ca285a2447a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.203.192.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4add079-5e9e-4afb-a1d9-e9275f2e6a1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.211.45.255']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f62587ca-2f21-41cb-929b-f761daf77321", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.212.59.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cd67747-2905-4d35-9281-ac6c5726f6fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.220.185.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7e96910-ef97-48be-95b4-1d64b9d53045", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.220.185.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8fd70bd-ee36-451e-9ffe-af47e81ad5bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.247.181.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c782fb1-37fd-4b96-b329-22d3e60d73c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.10.165.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64678175-3f86-4d3f-86e1-7076f9cd732d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.11.57.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f54868cf-1c7a-482a-ad7f-7f72eaae207b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.112.149.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaed7d34-23fc-4682-937b-b4f134ab994b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.119.84.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56aba4f0-8551-4c9a-b7bb-e1fc78334c16", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.129.185.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5850f789-732a-4eb3-be01-fd3e375ac14e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.133.245.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97abb0ff-e99d-4016-b395-ea751537cc4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.134.79.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19f72581-1ee3-418b-bab0-3578fc412705", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.135.194.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a5bedd4-5d4a-40ca-afed-024158415600", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.135.194.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed7f5a1f-b0aa-449a-b7bc-f07d871b0db2", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.137.172.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7692a7f-537d-4f32-9de5-30766cf07708", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.139.122.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e443b82f-3a76-4e44-b1b3-d3a938b60b39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.139.76.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72c237e7-1363-4ea7-8017-efa5ad66cfbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.141.233.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87ab2dfc-476e-45be-aaa3-895aa74ce7fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ef5cdb1-1b8e-4410-b654-2a88fe2da764", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--775fd866-48f9-498b-8d34-4eef661ab246", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61d82587-629f-4b7d-9e6b-864ab3473cd2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--962f5436-06ef-4f4d-8722-44d67423d57d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2ace8d4-499a-4e3c-834b-69ecd71fd4d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8564ce33-c1bb-455e-a5df-978ad67eb38f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ad7aa9c-fba8-4d5c-84a9-b52ac4c1b1a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ea134f0-1a1b-43ad-af95-02a04143ddd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15f53cce-4b95-486e-b72b-80f868795820", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb7ad6a2-15ef-48d7-bed1-5499d0168f49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c11937f-24de-441d-b0c8-e9fdc247d817", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b38592bf-8ed5-4492-b5d1-fa9a08d3e8f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aba03fce-1491-44c0-ab9e-56dbbd07b28c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9e2eaf1-fe29-4458-bf0d-02f357fa7c28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38c6ac90-e842-4b39-ad75-b10f3abb9802", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6e3e9a4-ad0b-4513-a6fd-9823a5f75efc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbc09db8-6f84-443f-a23f-9f96c17c7ab8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1627c45-031d-46ae-894a-f3fb0a8db0e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8556a41-97d9-4667-8d43-e119546e5a7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de704181-6920-473e-9cf4-74bbbd71b4ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc1ab12d-314e-491e-bc1c-ae391d6ed809", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02183cc4-16ef-419e-b755-da2a1ed21ef9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52004c6f-272b-42d2-9911-decbacce36fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df240f7b-3135-4227-867f-7471419ece7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f0e7c5d-9ee3-4e98-b3cf-d989341b98d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b492e4d8-cfd2-4cc4-ac57-612b8de48951", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2558cc32-c3a2-4692-920e-4b89f16b6339", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04e987cf-bd4a-49fc-b576-fc5154867e42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07035598-0a06-4977-88c5-be7e2817cbba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.3.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c48e324-ec45-4b97-ac42-a9225a4773c1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.144.233.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3816f02-a067-499e-b3d0-786cc912f079", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.146.55.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b65eea98-4949-4fc6-a562-9a1af6bc30a1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.147.249.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84910b95-dd65-4773-b37b-832a67da8059", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b15eaa18-bede-4079-bfcc-bd6bdca4e11f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af7910b2-b9cf-4898-b6a0-e2de1c80eed8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de70022a-41b3-41db-a6ae-2aa80992ceef", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80d70ca2-d636-48e6-8bbc-cdab8340262a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--543965f6-1327-47c4-8f12-a6b3236cf7bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--631f377d-c574-4321-be84-91b997e91239", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6686598c-11d4-422c-8224-4b9dffe88400", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb245e59-2787-4a75-8e79-0e895e573df6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--321d5dd7-d2ce-4203-ba00-b13476972997", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28dee8db-7fa0-4033-b607-c2dc47ce6ad7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cf800d0-b35d-4e79-883f-ce7f12b6afe2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74a162e3-6e10-461f-993a-ffcd642d1630", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.145.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dc6fb55-88c3-4d09-bdca-66772283d5aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.146.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc698242-563f-498f-b740-8c557e8e4d32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.147.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02442aff-2a8e-4823-ae02-0d7f97bbb202", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abd0fc8b-e794-41db-b755-2502ddec452f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ff0fb05-56c2-4b5f-b5be-29c9669a80bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65a1e6cf-82d2-4b3d-ba8b-9c8c5ab95bed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d44aa430-bae7-476d-8bf0-107861a1b23d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcbf6343-3784-4bf7-ae74-a74add6ede2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44174091-fde6-493f-a309-876d4551a738", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--358412f8-6e90-463c-b554-7e973ae0a951", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04c7a925-478c-4122-a2ca-76147371d741", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfbb35e8-1daf-4938-994c-40d0c0d7fd33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b9b6790-760e-45f0-9feb-437067890b01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aaac1db1-aff9-4ed4-b2a2-fb16b2ac8e98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08c502bd-7b84-4b4e-bc68-ffbdfcd3a50e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d37a605-fd21-4d4d-8cc8-72025b285554", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c12fe71e-6ca6-4b34-b433-431b0b212b96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3abf1f19-3e2e-47c8-a7a2-a1be045def3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bfc8000-580a-4bfe-9758-d94af2237203", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06846969-e159-42cd-af81-3a5e17445600", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54d10a71-bfc8-4956-be51-78896fe6ffa0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60ae5451-8ee2-426a-b7d6-4b7bb3e4d4c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7102ac27-805e-440b-b7c4-4d68c3fc94f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2971f2fa-1be5-4010-890f-8afe46ce4cea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05a9f402-6edf-42e8-9082-97c3458ad361", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff784f1b-68c7-4a9c-8d46-9b5615baa015", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dba5fb40-ee80-487d-954f-32e07023728e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.223.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b726464-cd07-4f1b-b902-1a5f79d8c325", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ed2676f-4527-43ee-8f2c-c10277481c88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11c0c7d3-dc27-47d2-b07a-63d29b08654d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ec68360-28ed-4055-9f2b-34f2d110f970", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e03f98f-03dd-4733-a0a1-36e8c6758a52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c31bc4a-4c2a-4dda-a297-6ee43d39cd54", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.164.39.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbed9fd6-6da3-46d8-a18d-56cbe2119566", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.165.163.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f355f218-85ff-493d-b31b-ceae74c56675", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.165.46.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e83009cc-c8fb-43a1-8adc-10043e27cf9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.167.70.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a292ed6f-642e-48c2-a813-0d8b3d78d1e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.169.207.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be27800a-5e06-4c2d-9270-33952b50a2cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.172.114.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98aa38a0-ba4a-4aef-ab84-2e6a426873dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.173.219.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1f9717f-9abe-4360-904c-6602add0224a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.173.254.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0effba5-418e-4187-938d-85e79f32c84e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.174.196.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d1786d1-caed-45df-a700-fc47eaf37078", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.176.34.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--814148f0-42b1-4a6d-85d1-b636b1b48415", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.183.186.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7284e9a-5ebf-45d0-8ea7-3c14c202797e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.186.120.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b784190-ed83-48e7-85ae-773881de3ede", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.187.121.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6d7d67b-6d84-4e2f-985d-454f8c6a209b", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.187.200.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36a4fab2-7c57-4146-a673-20090558bdde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.192.184.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9eb037b2-ac1f-4210-ba0b-9257353737a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.70.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be87464b-208a-466c-b375-1c8af135df2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.70.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18cd34ee-fbf1-4943-aca4-db3fb857f9f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.70.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdc8b971-6db3-456b-9704-2b728d92158e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.70.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4906393b-7edc-4281-b7d5-24fef0489b43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb10de92-1fa8-4278-9cf8-6b4aad3974b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2208bf01-df1a-4b4f-9a83-bb8f93ff75f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.202.247.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c6550b5-74f0-46dd-a3c3-6e6ab3a37308", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.202.247.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9ee6fba-162e-4dad-8347-b1d93af9a19f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ca9e9ae-acd3-401d-b55b-54ad0db7f0ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6c4e58d-d64d-45df-9676-177eb128b9c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d1769d2-dffe-43ac-acce-bd63f93b1426", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cd4cc08-ae59-4e51-b0b0-ca0782e73e03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--478ecea5-7178-4658-bbe4-86ea1875bf58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7590599c-a6a7-48ff-a39d-a6f10b54b368", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.226.118.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52c24a14-97d8-4f0c-a364-f8ea64399173", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.226.120.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d59f641-a0ab-4d64-8bbe-998b441af1c8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.227.254.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc3da0f9-e330-4956-9a94-fbec0ec97924", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.230.169.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dcb36d5-1fa0-4656-9831-083860b342bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.230.65.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e2c82a2-9432-41ad-b620-770ceb627b1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.230.66.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b49ad551-9037-469e-a5a7-a7f1a4f7c345", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.235.108.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fa5f0ee-9226-41f3-9a31-0d27608270d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.238.255.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b4c6f15-288b-4e8a-889a-30708521841b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.238.39.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d109b163-7818-4551-a95b-f8d5e39bb687", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.239.149.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72b41b99-4bd8-4f8f-ae30-22a7d8fd209c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.240.88.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c45b2186-517f-4575-9e79-d0232e490daf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.249.244.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0015e74-451b-4225-b09c-b0dae5d8da71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.249.246.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f89ba4a-249a-4fe2-9169-b16c251e1509", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.249.246.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d69f77f-2981-4aa3-b968-6316da073ccf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.102.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59396697-73a9-41c7-ba23-07a7d6da6b66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.102.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--529b57bb-a41b-4f6f-9031-b080eead73b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.102.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--906e7c74-9d2b-401e-8d7d-3e26b152d28c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.102.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b8e240a-9445-4845-9e8e-41f30f7b1a4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.105.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fd334b1-f818-4890-b6c4-ae40697a6411", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.105.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa46ba1e-068e-4a46-95e8-2ac6b3fe71e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.109.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4af4a7ab-c3b0-430c-a9bf-3a2ce28e866e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.109.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ecf43e5-a655-41af-8e81-d03861d34962", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.110.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--944ef17b-ba03-4cb4-a3c5-a1eee6fad34c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.114.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47426315-59d7-44dd-ba3c-23ff8064e6bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.114.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42a20dbe-f607-4cdf-b7c5-376ed061a8da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.12.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d109339-5b11-46dc-9a6a-ba30717acd16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.40.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f521e2ac-4df5-4bd7-b78a-a064698b0631", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.41.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b12b2aae-865e-48a2-afdd-5b58aa1ad46e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.42.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8ebc4d7-37ae-4d40-850c-03c6efef0f3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.52.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2ba980b-5eff-4246-87e1-9c7f5b48261e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.54.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1da8979-85ff-4f88-bb3f-895b53910604", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.60.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f215b4b6-ad60-4bf3-973d-b5e9b6f0fd77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.78.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3ef769d-bd7d-4f8a-8f36-1eaeeec688a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.84.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e52b8960-0b94-4603-9fa1-ed9a9c49e8d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.89.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2f8fbf0-418f-43e4-b5f6-b5fe1d5d5614", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.94.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bb0eb90-5dc6-40dd-8ec3-0d3166ed5e40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.95.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b27236a-9f77-4b6e-9588-b47fb0ce00f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.37.83.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7bf444b-5206-4dd3-89e3-44583bb9ebe6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.40.57.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92b4ca67-6034-44fa-aab5-60894ebed2ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.40.57.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf305b76-4aaa-482c-b59e-d11aaf02a6c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.41.105.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b82f7efa-9553-4c3e-8a05-9eaa95807c59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.42.88.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d89d1e5f-3ea9-4540-b3ba-562fc7116cb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.58.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4df891f7-de72-44fd-88ae-ea6bd8881122", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.58.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d58e1664-06c2-46eb-9a98-cb53718a34e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.62.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b63cb2fc-1d07-4255-b932-88a345ceef34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.63.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--023d9323-d887-4c4a-9f4c-dc3ebd103467", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.5.102.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9389d793-355c-440e-8d0b-4396b9253a9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.55.185.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eee7f7db-7db6-44d2-8e6c-06e3acc4db9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.111.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--982d324f-16a9-4e4c-b046-58d027e561ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.83.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b80ca8b4-0183-42e7-8f8a-813c5b8c1fa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.83.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d67b1cf4-c616-4d1e-bbc0-ac13ee205fa5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.83.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bceb0e5-d52d-43c5-914d-05a15a7dce39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.84.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--173da8c8-c9d0-45b3-8657-23f656e217f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.85.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fef1778-816c-4ba8-8bbd-f3bf27059c1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.6.40.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89775de2-caf6-46c6-9dae-f3b6b29e4e60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.71.174.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f63c325b-b8da-44c9-b7b4-8012d6e52698", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.78.198.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6b83189-8a96-4ff0-a85a-ca67d09c48ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.100.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--105825e1-698a-4696-b3b6-3512339185c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.104.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f8461d1-fd32-4050-8283-1deef762dc77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cca1b884-8c84-42e4-9679-fa40ceb841a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b99151f-43a4-4f48-aedd-b747940272bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53b7aef3-3286-4f3d-a181-688f2039d1bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fafe8589-671e-4ac6-8e8a-ce0531d5a7ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.110.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83aa1b89-6892-4890-871c-63bc215c19c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.114.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33687543-6467-4ad1-b8cd-67d9f96759ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.115.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0c9142c-ae9a-4de7-874f-40a447d49833", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.132.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2860f6a5-0a68-43cc-9473-55c1f781ec58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.153.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3437a7d-d015-4498-a9e5-726d3fc5da93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.153.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b57e052d-fef4-4daf-80da-d653c8d3385c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.163.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c05b9dc9-3532-431c-8f3e-1786ab9d3e8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.177.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff91f25a-57f0-4023-860a-9cc5645cfcd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.181.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55c0a7c1-708a-49a1-9bdf-101fff20e59a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.186.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4a5bb7e-3ea7-498a-a0b9-ddbdba154d89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.191.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c92ed8d-74a9-489a-87ef-5aa2fb8d8462", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.207.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a69a5b57-9773-4534-ac0b-d5f57cb3cdb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.207.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c67a2af-b202-44c1-8a6f-81b4197bb15f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.207.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67f87c3a-e086-4bae-bc51-bf976a5043c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.207.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8269a615-506a-4acd-8560-fda31082edd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.225.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93194a53-58d1-4f58-a230-1dc7957e134a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.5.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--635d67bd-d202-4051-bb34-e7384b7e7a69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.67.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46756aae-b1f0-42d9-8bf3-8e5ce4fb7206", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.82.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a53a60de-5904-465d-acdc-f707bde72040", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.92.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7697e0ab-dbc6-4c02-9366-323ea9da8378", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.98.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--add87e97-12d3-4f35-9c5c-41d6d01819cb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.8.19.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3dee5b2-571f-42e6-b304-5c1184e9a5d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c871983-d111-4562-ad22-5c3078f1a29b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02b1442f-8051-4ff7-a112-6ad5bcb4cb4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--418e3505-aad8-4d70-a17f-63f0d3e102f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51ed9d3a-8400-4b9b-9e55-b8b720e68f6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6fa97c7-c74c-4bb9-895e-b6705ce2b56f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1642ff9-6b90-4e51-b961-fca086c75336", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e549311-19f3-45a4-a7ee-ba0913655b08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad6a30ec-f442-4e9c-9429-9c06e03f488e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--410b8cb6-fd76-4641-9e85-6045be99a41a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2720ddc-79f7-40dd-90be-7975c9e90c58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9a2efed-ecf6-41b7-9360-751e9f1f39a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--442594e2-511b-4a3e-9117-417812e69728", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--169c1137-711e-493b-bd84-1c235e2217d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae3c0c0c-beb0-4fdf-a8f8-38660f4efa9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c91170c-df8d-4ed0-b5a3-99d22e289e7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90f7f2ea-9f9f-4009-917c-9c0fe621b1aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb4d6260-4f44-46e4-afc7-3cc11fc840c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0beb3675-1c00-4333-845d-13231ec78fa0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7449cbe5-878d-46b1-bfc2-054a0b04a309", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36a54d9e-bcf0-43e1-adba-d77feb1d2114", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad260eef-b7ce-446a-928f-edf5f0994dfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8ed4b86-a162-4da0-b911-742c713d0fe0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c6c2c4d-ad17-45c4-801d-0898897f64ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53507190-802d-4f31-beb3-99db0d14c8ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db64baec-b39f-4bdc-985b-1957eec2f7f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ca1ba1b-3ed0-4db1-9325-98dead5448b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cc0385d-7043-4889-b629-29fd03a542a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53cde69e-1646-4f1a-9bb9-e186afb27b78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.78.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--540a90a5-9d4a-49f9-af01-e3779afa9522", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.78.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cf2870e-8480-4eee-a0d6-fa32af60356b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.87.249.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cfd92b1-0d84-491f-877e-789b6d66696d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.88.0.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9deef321-096b-414d-b268-662d6c061f55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.9.2.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ddf6b2f-4507-45d4-b504-5d0dacf4e5a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.90.105.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2364af6b-4826-4318-9bc2-fccb29f9e464", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.90.57.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de1071fb-a368-4984-b668-7b800a5ea217", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.91.64.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a55cca09-a555-4e28-b8c6-5e1e660a88e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.91.64.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c996c6a-1290-4925-84d3-0e20e9c9bbe4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.94.31.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ded8d64e-3fee-4db4-81ed-e3a044af98e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.193.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4272b38e-c006-4fba-9b32-68d73cb9f414", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.199.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e8cb953-35ec-4cea-b77f-cc8c91c95eaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.208.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bddd9a5-9b26-43c8-afe7-3d54d4219f9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.32.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c488528b-8bdc-4844-a145-e4f01f0ba334", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.73.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e220caf7-710b-459f-b405-7da1ac06a52e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.77.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--199c93bd-05b7-4358-bff8-6291f80693b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.86.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32331da5-3253-4926-a859-032c1e9525ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.95.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d3f7b2f-d862-4d62-89f2-3d8eec41704f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.105.132.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b94f8117-48f1-4be4-aab4-0eacbd993309", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.149.191.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--257f5b46-7eb9-4d42-af0b-c4ed156f5527", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.150.66.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7912b52e-7446-4e15-90db-8cec6d6a287e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.151.178.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92bf8c31-f8c9-4501-8e42-06caa35e68ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.151.182.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fbf8df7-41a3-4752-89bb-9c994ffea79c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.151.182.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76c77247-735f-4baf-b39f-863f259e06f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.151.182.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56e2e0ed-bf7a-44b3-85c4-b6f57398f5d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.184.247.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6b12989-1c20-4333-bf72-1687d61fb65e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.188.119.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--731d75f4-638a-4bce-a31a-b8fbe330b0a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.224.203.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f590654b-a692-46bb-95c1-6698517e2c09", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.24.47.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dea3157-4d1e-470a-99ce-c6edcecc7169", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.253.45.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--015f74b3-3f06-4cf8-99ab-fceb8e323a9e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.29.238.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6358e94-9b26-4b09-aeaf-284c8a1b02ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.37.183.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad7421f6-9718-4c21-9302-8f1053c90ae4", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.48.96.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93a2ea7a-eb72-488b-a5ed-9d893657b7b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.52.112.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0a2e73f-0c93-40b4-859e-fc01efc25095", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.55.211.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfaf5b8b-e764-4163-b9d1-8f9871abb9af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.62.239.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3fe4e7f-3e2d-4dc4-b885-98c33f93d37d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.102.100.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d11fedf-bd76-4c3d-82b6-837306e90f7c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.128.123.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e718c1f-2746-4b5a-ae3c-b8beded6f4af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.165.0']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c24ad281-5585-4614-bd53-f2d400060da6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.179.0']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e019bb87-1a49-4102-af6e-8c2a65521c25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.194.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f44aa92-d9f1-4b44-b107-4e7d4bd8e6eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.196.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbb4ba03-6ecd-4812-8a7b-08ca9cff5fcb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.206.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec2901c0-ff0c-4a88-b762-1ecdb8c578f3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.246.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3acbc1a-3aae-41bd-b812-e7c79fdfa9c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.252.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f0a4d8b-8a6b-4fe0-a334-321a6cedf926", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.237.200.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ae89320-4581-4664-8800-b227d1deae8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.237.201.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6a74a6c-3c86-4019-afc4-e2d463f46970", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.237.202.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8aac4ea2-1393-4f75-9ef5-e0c5661bcd06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.237.71.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cdb59b3-71a9-457b-8280-a00facfbc521", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.102.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4e13ad5-e34b-4946-9ae1-1282a86ab2a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.108.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e880a5f7-546f-44fc-8331-347950416a8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.129.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0e9eb9f-080c-4274-8cf4-3d5e351112a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.130.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0deb31bd-5ee9-463a-9590-6be2ed848bd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.133.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10b88b77-6fdd-4ee0-9a65-3b8ea143f60c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.135.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--797a7243-e533-4cb8-b17e-8ee7f4ed724e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.136.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--347a7892-dcf1-405c-9abe-2fe333fb568e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.136.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eff73f0f-ea78-4514-9813-f0705bf69fe5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.136.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7f64d6c-aa66-4723-8f02-b9f191358b03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.136.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--695d2d22-c3dc-4894-888d-55131019a15d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.137.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce1ee1cc-2d37-42f5-be06-b19371136cc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.138.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f365d57-9b41-490a-ac37-7d7149e28028", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.138.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--207459fb-e752-4b21-8e4b-1638a2edc09f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.139.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--414f8022-7c77-4b32-ab1e-7a21b1b2b929", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.139.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33718fb3-5042-4f27-a64c-900a51c26c35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.139.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9bc78ba-006d-4e85-804d-cbe1bd8cb09a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.142.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca2a1ba9-2b4c-4683-b4f9-91087dacb419", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.142.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d8ff6a4-2a94-4381-bd42-f02f7b682da3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.143.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8e3a78e-6c76-4868-a1b9-7739c0b76bfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.143.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60d3a87e-73c1-478a-9343-c694deeeb844", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.143.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60a9fd50-685d-4914-b24d-f829d279c7b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.143.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--916aebc5-be32-46f2-a4e1-1b5d4f734aa5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.176.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e9826aa-0381-4c6f-b687-2cdd05876a8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.56.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e6773d3-4185-43cf-b5f4-e8d666dec033", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.87.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea1d8117-dabd-4ab2-b44f-82b4481cee87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.11.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20c1d870-7e9b-42b6-9028-4e952c9df38c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.117.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75613fb4-9f01-4c98-9211-b671d5b66d59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.120.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--477b2651-238c-483f-a866-d239d9a54e27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.124.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c604019-2ad9-4a27-826e-74bec4d2258a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.129.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--722a9d39-f47e-4c6c-89e4-51c4745ff59a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.133.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfc31261-f8e1-4c4c-8e1c-c0b7d61dfb64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.135.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bfef6b7-2938-4d9b-9738-d610c2572c04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.143.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2d933db-07e5-458f-9267-6c1ccf148a67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.144.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--037a9adb-1718-4658-a369-0d7b0baab1b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.147.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--869b666b-6550-4e85-9bda-a3c844fb5989", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.150.255']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--977b0367-ed77-4395-932f-75915079f699", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.160.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e85582b-0c3b-45f9-bc81-293c0b1ad408", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.162.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27f5b52d-48f9-4f34-9720-334bcfc6239d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.165.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3230b48d-b5ff-4024-a1f9-54464b84253e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.171.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0939a326-4836-46bb-9abc-f09c0b4845ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.172.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90f46f30-072d-4a3f-8a59-4920bd58014f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.178.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e9179a6-9afd-443f-a7b1-2dd033e5dbec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.178.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8319c65f-d0bb-4f2e-91fd-5770d5141efe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.180.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6627fd0a-c560-4f8c-8205-6c7f63d5b1c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.181.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfa4a739-561b-4058-916e-486cc9ca806d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.184.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a2f4686-ea1b-43af-adf1-d697087c4a2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.185.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dacc00b-2a38-44e3-8b16-f1cdbce4a4b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.189.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ba13e10-2b05-4772-a155-6f493006e131", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.190.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2bdcd5c-9ba4-4b6a-ab10-70b295b24180", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.192.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0d585f1-003e-4aa6-894b-3c907a45330b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.193.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe125228-bf3d-4c6f-a5b8-38395be4569d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.195.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8c7c142-85c1-4fa0-b84a-1757cebebe94", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.213.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc08d5c3-e4c7-482f-b2db-ae7ecad10b65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.37.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49b248d4-a54c-4d19-9f5e-6a1db5d172ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.38.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0de667d0-88f0-4a19-b4b1-fe6c86478f64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.43.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a5ba1cb-9a4d-4a49-a5ec-39a7b7eba38a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.44.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d432ebe8-fb98-4784-8e76-d7832252859c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.47.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--257611fb-276b-4766-adc1-393fc8ee9c48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.48.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--002e5b6e-939c-4e0e-be5b-37a95f5e4d83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.55.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7544203e-76ec-48f6-9468-ac43a6794f80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.55.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff3c02b1-b40d-4e64-a307-d8e1ea36c558", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.57.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c162bcbe-04be-4b1b-91e4-d12f5458d395", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.58.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--319f2e91-bd24-458f-81ca-ec43f9d387b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.80.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--417ae414-b706-45ba-8ce3-375aeeb13427", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.81.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72b26bb8-712d-416b-9879-46598a6c5698", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.82.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd2fe0cb-a055-46a5-a4ce-ca80f32410d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.87.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64bf6d3b-e952-4efb-bde5-74ecdb332dec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.87.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c8804a0-de7c-40c8-8e5f-bfa51faee562", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.89.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ad5733a-dc17-4065-a264-0fd5f312266e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.90.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d726e27d-fc25-451f-8029-08ef1cf18073", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.92.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--301e55b4-73e3-44da-9c10-e0d8d4f781c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.94.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95268472-68ba-4855-881f-a442c76e187d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.100.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64970bb6-16de-4007-8e50-033db3083d4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.101.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b22c21f-012e-4fe0-be66-332e1c6ac8a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.105.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c725d272-84c1-4018-8334-33c785c64505", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.113.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afa673b8-251c-4d1f-8b93-3f2ffd5a547b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.114.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5bc7796-fbfa-4ded-b295-bcf696730b66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.118.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78c90222-0c41-460d-a3d7-143c2f060e76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.124.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f7cebb3-f435-41be-a981-8bd6529b30e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.126.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ba63d63-6d67-4a50-9d69-b856e77f4de3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.126.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--275f80dc-ef80-407a-bbeb-48eaa43d9578", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.13.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da9b5c64-f473-4f1d-b5e0-8bfa02ed391f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.141.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe044227-97b0-43bb-9265-c617b4c0c8bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.143.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb20a752-5a81-4cba-801a-265b91124341", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.166.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9442c6d-650b-4d0d-bee7-78b068f19500", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.170.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8e04f90-0c9b-40e3-8a4e-71f5fd188520", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.171.255']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51080415-b7ec-47c5-bc39-f1d32bc82dc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.172.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f9ed1b3-0a79-46a3-b651-b8440545149c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.174.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e098a1e-3146-4221-8503-9dc346ec046a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.177.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d1bfce7-8bcf-4c91-af95-2e04726251d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.177.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b650432-b58a-4a5a-862c-37ee87826927", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.179.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3516c4d7-2552-48cc-a9fc-c5d37c7e73b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.187.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f6e3ac7-fdfb-4a1f-af9f-73d39d1507e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.20.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53fad511-6709-4477-a504-c170ec70460a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.242.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2054aa86-0732-4ca3-9576-36aa1f93418b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.244.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbea968c-4d3a-4328-a131-d3842e1fd288", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.244.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34012148-44e4-427c-97b2-601ce9c1a437", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.249.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dab1775-a771-42b1-82bd-51b266192ede", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.250.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e88bec75-8829-4efb-84d4-b26bfb455459", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.251.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ca615a3-3a24-4be7-aba5-7bbb90658ad6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.254.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5acce5d-ea2c-4050-adea-598a789bd8c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.27.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ece4f86-85c4-4945-b2f2-f55783a459bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.28.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--881e538c-63a8-4f1c-8534-8731279771a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.28.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c05db130-1b32-40ac-a40b-b1baa0b32351", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.33.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--358cc7f5-6019-49dd-8008-32ddaddd791b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.40.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f155140f-a298-46fd-92de-36e8e7afb6ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.48.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c14fb1d9-3bc8-4bd8-8ca0-8051363d3ee8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.49.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--154aa3f3-a7e6-46ac-a5ba-8ca5d15a24cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.52.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54e33369-0034-4eba-8c13-c754ec811aec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.52.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06104328-80c0-4749-ba2a-30081592631c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.53.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0988a46-11a7-41b8-a6fe-3abe21d4d2bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.55.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d5be4d5-195b-4b2a-8dce-5d216d38fa5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.55.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--726f25f0-3962-4fff-9819-0a67504c8595", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.55.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa1536fa-d46c-4256-8e57-1df68a081b0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.63.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f1eeac3-1261-4348-a74d-f32c9ccd3e08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.68.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a1526c0-7738-4f91-80ff-4307f863f978", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.68.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd8c0dbf-9bc4-4417-b93c-26378f33730b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.72.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bb65455-adf7-4ea4-bd42-ec9c1cb74c9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.77.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2616f1fe-4259-4413-8d2c-6d5abd3c5456", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.80.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61f0a1af-9605-44cb-b499-81ca2b5f2c22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.81.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f276658-7c12-496d-91a4-b0625fa6c0df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.81.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de8a1b88-3d50-4a14-bd59-04161fd616c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.84.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70ed2cd8-000d-4635-89c9-5709d9ff8cd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.84.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa2ddffd-ffc1-4e81-a7f8-1939004ffc8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.86.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fa1faeb-d16d-4db6-adc9-7c416fcea86d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.87.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d79ee5b7-026c-4c88-9fad-a40a3ef4610a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.88.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c980803-6768-444e-a5ee-911555ce1a28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.9.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--854dda80-3f1b-4ea5-a058-bd56e34c0f17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.91.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77be6c07-b1bd-4c86-b857-647334917d72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.92.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb280676-745a-4cf0-a29f-3e8396503775", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.93.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0c249d3-2d71-47c9-8304-68cd9700924e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.94.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2c16d07-99a4-4b5a-b873-1404723fd2f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.253.113.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf17b066-3d68-47ed-97ae-fbbc76eb468c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.130.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86e18e5b-1aed-4266-bdc1-581137a86474", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.134.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e895c6f-663a-48a1-b75a-d506faa897c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.142.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30b73bab-a8c1-480c-8c03-1207a5110b1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.142.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c873795d-0500-41b8-81f2-9c25ad411a63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.144.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--080bc6eb-6200-40ba-be26-1ebb16c8aca2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.147.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f3748b9-22f7-4611-a7a9-ee97d54d9a2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.156.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bed64bfd-7471-4d6e-8994-f4de4c25b42b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.156.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9af1f86-3066-47e0-9496-0c1201f98bad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.156.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ad86559-030b-49aa-9327-5a988a3fd240", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.156.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--688e2ce7-f851-4c17-8342-d05d3b16f958", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.158.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a312305-d4be-4038-9021-c19bd3dbbd6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.167.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82575e73-cc0d-40e0-bbe3-d99af9a6b1ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.169.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7d93c1f-83db-48d6-afdb-5a0e01a78aaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.171.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ef1a397-c208-4120-80c9-3a951b0d3b1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.176.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--303fd53b-94bb-4a71-8b82-aa270e0f6325", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.182.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--617c16d3-1b30-4590-b05c-fc558919b371", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.192.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad0f093b-9adb-4c51-8460-1bc0e2862275", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.193.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d46e887f-cfc1-4340-a43f-ad89db3d95fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.195.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1184c09e-d303-4038-ba45-635611264350", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.201.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd4d4b42-16bf-4d61-b98f-4d66f4855a98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.202.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8da9d073-3729-471b-8dc7-0e5bdc6c3a93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.213.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16e5f508-00f9-472a-ba00-d887ac4769ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.216.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38af561e-a0db-43f4-8bbf-246db94f000f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.231.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b851f73a-d5b3-4220-afd0-adf6f0a8b3a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.231.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--249d542d-e43e-498d-8d33-df66752b16a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.234.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d335931-2a5b-47ba-80a9-06efc6c48e21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.235.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0feac671-b6c3-4384-a434-0ee407a5132b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.239.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--033e24e1-1b06-4fd4-9b9b-4d757322e442", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.243.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40e47504-0a3f-4dc2-a7b9-8dc72c8b7973", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.254.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98599d96-4f39-4fd9-938e-c97359e6a65e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.29.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ec091a5-56e2-4170-a9bc-ae4947461189", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.31.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84797526-76ff-41dd-b5c6-14ab46adc4aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.32.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a1b6514-fef1-4943-b714-53b9d98f477a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.37.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56ef7aca-1509-4daa-81ce-35ec4ee86780", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.39.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa31a5ac-eae8-4616-83e4-c32d743e24d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.53.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--445d3371-3705-44ef-92ec-394a1fa9ae5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.74.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7bd9f4f-8e4a-479e-b899-d0ea757057c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.76.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85094e32-ce6b-4217-9278-775c044814ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.27.230.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fb44d41-a450-42de-927a-5d1e09a1dbb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.74.26.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e62a19f5-f284-496e-926b-b169f7953e29", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.76.179.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45554e0d-59cf-493a-9117-054eb679fc8d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.180.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97da49f2-fdb0-4c79-adc4-d838f5ac84d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.182.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6135bc21-7e8b-4d61-aaed-a960f2b9d210", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.193.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--549ef6b5-d05b-45bb-8a82-41452760f618", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.195.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca0d82ea-fca8-407c-8cc2-2c453a60e5b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.195.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4a56f54-2630-44b9-a942-99d643c54ae3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.216.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--247ef457-80a0-4126-846b-5c34db10b612", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.219.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07122956-8970-432d-af88-2d4d72aaef4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.224.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6dca4f2-8593-41bd-93e7-fd23a9a9a05f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.224.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--840d572f-f82f-4477-8673-26e039d73186", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.226.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdfa4896-5f14-40b0-ac0c-869b0ab7f22d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.229.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f0a1eeb-b28f-47f7-8652-6daa38a79669", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.232.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2dc8c4c-2e28-47d3-9599-1a4eae8e58e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.236.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--771e4140-2568-4c5f-a35a-b4912c74b47c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.83.133.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3df86de5-8fef-4f4d-bf7b-213abdc80fde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.100.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26ae6deb-425a-498e-b41d-93c9e61c20b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.101.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a06a0b44-686b-4b6b-90a2-08b4755b7f48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.102.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25614578-4c32-4c96-8286-2f2bf1b5f1d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.102.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d80dc3f-5fc8-4b77-bb9b-83ee9e03ad1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.103.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45d2159a-6526-4d46-90d4-f70418ecead3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.103.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--941d26c8-ebc4-456a-a95c-d6ef5dfea25d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.104.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1e0082e-b1ae-45ea-840e-97f9366ed892", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.105.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c005caaa-1729-4b9d-8b69-09ede26828db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.105.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--050ac85c-92e2-418b-ad3f-40c57ae4cfd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.108.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3a611f2-af73-40d7-a241-f57dc944dc27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.108.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85fee3eb-88ad-47b1-8188-a6853c3fe11d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.109.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1431e4fe-e068-47a1-a8ef-049e84d757d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.110.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e494ad7-6e74-42dc-ba9e-0304ed53fdea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.111.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--feee5700-b74c-4c28-9586-345c19d70f6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.111.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--910291d6-eba5-42cd-9efe-30452c3c55aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.116.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f06c3a1-7a04-43f9-9082-af5210fda6f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.117.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6977d31f-a882-4d06-901b-2753b99caa56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.131.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1969a618-0134-4589-bd0c-a5841c6cf68d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.132.0']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa62b2d6-4be3-4888-9850-9ca4262e9f5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.132.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f07af25-c8c7-4ba5-b909-c38daa4cf2df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.134.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee2c6af3-5dba-402b-a8c2-530baf5c960b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.134.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1297c9a6-d510-451b-bbcc-d63066054ff5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.135.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--917e7e1b-4f83-48f1-ad27-7ff79bdbc322", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.135.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dad6778-1386-445f-9453-81f53963f828", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.137.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d89ebcb-4dbe-49d1-bc78-8715c56df826", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.137.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e04dec67-303c-4d98-97a1-3e4a3266b5a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.137.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5b2aad5-af8a-47d3-8b5a-130531a88234", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.137.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bd51134-ec3e-48cf-8505-1c14aaf99eab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.137.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5ee9eca-d65b-484b-9cd8-2cf935110e75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.138.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33b6c3d8-bb9e-4796-92dc-cae490414f87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.138.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e26a50d4-a4e7-4ab3-8580-7b6742abc6f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.139.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14e0ecc4-88bb-445e-a5ea-bbfd16c96859", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.139.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a6e2307-3ee0-476f-9149-6054eed30b22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.140.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30ef0f1d-a1b4-4d12-b115-a362ee648006", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.140.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed826b1d-d12c-4139-8fe9-54a127890b1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.140.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f05d922f-6f87-457d-8601-f4530999eed7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.141.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a677fb7-1af6-468c-bb9d-aa38f4cb9283", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.141.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9df91021-c29b-4043-80ea-9488d86f0124", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.141.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cf403f5-518a-4c36-89bc-1aaac84fda97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.141.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49e360c9-8cb9-4acc-8d9c-2042ccb9e524", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.142.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d805584b-8ca0-486f-9bfb-587f97a9af3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.142.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ce05063-36dd-4fbb-a102-70b756d178a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.143.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83122efb-214a-4952-8619-c9334291df3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.143.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dbbc355-4e98-43c8-9240-5e493ecc7a66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.143.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9897135d-4038-4489-b3b5-8751891bd8a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.143.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f6ad00e-0082-4f47-af14-49e36d741ccc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.184.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--067703b0-0c29-4f8e-92f4-48b564785a6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.184.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f605b90c-b2b9-48a0-8479-42eb2a97752d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.190.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fc861fa-e002-4d1e-bd6c-b3f6616c3e50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.190.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d011b84-7c2f-4748-ac7b-14da7d0a17c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.191.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0db53832-717e-4a77-9ca5-3a1978037147", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.193.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6a8dac5-83e5-47f9-9d55-4271d2b060b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.194.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1baeff9-ef6e-4f87-a2f3-028ca2e40e8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.195.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16119b93-cd93-4ed9-a92d-3c475513a226", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.197.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6e6fbf3-0511-42f2-a994-fc3990efb22e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.200.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f30397d-b4b7-457b-a5d6-7512fa2fb9e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.203.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--003a5c9c-34af-4513-abbc-a1be73f47fb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.204.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df5e2454-55ea-4cd1-8289-cf8f33ebc110", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.204.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86c44e9a-cff7-44ca-b581-47453762b6cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.204.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d955fa21-4b87-4eac-adc5-26185fb3373c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.204.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7ccd32c-6b29-4221-8f9f-33cf49f6749b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.205.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--041a9945-4d92-4136-ac38-eb0d88dd3fa5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.205.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44f9d190-1b26-4493-9f0f-76e7ed8382e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.206.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6a46187-13ee-4105-bd53-ec1953a91d74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.207.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b06ba918-ef26-4d18-a5a1-45887c823726", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.207.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8610be62-fc2c-4b7f-ac48-3e25971abfd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.225.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bf00579-6574-4778-8caa-20115cc59126", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.85.193.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a9ce0e8-6514-454d-8918-7cf41ee0b22d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.85.8.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d98445d-6bac-4495-9b5b-fbad210b8a07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.86.190.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cac8f436-4fb0-4fef-8d17-38d65a498cf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.86.208.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9962984-74d1-4b71-a34d-919c57955e75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.55.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53e14ff0-bbe9-4590-8c3a-7247d436b5ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.58.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e3ebd89-2dd5-4c8c-b94d-4584ba07c419", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.59.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b64a65e2-0ff0-4733-b662-5ba89306d565", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.7.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5362271f-49ab-4474-a2b7-da5d094d73d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.78.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2281d89-a183-413b-bb5c-cc99783ece16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.89.193.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1845788-1a5c-4346-9a46-19b12dca1fc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.89.211.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ed6bb11-fe1c-45b1-b90c-1bf8cdc34b65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.89.225.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6b289de-e28b-4b1a-b0d1-23a062fcee40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.89.250.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5dcdfc4-be84-4bfc-9dbc-82bc8d2e8c8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.91.125.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82a852de-4eeb-46c2-82ca-7c8c10083454", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.91.18.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb228582-a508-46e1-b8db-e45953f6a806", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.91.76.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e08b224d-6583-4780-9c50-8e0e60d3dc32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.91.93.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f10a35e-9d49-4ebf-a43f-18c737bad7b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.91.94.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef29844e-da9c-4be5-876b-26b9c483c3d0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.97.126.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c12c26c2-b4dd-4420-b893-18e41aa9e951", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.99.208.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edb96c6c-2235-4707-9d13-85682edd364a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '48.214.144.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b874ca6-34e2-4049-b470-646f7146125f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '48.216.208.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--383a432c-9977-4c5f-b218-17a84947a9f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '48.216.242.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a18e0e21-1402-45ac-a957-b97048ff4aad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '48.217.233.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71fa3cdc-0d06-48b8-97b8-f46d4abdd2b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.163.99.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84fa30ce-bb53-48f0-a907-b879ea139e71", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.207.40.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73a56906-4744-4b67-b4c8-f881d7bba0d6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.229.102.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf40cfed-6189-461f-8aa0-11fead06e0bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.230.218.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6efbb0b5-e68b-4233-a6e2-37691aa582a3", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.43.40.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--067fe6c6-e3bc-4edc-ba9a-d76a09981fb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.243.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--537a656c-3fd0-40f8-8207-5c916af363b0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.64.169.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41243874-5876-4cbb-b36b-896a16d1a27f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.72.221.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2310d97c-385a-427b-a3d3-42c088ce03ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.10.228.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a233d54-579e-414f-9936-824c4bf79d09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.101.64.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd9964c7-1439-4590-a6ed-1a7fc38f1012", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.129.182.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2d81a11-11c4-42f6-8d44-8b5a7f32ec83", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.135.173.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3344382-f64c-4207-ac66-fd8fad7f0a21", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.181.124.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3294841c-93fd-42f9-a29e-c07d30741477", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.182.204.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a439d08d-ce51-4c7f-9597-a8af2ce5dfd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.187.35.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f4ad67a-fa7f-489a-a835-3caf4c503b66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.187.35.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4a421e8-56b5-471a-b08d-87cb48624d5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.188.206.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--561ef2ff-443d-4713-b6c9-45daec635cd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.188.206.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f4f0f42-a66e-4cdd-bf90-ff67340ac694", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.188.206.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13bc894a-0342-43fd-bf06-a3b6d9843f2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.188.206.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e09c3b6-d122-45ac-9da6-3dec01187649", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.188.206.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29b567ed-13c1-41b4-aa0c-7c929e37714c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.188.34.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a792c31-aa81-4ff5-9b4d-135c31b4e6c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.189.130.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c23d17e-b6ef-470d-bfde-1ecf60a7625a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.20.23.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c721f16a-36b3-433a-a715-b3b8f4b84bef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.223.67.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5abeafcf-8995-4809-937d-0cfa6d402cb9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.225.77.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74b0659d-9616-4332-a8f9-bcbdf75c0197", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02fff4b6-9418-43ca-b6bd-7dd0eccb45b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--534064f7-e9af-4fb1-9be8-5b5e6eda0c5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef2d9dbf-5aff-437f-8387-fe614518453f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eba14dec-cac1-4f71-b753-94eb3f4b9cc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebb1309e-9bf2-4844-9578-03d63e5c5753", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9af9c8e-aa09-40d9-884b-73a06e75c7ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bde6b93b-d4ac-4edb-aca8-ccef33000e30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--787e0a3b-b39f-40c2-ae1b-add007bbd6bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce7bf1c9-b083-4246-8df7-c05b40d02450", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b3cd962-6486-4f2d-9f10-507bd8f55ac0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0563e928-91e6-45fc-940b-ed6b87c2e96c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06d6ad58-79f6-415b-a306-b7396d969a7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3342c5a8-5c51-4ca8-b1a1-201634037906", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--766b71f5-4f52-4f3e-80eb-8bfb6872f8c9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.255.118.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58041715-44d1-4882-a893-eb554154f8a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.45.189.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c3a9a1b-d7c4-4278-9ca6-84e248258e38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.61.209.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dfd9636-fae2-4568-8a5e-4fd2be7d4e2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.61.209.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0861d00a-6e10-43a3-9bc4-4a5b26c6468f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.63.151.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a3abfdb-62b8-46cb-bdae-d44a59876325", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.63.151.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--893afcc7-a84b-4c32-9bd5-1d807810392c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.63.151.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e42e6ca-c0d0-42aa-8458-f2d73b596dfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.63.151.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8d3e0d5-7465-46ab-ab4c-7e7b62d60ed4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.64.186.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e43404e1-6bba-469e-8fd6-78e7c16a6b92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.68.133.1']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1880c082-44db-4fd9-8e07-5090e2666553", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.83.143.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0c83e25-048a-4f10-b07d-ae76c7fafe58", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.116.106.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4ee5b3d-fcca-4f27-a177-92b5b49b297d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.116.23.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3acd0c8d-5fe9-4c3a-8e3c-0a241dd603a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.116.26.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fce39bf8-99c8-4795-89ff-8d9cc37dca54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.19.163.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98aaab45-15dc-41e2-b4a1-ea997fd83451", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.3.85.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67fc2994-fa31-45a9-9c66-473d11e45a83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.7.127.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2624f98f-bd21-4782-be2c-60d65c30f1ea", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.7.136.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2591a68-967c-4c65-bab1-cfc19311bf84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.7.233.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5923569e-da66-45c7-8096-dfa7b54521c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.15.44.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3374ce75-9970-41cc-ade5-92d161cbb8e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.15.56.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03731f57-27ec-4a7f-a631-070e54596294", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.15.65.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2d2178b-85a4-470b-aeb9-e79e72b84cbc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.15.67.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ee3d7b4-6acb-4d65-8c79-2bc3b5286931", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.158.173.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13a256f5-1314-4ea9-98db-3916831d6cca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.158.205.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b08da49-541e-4320-8db7-fb2badeafb63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.158.205.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--040c8f9f-16c4-44b1-a1ad-54684629142f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.159.104.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be3883a0-81b1-4717-9c9c-6f840c8d08a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.159.105.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81249da9-48d9-43f4-84ab-9715f732106a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.159.110.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b85baab6-85ed-4d4b-89eb-4c7b52beb7a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.159.111.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0585bf15-d541-40b6-92ec-957886914bb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.161.192.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1145ef6a-d3bd-415d-a465-8cde1425574e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.171.201.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa48c0dc-41ed-485f-a8c5-9d21b639e355", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.195.183.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--182b76ae-9dc7-465b-a7d8-9deaa1cbde38", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.222.155.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97154995-f1ea-4a52-9f5f-6bf00c2b8151", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.36.129.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c6d8125-d684-4964-8885-12513c07f7f2", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.38.165.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6619efc-6520-43a9-82c5-a8bea3d687eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.57.81.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12ec1ffc-7833-4422-9fa3-b0e76597376f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.68.103.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c573a998-8b4e-46f4-b423-0cc027452eda", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.68.111.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdb15d78-0ec1-42fd-bcd3-6c0cd5228d48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.75.149.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77a18766-0ca5-4afb-9ae9-1730b3dd7c7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.77.222.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b53d6a4-15d7-42a2-a5d8-2c5cb2c634c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.79.177.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9152cd82-fd8a-4c17-8676-d9e22593f32b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.79.99.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f73555dc-3afa-44ab-9e5c-33396a1ce339", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.89.192.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--188406db-6fac-4a4d-a2ec-b8401826bfbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.91.111.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd840640-482c-40ae-aafd-ddc5f3ddf53e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.140.76.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33a0adc8-5a8f-488d-a49e-7e6d4a0de86e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.146.21.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf69c09e-6339-4ba8-9d6c-2e88a0caa7de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.146.21.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23509097-3ba2-4ac1-9c1a-59a2d10edde5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.146.88.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2994d02a-1b8e-48b8-84ed-9651f3650401", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.146.89.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a68d2c83-65de-4565-8930-392178b704ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.80.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41eed1c4-7200-4033-ba5f-de16d7eddc9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.81.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe88e856-2767-4982-a2a3-f8204a55cd97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.81.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27146e4f-8bc1-4c8a-abd8-ba6b7a2fcb44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.82.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f5a07b3-1261-4bc3-a1e5-1ffabe011119", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.82.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59fbab07-0e68-4d5e-9918-a537447533d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.88.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07d33ec8-bb70-4dfe-bdf7-4bed73a521c5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--129dc67e-5e75-45d1-b28d-f627298bf99e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4de0617e-98aa-42c1-967c-a5d4e429e9fd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d76c129-b603-4230-9143-5cadadb95f7f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4782bf2a-a862-4f72-a8f0-e6316d93c31a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--461a2bcb-354e-4a25-a7d8-fb8ee27362ec", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74c1a0a6-70c6-4f72-a061-938b4ee4f90c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2220c3e8-e405-4afe-b4c3-fa4992c54538", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d29301b-ca20-425b-83f5-99a705baa956", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9009e5a9-05fd-4fcb-8222-4842187001ec", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0b693ef-9650-481b-aa1c-eade18773fcc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--152703a2-dfcb-41ff-a07b-8f0d2d81fe7e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dcf68da-0eac-4786-bc3c-ee8a0886f8b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.180.146.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f88aa02-e33d-4ac7-a7ab-2ca8d41742ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.180.146.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5470c4a-3720-473f-a436-4544e33c3fe7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.180.157.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e997c6fc-c85d-4039-88d8-f3c6d9cf974c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.186.169.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d53531e-4aee-4b4a-98c3-db16e659632a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.186.170.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b784469-e993-480b-a8ca-51c81a6a13db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.186.171.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a675be4c-b013-458d-b4aa-c3bc86aca923", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.186.182.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c473b92b-0ee0-4a01-be1e-3a83fcd5054d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.188.189.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cc37c4d-d167-4e98-a95a-775e4ac48dc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.20.198.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5c68095-5723-4679-9a6c-49a2f77c0dc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.203.245.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b590cd4-2a39-4cef-ad8b-303a491d6cdd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.207.117.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da1ac49a-797c-43cf-bc2e-b08c7bc9516c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.21.227.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--286e4e0a-52f6-4030-aede-5db2dc16e24e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.248.43.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef93c956-0373-49e5-8837-47a9a18aaa4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.36.5.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bf46631-23b2-465c-b863-79ff6915a8ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.66.82.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cffec1e1-b6f3-4320-bb65-be83673b6c00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.87.242.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca8fe609-464d-40ee-827a-9a83b5f3d8d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.90.1.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5fc262d-49b9-46d5-8c19-80584343d4ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.90.155.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--346ba0a7-b2b9-4abe-a39c-b05c3a66b904", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.91.1.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8b93afa-1bf6-46c4-a8a6-3761f3a93828", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.145.236.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bd28d42-9084-40af-9d56-cc9dc3fe5ced", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.147.248.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7a53438-438f-4b61-bcee-662d937227b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.159.150.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9112e9c7-fcee-4d47-900a-23cd2d92be20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.161.202.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03fc7017-329c-4c31-a8b4-9c6698e663b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.166.112.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5336a65-9f93-429b-bb56-af371701d5e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.179.166.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c642f240-c8d7-41ea-8203-ed5ebbb7048c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.187.10.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bc4e5e3-7dbe-4a19-b5ec-dfdd30a44453", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.205.241.255']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a4c8a8a-0686-4a97-a12f-9c071082a54d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.226.114.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e7f7871-7320-4643-87c7-5b962d426ab3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.226.226.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ecffac9-1565-48d1-8bc0-cc64378e9c6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.237.205.1']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5002d195-a732-41af-bb88-978b2a91a117", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.37.10.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cdbca27-c13e-429c-90af-f9fbf3fba783", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.82.48.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--521dad83-fc55-4aed-abc6-81048d9b9958", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.85.125.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2eeec665-84a7-4c9d-a32f-4b901e0b861a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.86.2.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f902d093-e732-4c0d-8416-373b8016a0a1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.87.72.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a079f4d9-1b50-47e1-9bed-b80ede1c5035", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.90.205.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89e4895d-4011-4409-beca-0b5f039f01ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.91.225.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--457f9b7c-1533-4101-92bd-7d2e6eb8c950", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.6.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e59dcd7-4d5e-44f5-8876-f7d1626c2010", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.151.97.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45a3c58a-1976-4496-bf59-cd13910accc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.152.33.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf0bbcc3-774d-4668-b83f-80304b05c663", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.152.34.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7c4a8ec-4bea-4671-bfc5-90663803d3db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.154.211.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6624f70f-14fb-427c-8a40-b75b59c923ae", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.126.160.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c05ae1a1-6f32-452c-a494-67e17dae90cd", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.136.46.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d95042b1-304d-44b4-ac3f-e0e0bc08138a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.186.20.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb4167a5-ca1c-4061-a35d-1710872adb1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.19.105.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7208aa59-9f8c-4340-ba73-3b8f4080be8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.42.204.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1095814d-0b70-4db7-9355-d19984bddfe5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.42.237.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b9500be-fc02-4f61-8ef4-70ee8f3861d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.49.59.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b30fa78a-d98e-477b-9a49-ffce3ca8f0e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.97.171.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29e92f91-51f0-4111-a587-954c623ead23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.10.169.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c384c53c-0b72-4ef6-b3ea-3953f126b028", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.110.149.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3b84a75-b188-45e4-8f86-d5d158508f3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.110.228.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00363852-d685-4de4-bbf6-27b1b8d366cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.127.177.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40214543-5725-4f28-8de4-c7fc2d40ab3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.149.239.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--355e846c-1471-45a8-b970-7f61c0974b54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.173.111.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fe99b7e-1cec-4c5d-9ddd-2c837b169fe5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.24.152.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59fd3212-0890-432e-9e8b-34c6a151ba3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.27.31.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6db78fe9-dbc3-404b-93d6-662d02288c10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.31.223.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99eaf376-ba80-4efa-acef-40343e6c3a35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.52.101.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b69b272-483c-4191-8f74-2069069487b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.80.22.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07562aae-6d7e-4dab-b465-fcf06827b268", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.183.107.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--321ccc6d-5dca-4a3c-923e-06ae4712e300", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.186.142.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e35a4bfa-baf0-415d-902d-25f3b81691ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.188.247.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8060830e-3a7e-492f-bacf-7c5d58e1b6fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.191.125.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcacaacb-5386-400f-9da5-6501e99aecfe", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.199.224.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24b1e6ad-0a44-4c5d-8245-b4ecb2eaee64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.178.209.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b6e86eb-2416-4b3e-a583-09bb80477f82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.182.2.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e64d3e12-d7b2-4f8b-8748-4ad0cb484faf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.184.12.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5aa16e6-ffde-4509-9d1f-d0b595316033", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.220.189.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8cf59e5-3724-45a8-9ea6-d13e997339f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.220.235.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--987c877f-7345-4f13-b10c-265923de99c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.221.134.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab7746b5-8be9-4102-ade0-cdfee19dfdd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.221.207.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d3d6b53-9c01-4c47-a030-20afdeb90556", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.76.112.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--940cc451-cef8-4cab-974e-bd95c73b64f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.76.247.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c989230-e844-45b2-bd7b-c3a7809d162c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.76.64.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a10957d-11a2-4223-8db7-784196bb1896", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.77.88.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5e71f57-11e5-426d-975a-50fbe7f766c4", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.106.104.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1ff2091-6987-4d31-aaa9-0cdb9455f5ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.162.152.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f165bb5e-1513-45e0-8a67-34ff36192821", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.164.177.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95c4dd05-dd31-43c0-95da-5eaa5981493c", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.171.135.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3accba4-28b1-4c50-9d3b-a5dd28f0508a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.171.191.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ab8dfd6-ee5f-43f1-a80c-0de798be3d68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.182.85.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62e3d7cd-78c2-4b39-9aca-cd0d16f37578", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.210.189.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a109c36-2db1-48ae-b4c8-081db08dc213", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.210.199.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a652f27-8f69-4ef6-8faf-b79214910247", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.210.209.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91711d26-df49-41f7-a86f-2ee0452baa09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.210.246.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9743c628-12bd-49b8-9924-fbb12ac9f3c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.210.36.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c149b10-0e62-4207-b2ac-57088f34c9c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.219.16.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f5d8ee7-336e-4ef2-b894-43f018179c1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.72.46.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfc6fe97-6891-474e-ab64-6c6a7d9609e6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.84.187.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bb22698-4f2c-415b-8708-702c72eca409", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.84.188.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46a09507-7c6f-4af8-9fde-3855973e1cf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '63.143.63.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de1cdd8b-68ef-4b9e-8568-4c0370d6e428", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.186.254.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--407d5938-c896-4d63-8049-60a1019daf29", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.188.83.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66bcb84f-0b17-488c-bf63-54db42218b89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.225.21.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--612a541d-99c6-4f84-98a9-4749f1a529e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.225.40.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c73a590-2830-4aa8-8ad1-90f5d06df30b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.225.45.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbe4b31b-6547-47f6-b207-154bb86f54e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.225.8.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89f3b7af-d56f-4000-97c2-b69b2715e06a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.226.110.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d419c07-eb93-4c07-a255-28882a77c77a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.226.117.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d105a93e-f6d9-4e04-9488-3025d7f6ac5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.226.91.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc62130f-2701-4446-a277-b899f9d43ead", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.128.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--137123aa-b63b-47e2-867f-6827f93bbe6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.138.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cb689b4-89be-45da-b829-c3314bd2d82b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.150.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6689159b-7e47-4099-9939-e516c9b91aec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.164.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d361102-332d-4af2-ad46-3104a37ff4b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.45.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3093950d-ff79-4690-9c14-5587e304a7eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.50.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8698fa65-b33e-44c6-a581-8179edbcfa0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.90.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1446c9cf-9f4a-4099-bd55-b5c6dc30a316", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.92.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5476d9bf-dbc8-449c-9947-9bfec95556aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.23.149.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--705000d9-b656-4a0b-ad01-9e5f95559490", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.23.151.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71dce0de-df00-4680-9218-7385349b67cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.23.161.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c6c298d-50b7-4da9-ac14-00abeb63620a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.23.218.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0e298d5-4198-4274-92d6-333b3a90d07a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.23.236.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01a000f8-2e57-4e3a-8b3e-47aab6d04852", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.23.240.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4c1ad4e-24b9-47ad-b242-cd4efd69d41c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.31.53.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97e5e64f-7313-44d9-9782-0c1df44ee7f5", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.41.88.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d010cb5a-a0b1-40a7-ac86-096be18d721f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.56.19.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc6e59e3-5291-488d-946f-95b34aa1b69a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2150ca8d-563d-4b6b-95eb-220ca7c7e60d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa72fd24-c544-439d-b818-91a854e5d64f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0594736-8cd0-41ff-b5df-93698008cd1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cf21e14-29a7-43f6-ab7b-ad72820a5806", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26266c88-53be-44ad-96ef-2eb02380c200", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfcdc257-231b-4272-82e5-77788b73fbbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19ea5fd9-cd57-4a84-83d4-4c06ce937a09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91ca8d99-5e5e-4ccd-9603-d81abd6db7b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc6a8e5d-b4c6-432d-97be-0e7e14544295", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--703b74f7-bcdc-4da6-b31e-49745e053ba6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e32c6576-a339-4cc5-bae7-a212238c0e44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0241771a-ecf2-4cab-a04c-fb3c148854a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c432a5d4-0eda-4105-97c0-dfb68447932a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6c4afec-4c80-48e2-be46-407918a52f4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0573f73f-ffe7-4514-bd1d-0175f9cea6c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96a14b38-af73-41e5-9bad-4a2c890e324b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcb990f7-736b-45e3-b86d-e5a0c022a794", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc44a394-95ae-4c03-ba6b-dc0701312c42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57bc8647-669e-4b4a-a104-aac4895b9ad8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25ed4d50-c9b5-4940-9ea3-973d1f5de0b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--672a61f7-e5c4-4b65-be0b-2f301b9c754d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1777de4-ef47-412c-857b-f2df526a64df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4762155f-8689-4bb5-adc8-b53579462a83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25944f2d-a961-4827-bf67-aa011f14c906", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7b9da39-3246-4de4-95e0-4d4b9a295666", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9742bc69-1b1f-460b-94ed-d2b83e9c0433", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cfcc585-7f1f-4257-9b31-928e32fab88e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b1f1d06-c9ea-4d5b-92fa-85e1609f8390", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d74deb8-4a09-4dd5-9ce7-e77871ef5449", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bafb640e-0a62-4bec-a7cc-bfbd75a9fae4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5168e14-71ea-4e33-abdd-417e517bdf01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b63f39f-f622-41dd-a4a1-d94d833f98e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--772d9410-e6f7-413c-92f3-567d9c729c46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01443d27-20fc-472d-9c93-b8d380420d2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e18806a1-851a-468d-b519-8a1e30e4951c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e409e279-7d47-4209-a391-35b73ee79737", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9ebf7f5-16d3-488c-9b21-779ba4c85265", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a6b4e05-69dd-457b-9dd1-f46580afb173", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d017793-9511-42fb-b528-2e9a2a9f3cb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7b5822a-6c05-41c9-9d8d-e4758fa6a7a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6685a25f-0459-4b8b-9115-cf15bbb3759f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7ae619b-0840-4d98-9b6f-a65282364920", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e724aec-58d4-43aa-b4b4-43cd17df61fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad84c5f4-7c80-4f5c-a42d-a09a057df0cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d71b22d2-8d2d-4f84-ac28-29c9b8cb916c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--344127d1-9c4d-490e-b364-e7ba35d2947a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d7f4fe9-81f9-4e1e-8df3-70baf14ae9ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40a37d86-df9b-4966-af41-c0ffc94b31e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4db394d5-cce6-4693-8ec3-4fed039f01d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8620f7e1-5362-4be3-969b-f0b3f6658abc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fae489af-9ad0-465c-a81a-9f3f6ae2b4bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b2601ed-957c-4dc5-89f2-a3e5f39738cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8dd980e-b54b-466a-829b-2fdce073894b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9ccf742-90a2-469c-9471-1c13760ab493", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b318da0a-41b6-458c-befb-fd9d6e6ee242", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3407ea7f-ae81-47cc-ae52-401afc2a66b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d71ae09-3bdb-4d08-8ce7-07b5fc016f52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea5a2e0c-9433-4cb8-96a3-027f26b2cd66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8154aecf-a20f-4dc1-8df3-45464ebe3b2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc95ef00-652e-47e3-98eb-313dfcffb8e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ce93c30-df27-4033-a178-b9e7e8c5e351", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fb7c8d4-7179-4499-9d98-b7a9503c4e97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23cb29ba-da36-4231-b22e-40164c836158", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d39d42d-6694-408d-b77a-c73d3c3b169c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--476c0227-14cd-40ba-81bc-18235d6c49d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ca451f2-e050-4d8f-9b10-699110412b93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5abe533-ed4b-4d8f-8d59-e7d59cfb77cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b425d6c4-8983-4fb9-8364-2cf7464d805c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58d42271-de1f-49a6-aadf-a22a34408234", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a014c92-4801-4b3c-9d27-7d181a4b8777", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd33fd48-813e-4141-91ba-8e24cc02aa1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e48d569c-8472-48a1-ac67-593ea8ba053d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3548506f-c122-4256-a85c-4f34c94ae48f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--feac29eb-eeaa-48eb-9fe9-f8f726ee1f8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f60ec18d-e623-4c8c-9f4d-a372f4a67931", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b95938b-6742-40b9-b3f6-bb4a7f27debf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92b80626-6510-4e87-90fd-ed9e0f1bf31e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce6b4feb-0bbd-46d5-9aac-967878fd5eb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5580824a-0507-45cf-a8c4-0f38f419d199", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07cc5fd0-a6e2-451d-a0a2-671be74cb686", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f83c5e3-df10-4d42-8999-3ef833676ed0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02b20ff4-c188-49d1-ba68-a90c865f924e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9754631b-1a09-4716-a8ce-a46613c35d9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91122a14-ba09-4bc3-956b-a2c01be878e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5f4a4f6-5f44-4c4f-a32b-6f2f8d426dc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--242955ef-9192-48bb-a845-032070525479", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e773d80c-7835-4bdb-b6f7-c5d28e1cc541", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5036ce4e-b0f7-454f-8dae-d3b0e492b685", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dfb222a-3821-4b45-8f70-4afbad5f8969", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--901c4d31-2e97-43d1-a59d-fbb403bef9b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--809543d5-6b0b-4a9c-9d81-1fa735008317", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd021962-b926-42ef-8acf-5bb9c2c9ec54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5c3d1b4-5824-468f-a853-89095e4a039e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a48b9601-ed5c-4207-89c8-57be39def829", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd0a838b-ce60-438f-968e-5078a4e5e307", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4554145c-9fba-4585-a437-194119590cb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fdb109c-744d-4409-8a88-9ef915c78b98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45cb2c73-e26f-49a0-89fa-0c504a641e6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1a61a27-38f6-4fed-af5b-6361865b8adb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--059e22d7-22b9-4d48-bb07-063a2e33f48f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--765d8d0a-3d0c-4193-9dcd-36efc7634dec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e31c6ab-7255-4068-9b47-d7b63b8975a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6b5189e-d173-46a6-b33a-cdc277e4f7e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15c0c5cc-0a66-4b20-8743-1532237078f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99dc3f45-6ed0-473b-b41d-712be6f31eef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad64cea1-101f-407d-96e1-fa6193ff0cf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86de05d4-3e0f-4f2f-b7fb-1c75f60876e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f66350c8-e474-452d-8db5-8e9b5176b4c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2910229a-7c43-4fdb-a19a-7e74e44716dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82798cb5-839a-4fe2-9ba0-1bb621f1963b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29bfef9e-b7aa-41e6-9853-136ae27c55de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de77317d-dea0-40e4-b044-76ef219e8c49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92f40a84-8530-434b-a34f-9d627fdd2634", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3518113d-a78c-4d03-a8c0-b98626edd2b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e48677a6-0a5c-42bc-aafa-bea05e6bc800", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8ab4eca-7681-4efc-86bf-f20d816f4698", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c61789e-412e-4e15-80ae-391179576327", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5afe67cb-be05-4128-a211-13f149371bb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32e2212f-5aae-4101-8cfd-8276e189fa57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c57f029-b20e-4710-8db9-745f302af6e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2246a31b-6ea2-4004-8c06-28fb6709f573", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6c17976-0473-48fe-9a31-a1b84e5d27ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe4076b5-9644-47a4-88f0-995faa7062ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a83ecb74-81b9-4989-a27c-431df7bd319c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57080c5e-711f-4753-9a85-363594d8a976", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1921005-d77c-4fcc-896d-c3caef94e3b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5849a4ac-bcf9-476e-8fdd-da3a259ad13e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86f4ce75-1be6-4e45-a14c-31155158d1d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43444bdf-47a2-45cd-a665-b4a32ae854ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1077cd7b-68de-4f8e-9f0f-4fefc885ac1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce5f1d47-c01b-4bd0-b7b5-ab025c083308", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e7610eb-427b-4cbb-95b8-48281d3671c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fb9110d-b39a-4908-989d-d736b93412e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.83.43.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccb48058-fecb-40b3-ae07-9ec62ec412f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.160.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18a19b42-ba42-43a2-a950-2e73071d37cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.160.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2ae9af6-b993-45a0-9b8b-c34a5688b3d5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.160.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12d2c04a-5515-49c1-b162-f2a01ae1aa25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c6ca461-aad5-4ac9-92ff-100cb9740540", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91aba376-02bc-4b4c-9d8b-691e0fdc6444", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5041f0e5-d58f-4f8e-bd33-a6e6e9adfd94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce8ad206-b571-4d9a-80ea-53d65a564f44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6ddc985-8082-418e-8a39-509748cda39e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f52179a-894c-4b9a-89ca-db7fe14efb26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25b28a50-ce87-4bd7-ba4d-06a315708928", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a26f3072-558a-45d5-9f71-16610308172b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03e6d31c-7fb8-4d33-8a96-b9760ac8ecad", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d07e022-ee46-4e39-8c5e-489990b69cc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--648efea7-c080-4e5a-930e-516d01c0d467", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b1b93e1-f8c5-421d-90a8-712404983291", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5beb425-05af-4e51-b2cd-46bfdffe50f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8b20086-0f1f-42fd-b35c-1663dc122f11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3910bbb-3dca-4160-80ea-2ec6dbecc909", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3afd075c-b373-4aa6-911b-4901b427e3ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--204aa8e6-05d6-4c6c-bc82-29bf15cc9061", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db101f78-92d9-4a96-a4a6-48900ea46ca0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1d1647a-6f55-4970-a448-90c162ceca13", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ba8f7a4-4e87-462c-bdf3-e2c55da41c46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc080659-1d93-421b-8005-da276ba3a749", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03dfcffa-c5a7-42df-b7da-3076f253f0cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.94.85.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62c9ef10-370c-4dda-a360-aec839d88029", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86e5f9f4-de7c-4662-9a5c-3eb99450d67e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1d04a66-1b7c-491a-86af-6406f84f34b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--186078a8-6705-4e77-9b5a-3da204902c26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68e01a62-cadf-4e08-858c-d8c083b99c3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75b31357-697c-4864-a262-e0c2d6dc5998", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12a56fe6-b9f0-47dd-b5e8-fb22fc0a80ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2875e839-3387-45ff-bbe2-16e0d8a11b07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3314c071-9a40-42fd-8811-9609e4730ecc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17ed6d19-12a4-435b-8379-13fd478273fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a58e903f-06a1-4db6-b260-4fdf76333009", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2554a8a-6915-447a-9782-e163b4957433", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a0ef84c-2c83-427e-b7e2-795bb7dcb8ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37c04f4a-ceb5-442d-befe-e97e3eacd0d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--105939d1-1156-49ae-b074-d017950407e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e23417f-f88e-4a6e-abba-699b6da717cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--218b7a13-73f2-4249-9f25-06858fc469e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad7d9cd6-c68d-4c65-80f7-dd8509b04053", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5457333d-d8a7-4321-87d3-e742490e6679", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e4a7342-a3a3-4371-b613-690427161a74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0a548b9-a03c-42ab-a5f8-1c6d571c1702", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eed1d60d-f735-4d9e-a335-7a20c20b72c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--850af6e5-ea4b-40d6-a7d5-dbbc630eb656", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fee89492-04b9-4586-a648-7f15d42b75c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6692ee8c-7d69-421c-a82c-d6b0af2794da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--870f864e-8aaa-4929-a793-31567ef7acd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a18534e-a26e-4842-b70c-3b5bb3c54e5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75cc2103-a71f-4e40-b5e9-5d13e0010136", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b8813cd-b1f9-496b-9305-48c96e6c7774", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58e8bd84-9e5a-49f3-939c-538daa842ae6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c31d21db-00e0-455f-ad23-49a5fe36195d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0b54b21-1af9-451b-830c-edcdbac63b1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7def71b1-ad88-4af7-8477-9cfa7becd6b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a01af8ec-c481-4657-9002-e97b743b51b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc3988d3-3bcc-422d-8abf-cd29640e70f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--448ad064-ea55-47fa-864c-bb037c70dbf6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c01aae9f-915d-4fe2-83c4-9d5da40ad3e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b470d454-a5dd-44d1-9ac3-4f075ddf100a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4bf4133-68ff-484b-9514-d32a11fbfdd2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba895609-1b8d-4772-8cac-abf94c77129b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8e3cf8f-3339-4e7f-95f7-d34470a62bb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--527c7871-79b0-47ce-9602-65bd8d9d3d21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91f207a6-e83e-46df-a028-e9cda01d4678", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2171eb62-c531-4fdc-a5b5-d24a3f6a0784", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42d266c0-4abb-452a-9bee-83b4569268cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94e77991-865c-49d3-8c52-1db3e6f2ecda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07a96484-c9de-414f-a4c4-14e35dbd44b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da0cda28-f2c9-4b13-a4ff-00e2ab9996c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--820c99a0-473c-4d80-9b9b-c80f8ba77ca5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c538c0fc-466d-4c6f-bbfa-9c87456ee039", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91456945-151f-41a2-9af1-312d9f8ea844", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--253f4cc3-fb76-4cec-a66e-3cac92f11aee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6f548d0-198c-4447-8bc9-65c70bf45288", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e10b7a9-0ef1-4034-947b-e06c1d515365", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2e7e2ec-667b-49dc-98fe-f3265d13d348", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e488a59-c851-433c-968b-378c9154f8e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d4c323d-77e0-47f4-b902-56a7d4174a4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d52c0c5c-0ab1-46f7-973c-2980b22009ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23ee3291-cc49-4efc-ac76-03fc13120bfe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b193b4e4-a8e9-4182-9ebf-fd56116b1300", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65de927d-ac55-4c2a-98c3-ed1eb75a98a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84b72d97-d6c6-4aa6-9812-a0cd873616d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac542c92-6824-4730-b13f-c07aba370f9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7000593-9eb5-4b4e-bf32-8cdef19636e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--285a1b5c-ae62-4992-ab06-312ee1fe4eec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62622d8c-998e-47d4-a44d-d15c973c9b00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2278cc4b-8bc7-46f9-954b-c254228f2a11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a49e1f54-acbd-4d1a-9202-77f904b41ab0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c016f9e-ff5b-46c9-90b8-d6b02d0bf31b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbe3ba90-8e95-49e3-b6ce-0b1dbda19099", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f01a348b-7aef-4cf7-b20b-b573b2d722a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c59873d-8a27-4dd9-a552-8fd607408958", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8c47d90-86e5-47ad-8730-8521ea11a888", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fbf3fff-522d-443d-b589-eadfe93df443", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9e9a3ee-9054-4222-8b2a-cf2ae96ca24f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66516b02-4fb4-4572-8f1a-f16578425d90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3d2d1f0-a3d2-4bac-91bd-d2af3a88ce73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c208d74-96cc-4218-9818-9eb14110a1a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46ccf14d-a984-494f-b84f-5d03fb3e89a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--517bbfed-f89f-45af-8a99-306f9328e17b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d2a0015-4f1d-4524-bc47-b3528f9693ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8dddc71-1558-41e4-855c-88a60c195a93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04c79151-7660-4793-a5f6-a54ae1e947bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33d6e727-cd73-4785-9141-5af5eeffe56f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a9d612f-09b8-4a6d-b29e-c35e0c311202", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4052dfc8-9325-42bb-95ad-8429612b3078", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d99d2e8-f864-42c4-be00-2fb19256e778", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bfbff0a-f95a-4bd9-a073-07b778d98302", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77738561-d352-4b0e-a67a-50ea388a1432", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c47f73d-61e7-42fa-b38f-650f1e624497", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92fb5af7-3738-4ba5-8515-e9782c80b672", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae234572-103f-48a4-aadf-2a630088163d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74d3728f-9963-4a36-905e-a7a626698d31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3467efde-b7fb-44bb-a503-f07c6f4a922a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d9b3243-d50a-4238-9af1-9171c12cfc42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3687812-def5-4c86-aedb-5f1299e2b525", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c38cef1e-64e2-4930-8938-f61d14cad3fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4513a277-262f-43c3-8c74-c98ce071bcfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70233424-95d7-41e3-b67c-05005a166b95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec0be3e6-72b6-40cc-8aca-6166298bbe38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0500d45-2004-461f-b03c-cfb0d4d2cd47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3846ddff-4a33-493d-88f3-cc964cd3599e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--153d7f63-05a9-4052-bac4-25bd00943cd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa9227a4-ac5a-4048-8baf-74804e1d51f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7e43414-054c-4d16-b149-1f54c0339649", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed7fed18-5c18-4b03-ae95-33a15e39b0fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab97f637-6b34-44df-8c4b-7faa8ef7aae1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2696be62-1e8f-4d86-9260-352302ab66d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbf30a07-f0f1-4943-b0cc-22e84d3395a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--791a5a40-ee9b-4632-988e-a61d3f8fb95f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95199265-ca09-4917-a30f-3e33acc0c7cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4e14858-e11d-4324-b2ce-ab8e53cdfe72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5bd10c9-09f3-4c4b-9c45-d97ee243996e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1441d9a0-c123-4b2f-b00d-c0143890083e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d8d2e83-2b74-47ab-963b-2c71acd2602a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a775988c-acf2-4dad-95a0-bc5056ad910b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e78efa5-b333-4545-9e56-e2da5842c475", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fad2f354-9dcf-4f75-acb2-37de82b6e1db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a727e26-7f70-499d-a278-59beef299c3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7753ca2c-49fa-424c-a222-d8e6ab98cef5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5ba91f6-01cb-4b56-8a7c-74fb481f6ad2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e222266c-2610-4498-89ee-dec8a96ab743", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5987599e-e42c-4af6-baf4-c259edf18508", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edde8099-f96c-4c95-ba35-8ec67df17f4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7778f9f-ed5a-4eb7-a933-2450741aa0a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81cd4ba6-4450-4bcf-901d-fb5f6a6bedde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1962fc17-029c-4c6f-b599-0922cd5018ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68be37c7-1eff-4b41-83e2-b416e2148e53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--344e80c4-5d3b-46d2-8cb2-55913d8ef27f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--255ac3e5-e853-447b-bb39-814a1cabe671", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--601ccfbc-6d75-458e-a3cd-eb764fe92dff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44d22ef8-0f3a-455e-b2d1-a87b2069c0c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a08b1ea-f751-415c-8cef-eaed222ffafd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d466c85-139b-4370-9df3-5c7169cf71d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52c0a4bf-1f2a-4123-ae50-fb754daeaa09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a79fb3a3-f5d5-4966-9d39-a09bf421c7ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94bad397-cfbb-4cb9-8a12-85e3c7394fc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17b64ad9-1368-40d9-b3ee-e5537e53aef9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bab8e2b2-e0f2-4f2e-8841-69ed29697099", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86745203-30f8-40e3-8b51-5d7dd60ee60b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92c569e1-b07d-461b-8e7a-b204afee6321", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--837bc902-bb73-4953-944d-b081553470ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ff32d61-3063-4bb7-9498-95fa741feed3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7405d5e-caa7-4c53-9716-1bf570adcda1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbaea937-1a27-4e98-b513-62e262c62b9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--518fdbbb-95c5-43d5-b768-c4e5e24667eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fd1ee72-2f67-4f2d-805f-06a0060655f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8024b221-4025-4658-b59b-7b07df87b175", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffc6a12d-cac2-40f3-bed9-4f5db8bbc675", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--206af775-f4be-4cb9-b509-6e2e2ab02308", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8147fb1-75de-41e2-9cd6-bfc2c7412c7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d57623d-de0d-4a41-9840-021a673d9be4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a52f995-e7ad-49ff-bcb4-e37e8b551260", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f763957-5b64-438b-aa02-1dd9acc808ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a854743-6ff9-4467-88f1-4e0ea12eaa56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2f0395e-ddad-4b28-ab2c-50d370b7b857", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9ab6498-33be-4110-8d57-49274d6b52cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13c7d06a-11ba-4910-b80a-452ba613b3e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7151b673-a662-4940-a812-7000c37f453e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4cf22fd-9900-42ac-b8ad-a20c9f73b929", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6dceaf1-7299-48d1-aa35-e4a1f6210339", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83e081a1-68b3-4126-86f9-508ea612df00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3a4e90e-72ae-4611-9ac3-0d47bec1e02f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cc0dad1-7bf9-42c7-a495-5e2fb201b633", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--663cca86-f0d4-4289-9a08-d5cc599ef949", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--572eef9c-9212-4847-910f-c9d628083334", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8603ea85-a2ad-47e7-8810-a362be940854", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc53b6c7-62a3-4f7b-aee1-28f412b8d4c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a95e45d9-4ada-4e1f-8f04-fbf9e0d6a6ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.60.61.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f65cd56-886e-4639-934b-4f54be02eeb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.60.61.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91465347-bf0c-493f-84ee-55279cd93f7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.60.61.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef51d558-2129-4471-8ba6-cb4b9efe1ede", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0ca7cd5-e580-475c-8412-af0248097376", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--642a3241-3321-4828-9956-28bb2328514f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f9058d3-cff4-468a-82ed-57e966cff346", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52d630dd-3478-499d-a3e0-6c4c985dedfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e4f2836-b90f-4f22-adf4-eaa2ad7ba317", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8160dca7-e81e-46df-8c1d-278d1c1dc78b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35ae3902-a592-4c38-b499-4c03e510bcf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a6ecf32-6d04-4eee-b774-1e9b9caa878f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--999b5da8-cc8d-4417-b282-a8c47b82b176", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fafb569-a2c2-48ff-979a-c9f95cc4683b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a07607f5-186a-44c9-b0ab-410a46b0b94a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef9dfefc-b835-4d95-9a50-58315c29a83b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7985bcb6-56a0-40cf-80c6-d29d06b0758a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b361f9b-9e60-40f5-ac84-bf0e22d19b84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0ef3ac0-735d-46e1-afa7-caca03cc5d8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--720dff46-b23d-4ba4-9aa1-7bfc618abeaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dc3dcfc-60ca-4d26-ae95-66d9a01999fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df240f4b-7c7d-4631-9289-39cf08928524", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a59672e-4a88-4cf6-af97-63b8fd2c4336", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa032931-7528-4ad1-9a44-1b021e1ceeda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c12e25f-8761-4521-a4be-75b8882710c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c79a7e2-47ce-43cd-aae9-57ee00ad6dbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78b227ce-a437-41dc-a1ef-0798b3292d01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d81d79c2-5043-4881-96d7-2f3e258dc26b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33ec208d-a39b-488f-a634-8399421fcc80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--465f2d89-d81f-41a9-8828-aaf22a352c66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8750f59-0df0-4ceb-a51b-3df18514d019", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98611d0b-89e3-40b1-b7da-40cfdadb6fc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d1698f8-64a5-4130-847d-10b7acfa0a71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e85ed528-37c3-4ac2-bd8e-905adf200dec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--566e90b9-1e9d-4389-a87a-582fe53be69d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e8f55cb-e248-44d1-b44b-5a242b2d6716", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8c57818-5ed6-484f-a2a2-9e293c855276", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39dd31f1-8e92-4674-9596-9de6f8a90893", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc8953f4-4ab3-4260-b347-e923db1852a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2834bed-e7b0-4f52-99af-71f542f48a95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f09cbba-0e23-4e35-a802-76dd1822ee35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da336969-78ef-40d7-a13c-847ba3b74e4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc5675c4-b4e5-4608-b5a2-2d4818ea1443", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d2bb719-330e-499b-a068-7081bac65c0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ff8d8e3-3101-4bc7-a611-07ec9d7710b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47d0f897-9af1-48c7-b96b-b2f6cabad8c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--778fe931-d417-44cc-b2e2-e6266367fefb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b10bacc4-078f-42b5-9d6d-25338a9f4891", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99bfc855-213f-49d2-bd79-68752957fed3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1f5b6b6-607d-4ad8-96ac-a18381da6dd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acb62116-f694-4400-94e6-685c2dd113ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--591be1a6-31ce-46ec-a7e9-d362008704da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d321108b-a6db-4e1f-94ee-2762804579b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83282d71-89c4-4d38-8950-2543b79a1615", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c773e362-f6be-47d9-9f8f-f9cee161c99a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--accbbc7a-4365-4c5d-ab93-59b9e944c4a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--295afef9-675f-42f0-bb7d-f209ac0764a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da08bb07-f75c-48ee-bc82-b3ce3fd4a71b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--649eda7a-d75f-4a69-aaa8-bcf78f50e577", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66b70192-450a-4862-aea9-672a7035cb7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a5ba6cd-f0e2-4732-b4b4-e6203504d5ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88a6db54-30ba-4456-8818-2c118bde8a22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9c9ec04-a43e-4de6-bbf9-75f7b3565d01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d531d60f-cc31-4a1a-8af3-bc2da9dff9e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b736458c-d9d1-4fd3-b6ca-71e4fbaae5d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3c6b66b-4d6f-48fa-bcdc-9779d1c2a377", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dafc86fd-ad0e-4a11-a77a-9565151e994c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a2bbcfe-3984-49a6-9990-fac6612ad094", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--616044f9-b2b4-4a5c-8424-5dd9ef085050", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f6e2d64-ac8c-47b9-b76d-c0889a5f5bf4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--971ba8e9-742f-4623-ad77-4265c24201f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--effd2322-ced5-4835-9caa-3d671e6d8ee3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9375e620-29b8-45e0-9353-61570e96d8f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c7860a1-2b7a-4a4b-8247-29a2a15502e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--487ff3c8-92b5-40ee-9a0a-f0ea5bbd0372", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6fb8988-c5cf-49f9-b7c9-afba7c3241e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0bad849-af2f-40e0-804e-1c65d6a76fbb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--885396c7-bcf0-421e-892c-4ba3158e83b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--240ff185-e7b9-41c8-b41c-49cbb1c6c97a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6901e27f-808a-4a90-8656-dbaaf057cba4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--268fbd22-e9fd-4e0f-9c7b-bcbf1df5b3e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b3416e5-170f-42dc-8438-625d16419896", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad15821c-9d78-440b-9f6c-9971a912c0fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b6e3a05-5c90-43df-ac07-a65965c62474", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bcd1c1b-54ae-492f-9350-11c3707ca31a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7d34d81-206d-4d57-87b6-72e96b9e2136", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e028884-dd7d-4cb9-943f-b2b52351a7a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a4d654c-d0dd-459d-9649-905569956097", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a834782f-9b50-4fbb-bd2d-0ccf55e441c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3610a454-e45f-4e2a-9cce-4f17559b46d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1623e82-c090-4889-8086-5d8a577408e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7259adb-b392-4b93-911b-7dc0d950a033", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6ebb202-7eea-489f-844c-f0946bb10d9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09c33b63-8d7f-4ff5-ba55-9081d61160c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33e3d64d-dd92-46c8-9f63-33e6da742693", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c25ce4d6-388a-4d36-9847-151aa9904c1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0c50cba-e0ae-48e3-aeae-21667720da55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9e0a792-77d0-43bd-8bf4-cf553575d33b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94b4db46-e661-4442-84b4-3c6ae98d20e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad83c0de-d3f1-472c-a9e0-8d7c773ffe2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--674f02e5-128e-4e81-a922-c60ef845a31e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53e9ea7e-fef8-49d3-8b08-f7093ce7b0aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b595ce2-5ec7-404b-a594-1b26c8237c3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75b9eecf-6de5-4272-a0c2-46bc82b410ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff819e40-19d9-41ca-ab5a-dcfb3b38ff1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04e87238-8cc0-4ec3-bcbc-0cbf30e7f28a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37a1cd5c-8ef3-4e3d-9a0d-1d30fb3f50ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--907aac52-e403-4458-a6d1-fbdc975f28b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--830e2cae-f88a-4144-b010-16674111736c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5a664e9-92b6-4d17-b49a-762ef304a5ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f826efd4-c22b-410b-879d-b254a6958182", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74875cb7-6eab-45e2-a223-e00521623d6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6f90620-27e0-4196-bc35-f6ed0a08cc96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--886e9086-cfb2-44fe-bca8-84bd09bcc495", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--015baeae-e9f3-47cc-a203-835fe85634be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8393599-e573-43bc-a3a3-1e0f0c2d169a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0095a83-bb1e-4f68-90b4-570db3e26a4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b1e54f9-46d8-4acc-9d35-25b4dcc60f93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d55a7013-0b01-492e-b01d-8ba2fd7244bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae2656b7-a0b9-467c-a7a5-bd9de013ee59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8209d129-8b0c-4f88-9cf2-053f13183346", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d880709-04dc-46f3-bb11-33b66aa37a24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bc346e6-63a8-4af7-bc4d-7ecf24fbf6e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87b96c37-68b8-4e13-94f6-8ad43779434a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0683d36-05de-4a96-ae9f-b0e9da348d0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--184600f2-60ac-481e-b205-6f41ca51c497", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b57e7ef-5d33-428f-bec8-4a33c1173899", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6a9ae45-16c5-4a93-bee0-963bcbe70c52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d8e14db-8094-4129-98bc-a25d5008d200", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04c36f6f-231b-42c9-bc69-cee2f41d9fe5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--968384b1-a6a2-4921-a069-0897c4c6b672", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ea68e50-bf34-4fdc-8f87-780bd5854343", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4a6e98e-69b2-497f-a7b1-6c24f243e00b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f1a0df2-b59d-4f2c-981c-7cec8f57e0bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a03f5d7e-6f63-47e1-a5a3-1ae123a1b542", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1444f5c-9201-4ccc-94ad-7ae327aa93a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8f476b2-ad4e-4108-8192-93d5351fba09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7bba666-1149-40dc-acf2-0b690f679ec2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e76d5a2a-c314-4814-ac2b-3271a07809b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6278950-8143-4c43-ae77-c140e8a418d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28aa9976-9953-4f0d-a774-6424d2c0340b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c82450ee-1dd4-43f1-b003-11ae9c524739", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fd39673-7ecb-4865-a454-c6b40669567b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca4f45af-62cb-437f-87fa-9232250d0320", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93d575d3-9089-49e9-ac97-0f4df0ba468d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb2f9f3d-2ef1-49a4-bae5-517c36b5452a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f60e7a6-353b-4369-a8b2-9b8a2478561c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d1870f2-6b48-4b84-bac1-3c1fea8924ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a160e07b-23c7-4947-801a-13c89d422eed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b73d922e-dbed-44d4-946f-b7945f55fe5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27fe5682-ba62-4a57-a65a-453ffa7cbd8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--523bd342-26bd-4965-93d6-440add100323", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29aacbdf-da5d-427e-b6e1-30a4367b56f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d61bc13-e4d5-48bb-8c7c-5896b4bcbd92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad5b93d9-1c6b-4a94-95c9-6e0737d5d15a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d5e85e1-0488-4484-b37e-3c81e1d507e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16f3f8bc-cc8d-4d43-b7a6-260dd5c8ded7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ce2ca52-d55e-42e1-bafd-64b7cc26a132", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f39d86d-5b1a-46c2-b9f0-21de91e791bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca62eca9-1d78-4cba-b10d-1f266c794e7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d7dab38-a4f3-4f64-b4b7-826e4b08d4fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cc973f4-09e5-465d-97aa-8101d9875337", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--297edf59-0a10-4604-a4dd-d61acedf6d11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fee75ac5-e6bf-483f-ae6e-3dba997737a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c710495f-b87f-4b38-9a6f-0032d89487ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4626463-5358-45b8-8070-d21f1b79f0a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--374c492e-e47f-46a6-897e-6a249cd07e0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9138211d-75f7-429c-ab03-88c0ba526ce1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02a965ca-8353-4b55-95ae-202f198a29dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84d75565-c7be-42d0-bc59-803ca2320d73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38363357-378b-4b2c-b209-85bb013a83d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f42a837a-3f10-4db1-903c-c148b3b3d3da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f332d1ce-c5cf-4edc-8298-67a46e7c0ee9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ea326e1-2dd2-4056-86c5-b18e18a22b8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34cf0efb-ddb3-4dd1-8021-b317c6e0d175", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b18c496-9759-45ce-9b1f-5c3cf94c87df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dae5056c-3847-42d4-a9e6-b173c442959e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--470d4037-9999-41e6-b5a6-a110671b1917", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb23be46-e793-43a6-98cd-68f1ea777607", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea0a2883-ee01-42ae-a895-d8ab8331036d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a9ffd14-337d-4348-bf46-b3a1127532ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bff71e86-7753-4c9c-90e5-2060aa85fdeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab98296f-2453-4f19-976d-b8550ff0963d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82c47f75-5480-47ed-b12e-2e89e39c4cc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e09363a2-0595-4355-a03d-9c19b4c2c754", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc5e47a2-8ca1-4b49-b162-4ea687668e08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fa131cf-577a-4553-8d27-7a3501b74b56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b72c42e-1f72-40c3-9a5d-d24c4d125ca9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--697a7176-3e07-452e-aa6f-745605a16233", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e957ad6f-5dfa-4d1f-b786-568033d71c60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c434cbab-0e1b-43ab-8ba1-763930b10919", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5838f1bf-0c7b-4b99-b7f0-ca6a1e5cd8e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebedd33a-3538-4622-91ab-52ccd049b429", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dd64461-c113-4a75-b67c-52c1a16ddfbe", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--840febe0-65c3-4cd7-b1a5-47131ba08d8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36540227-f6e8-4642-b5ef-b51ae75a1fc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3f64a3f-9dbd-4f5c-a8c3-cebee43dfd91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7195058-0520-4e87-b4a6-23acc822521a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ef3564f-7857-4f6c-a3a0-64cedacc4934", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb63bf75-40e8-493f-adc1-b368aeb23521", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3cb259e-e108-4a03-9279-f4f3cb64e642", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7144492-a9e7-4ed7-844e-f51e4169cce4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3822e06e-57bc-4603-8e77-2b4a0a7721f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86803d1b-d420-4164-991d-1369670ba149", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--160e6142-f41a-48ed-b6c1-2b296ad0d7c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c878ca82-9276-4a53-9e82-13677fa43c31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ea8afd5-a482-4227-9bcc-1e8e091f6b80", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.154.107.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--227d5d9b-3581-4c53-810d-ab3acd14a35f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.167.147.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8066b52-9809-4b06-b762-6ed40fef3f88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.175.162.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f9c97a6-2ce6-446f-9345-c5ffed5c73fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.175.211.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a746d5cf-227c-473e-a5e0-d644b401a865", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.175.213.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ced11628-34b4-406f-ae68-167509cbc2d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.175.220.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ff5709f-62a5-4469-8fa5-75d98b3e1d4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.40.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1439fef2-135c-41e3-90b1-a609e08492f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.42.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fef129d8-78eb-4fb3-a914-d45121120a9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.53.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e49c3372-46b8-45f4-92c0-2ccea46324d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.53.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33515414-871d-4e93-a123-1ffd29bd20d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.53.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f93f51b3-667c-4e00-adba-7dc962453514", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.53.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc0e4640-ce11-4998-a5d8-ead711c235d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.62.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40fb987c-cc3d-4580-98bf-9bdb4fa9fc0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.234.157.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1659a1a3-32b7-4de7-b8d8-181431fee783", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.192.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5604bdb-cfa0-45bf-b22b-e22e05da9d8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.205.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--947a7006-d80f-44ba-9c28-b7e6f08ea22e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.223.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--159808c0-96d9-41ab-a415-bfaf9424858e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.223.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--770a02e5-3ac5-4f5e-b9b1-08b22a0cc18a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.236.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2954e006-634b-4eba-aae1-68992ee1dd57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.236.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f3e2a70-5d47-44f6-ab45-04c5c53089b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.236.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e8fa95a-5bac-4d5b-a2f3-2987f327ed32", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.75.1']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7685588-68a8-44f0-a0ee-425a2a5ac0d0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.75.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6359a434-029e-464a-944a-b6f02ae960f4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.75.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b85f8d2-1890-4aa5-9da0-f8384bdde05c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.75.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--687cdd18-2e90-463a-8882-7004a48b595f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.75.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd834103-3a10-4a5d-b1da-586dd9b7fdde", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.75.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99f7713f-8f16-4d0e-9175-2eb2bbc87cd2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.75.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52799475-8a69-4ab1-962a-1125fc6fa291", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.9.160.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ed6222a-cf76-4267-89b5-928e25c0965e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.9.160.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a0688c0-2f67-4ec5-b415-3b63a61f0ec5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.90.98.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d06252e-023c-4164-aae4-2c8e4382221a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.102.7.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--243ea716-b7b3-4f68-b095-96b48c72e580", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.161.45.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a76db66-8214-4bf1-ae39-a559cdc48178", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.201.103.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78f1945a-b98e-48a4-8b7e-7618bcea5bc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.205.145.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04abd59d-aa2d-444b-9ee8-186a09620ce0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.205.178.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e67dbd8f-0157-4df5-bcc4-007626525bd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.207.87.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee68a55b-62c6-4d31-9ffc-aa6009d8d76a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.207.88.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c90fee1-9cf6-4faa-a5c1-f68bbf395291", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.11.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aef2032f-b1e7-4e34-a084-f56eb9059411", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.120.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d87274eb-4f12-416c-aebe-943eb278d054", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.133.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ea6debd-afd7-4ba7-b104-c17f7d26d109", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.14.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c36468b-f59c-45db-8a66-c38d51e131dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.144.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87d6c0e8-b8a4-4c87-a352-382317f0e83b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.180.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed702255-894d-442f-8b15-57ab58a7e05a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.193.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e697818-7997-4da0-8b87-034e789f5b7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.202.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad577447-3a7c-4d3f-98a7-a68f59536918", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.229.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22366ccc-f1ef-426b-ab09-92ec874991b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.40.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdc21351-e9a8-4be9-9f57-cd2c1f2326d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.42.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d63290fc-76e6-44cc-9a47-40401a68e559", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.44.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f468bad-d1b4-4d5b-956a-cffa3972fe4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.54.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb8507f3-ddcf-4eb3-ba9e-1b19c331827d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.220.171.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c35e79c-65dc-4381-b371-1c900f564ced", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.235.37.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64665dc6-c82d-4f76-a489-8d55a3757ad6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.235.52.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea1f4d47-6570-4683-893a-5f93ada1580e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.235.52.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aca793cb-4b81-4ef0-8108-63003da36c65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.235.56.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fb1230a-f63a-479b-93b4-8bdf8d1440fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.235.57.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--049e7bec-fdcf-4f40-8bb6-7eb5fabb3c03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.235.61.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3cb5420-3bcc-4178-8c03-30175341080a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.235.62.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62a9ebfe-d1e6-40ce-8061-b07d859c0beb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.235.63.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--087ba77f-4058-4cdc-bc08-4e5cc73e6fcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.69.177.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--648236f8-5326-433f-a62a-22db1f1b7d0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.164.214.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01921b48-8d7e-4852-bda9-c8ff4c89d83e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.175.92.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec06c724-08fb-496b-a5e9-221526cb1db2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.175.92.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9974f2f2-46d8-4424-9ee6-dfa52b57a174", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.25.10.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--742f394c-251a-4f12-8271-7718d77e5dbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b4e491b-1125-43d1-9970-af0a8f2ad7a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe712c50-8317-4f9e-a900-371e4f681fef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--477b57d5-9557-46b7-9288-f82e0e31d2d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a83595eb-1f21-4c00-b28a-e9cbfd760eda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ef8d8bc-ba33-44f2-b002-f13f27788c34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4783a219-cefc-44a2-a8cc-9fecd4c6a927", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d749140-173e-4474-9c85-b1089cc9b7e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c934cd86-b4c7-4f67-bbde-bd2c87b97cb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a73b048f-db87-4b48-a75c-62bb8e8e1e02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c703d1a-007b-4489-9078-14b839a2b3cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6945b116-69f7-45da-93bd-020854224883", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3064df54-7252-48de-94b6-33b2f3ea25fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ef031bc-cd83-42be-ba0d-efafb0ef7f61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2261316d-73eb-4dd4-9af4-9e5d383820f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b13d95c3-a6d9-42ad-bf79-2a6d7d3f1513", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52c70879-c1de-4840-89fb-c6920567ff99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ceaed7a-dc60-417c-93c1-e625b5272fdb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1861aff-729c-4bbc-81d7-838d85396dee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58e4cb38-f161-4c3c-9fc5-a7099e11fc45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc97d612-aa58-468e-8a06-44cd8916863f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3e4bbe9-a91a-4666-9d2a-fc54eb6e6919", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3261f0a4-148f-465e-9388-742d6b2cfed9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eca88b0b-3eaa-4f3c-8263-8a9d093eccd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29cb3449-afcb-4bc8-8635-a9d480e1b7e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5fcc918-b8a0-4ffd-820f-9e56352d9045", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d0a6c04-7b75-468f-adb3-a0be47fe2610", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59850ac1-eb59-42be-91d0-b57c6809fc7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b48ee430-d287-45fe-b378-aa8311c85d78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ab0fc17-f660-4736-93ad-2b5ec0792c44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c70ef136-4666-4a67-b0d4-e42c5461fb4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62340a5b-405d-49fb-8532-a66eb9482c22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69e7eb12-7602-49d7-9872-138ee52448ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2378b207-af6e-4200-80f0-08fa8ab4fdcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df3abf18-d791-4043-9db3-6520d0e6ebac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aa61f73-3146-4b5f-8503-968dd887d7b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--721de374-07c9-479b-a9e9-372279e5bdc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94de079c-3415-444b-a3b9-44230f2eb540", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ef889b2-4291-4669-9243-2892e2df69f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3e9e10e-4d74-44e6-81cb-be2e6d0396e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--046dce7c-5efb-41ec-9708-73baf69c1129", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.161']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4c5812a-98ec-44b2-8b6a-69b01a12e389", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.163']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed1be9e1-3c65-41a6-9069-f59df9d19556", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bd8e6eb-a52f-4f46-a171-3a1d22600039", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a08872a3-70e8-428f-bc23-7df770eb9024", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9205c89f-ce96-41e9-a2a0-f5c8384cb636", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfd292ab-44e7-4237-b671-cb5e85f6a936", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8405bc02-cfe8-47ad-ba93-3207fffff9be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac1ecc2e-6731-4eb7-9dd9-253b5bff4afd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2abfc7d-de49-40eb-973b-2dfdc9832c08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1ab377b-8a4d-4f1d-aa97-3cc7aae3778e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e40c9126-ea3d-4cc1-8150-a82f6e81bbad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0aeff93-6015-4131-b3b7-809f26c3df43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41b6481f-82ac-45dd-a55f-2d767708f068", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b70695d9-b828-4a79-ac64-2db8c81744b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d940568c-5baa-4184-bb38-d3ca0f4258e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--623f54f0-bf29-4553-aa50-955a14fba66f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4b19a14-67d3-4cce-9f3d-243f6ae219ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e54afad2-ca5d-4f5b-aca5-d2326aac24da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8cd4da5-8019-4ad7-801c-56526e1b6497", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--961057b9-14a8-4a79-9ec6-c1a0b11cf54b", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfe4a38a-125b-41d3-bb08-1d275f79ba80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf9ac537-10ce-44b0-9b65-ae2fbbac3880", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0af89f37-c2a2-4e93-befc-e6b4259f37db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2bfd207-0c23-4698-8bf8-61bcee797c5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e05c5670-8573-49df-9711-9bd44c821bbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cd35d0d-86ff-4eaf-aae0-9b0002be0154", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cfc34b4-b1fb-4786-9292-bacc9def79f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ce93089-e1d9-48f8-9f50-c1d7f578102a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8e1ecf1-235e-4bc2-8912-6db74d44b367", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb71ef66-bbd4-4485-914d-d757103062a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d85a6418-045e-4e68-b5a1-575ea013c828", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fad2eb6d-b20d-4cbd-b11c-98175fdd50c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--513a2f00-71a8-4e83-8848-dcfd5b444ac7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86d42b7e-b36e-49b2-94d2-826dc0daa39a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9be3e2f3-987c-41af-8cb4-152ab14989c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ce52b4f-4a21-44d8-80d7-516765998909", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d7c41bd-48bf-4153-96cf-5baa97e3cb36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7044973b-461a-46ad-8c23-b5ea4097b2bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c858978a-7999-45a1-b9dc-05ce9c3c59c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99a95a72-5d9d-48f2-b512-a2f0b835ce91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28da78ee-ef93-4f6c-b9c1-417be1f523e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c3921f3-fa53-4723-9d4d-72c084f73fed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--666f54ce-5151-45bd-8d88-4d0ea03216cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a95e5f0d-bf45-4e6e-bf1d-60501e141736", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16139a08-0894-4dad-9514-65a4d18612d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb2a251d-80f3-4bbb-8bf8-298046776f35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c92251c-0bf5-4e8b-b08b-22bdf28cf935", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7350c00-41b8-4418-a951-f600bad01ab3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b5f8cfc-ce1d-463e-9852-035c619294da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--160f2a2f-ea29-4790-8c74-186267ff73f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d037bb5c-ce83-494b-bc6e-af37c949cb83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63867894-22fc-4f88-9f30-95dfb0079cf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--435a8ea6-d42b-45f0-bd78-a26a583b0f08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abea95b0-e4a1-466b-8956-581ec41bf19d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--847f70b9-58f8-46b3-a228-261426cd1e91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36e0c469-e004-4c77-a28a-a3af21ccbdb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba691e6f-6495-4c31-900b-54b4dafec45a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10b59f64-2f96-4198-872e-233a2a8356ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6f6bea4-e062-4297-a123-c2d5f281509a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8760351c-1cd7-428c-8f77-e9cb3aa34173", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28e5208e-f7f7-440e-bbf9-a630fdba7ab0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27df5ef6-1294-4e98-b063-d88395d3d0c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50c7412e-dfd6-4502-a26b-e807c43ba685", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16d5dc4d-e5ee-4838-83d7-66b41171734f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f79be64-87b1-4f02-a5fe-a827b28150d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--010d0064-6b56-44df-a46b-cf64510261be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aab613cb-a5d9-46e6-810c-a901f743fcc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7471a98-8c89-4af4-b8de-1960ef841a2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74522c86-1901-4a1a-93fc-d2895d824b8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea3914b4-6c76-4733-9f67-eb0af99303a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04049bcd-44ff-453d-ab9a-1eb8d3ccb2f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a108b4e3-e257-4b0d-9845-b0e596037b9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dacf780-4568-4824-aa34-5be0846f1c03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cac224bb-2e34-483f-9d04-79ce407f0484", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b609d343-2f7c-4430-9e7a-21338abe967d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f469882-4be2-46a1-87f8-2fea2d5f903a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cecc93f5-2f44-44fd-b73e-2e405748c487", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--534bded7-37a5-4d4c-a54b-3fb7c5ac13d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bf199bd-3fbf-42cb-9de4-0100f442804b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55aad2d2-c6a9-4310-a227-a25c56bc8a96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6406b0d-ef3a-4227-b27b-d01285bd2879", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad42ec91-5b70-449a-a85b-c565c03c05e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fafb2fe7-cdee-4d82-bd91-1d7bca074cfb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01047782-5439-442f-8d8c-f1f483153363", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2324e6c2-6f9e-43c7-b69d-a647a1edfaa4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc89029e-ea8c-497d-8e2e-4254f40cb9d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f11cda4a-a980-4cf3-a081-b59f4e4dc016", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b685e88-b4d5-49b5-8fc0-36798bf2e26d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae3c74d0-c1c7-4db4-a8cc-796bf6395d8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0283fd0-3e86-4762-bb4f-1429330dbe46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87460cee-97ab-417b-857a-d2dbfa59bf9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54a0875f-4473-46da-bb7b-a739b162bc26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ae2fe4f-7346-453d-8eac-40915adf119c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2128f7be-f79b-4d60-bfea-f23c522f14ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74e86fae-dfc0-4bc1-952b-7884f4168a8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c36388b3-43cb-42a6-b72c-526579d9dc51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e824cf7d-22bb-4ddd-8251-21e3fd31170c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b8752b7-4104-4b08-99d9-e9d44eb0a9c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49c996d4-4d4f-4d17-b8dc-24c165dc4688", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c85a4d4-b054-4bda-aba5-071dae048716", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09ab0ddf-a78c-4611-9b22-73d72026aeed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92f1a3fd-a15e-4276-9f5c-ca1b32114501", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.20.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10de3714-82ba-4f38-91d4-881c9c6d013c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.239.37.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c58061ea-e0f3-44f9-bb17-db54455b34ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d19ce2b-7ff0-4b31-953f-f74f057bb27c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da928a5c-bb7f-42bb-8792-52d0b0aa0ab2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9dd92bb-d84f-44d8-b2f3-d2507e7994c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bcd4ff5-bf95-4075-af2c-73d9c71eaa8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6c15498-0de4-458b-a426-ea017b289351", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7aa76ba2-3966-4cd2-9be0-50f251e12540", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.135.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d572991-f528-406d-8a9b-6662b6f39965", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.147.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a004639f-46aa-4155-b34a-397fe3b236d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.165.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c7cb538-bfad-40a8-98b6-27c8e8aaae3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.167.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2a0344d-d900-498f-8e4f-af91114277cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.199.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7239b174-0457-43c4-8ea3-d00a19d4f1f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.199.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--213dc033-695f-4517-b88f-1823815ecd9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.199.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c07f87c8-8766-4bca-900e-23c7c0c7ebe4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.232.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86425841-32b0-4454-a6fb-b7db55db638a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.232.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--caeba06c-126b-4b62-816d-97d2598dadd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.232.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c4317b7-27ee-4c5f-8ebf-451d5db03092", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.232.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd035c83-f378-444d-92cc-474f5d2aa841", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.232.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c34231ae-d17a-43c2-beee-ce5795b9f446", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.232.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09f51dd7-e498-4ef5-affd-51f33cf5955e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca5cc23d-c617-4cdf-a848-245fa06417f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.67.241.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c91e46f-7109-45fe-8468-90fb915842d2", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.240.125.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe3d4c30-f340-4666-8068-66c81e3a68ac", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.253.251.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffe46f0a-3926-49dc-8c42-7be8b196a197", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.90.84.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d735d0b-a2b9-4293-a6dd-7d7a8640831c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.105.62.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--294719ee-a530-455d-80e0-14b196a4f3bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.207.235.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1bcd03c-eefd-463c-9eec-b45353c25778", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.207.253.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7b312c5-13ba-4f77-a615-257d7db5056c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.208.185.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eb629e3-0eec-4027-9bc8-eff969026acc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.208.79.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6134e942-0ae1-48c4-bb21-5c2ab2aedb6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.208.91.1']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcea4700-bf02-4203-90f8-33d97e4a200a", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.100.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2e575e9-ffd7-4ca2-ae50-d4ace68013e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.100.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f54155f-ed90-4630-8801-b51e5b3bcbef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.100.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e4a4c0d-6143-4b27-aa65-c5e990efb12b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.108.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fed0e16e-0135-4300-bfc0-9e04ea89b518", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.139.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99717759-c430-4254-86b5-952c00f449e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.140.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adb4dbca-af90-48de-9b89-f228ab04329c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.243.239.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80e61ed2-b30d-40b2-89a2-78df91795a85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.244.5.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8256573b-58c4-4766-a7a0-6b401c7d15ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.128.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c94e8eaa-738c-48c4-931e-9fea183477a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.177.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18c46ca3-deb8-490f-94cc-005d43c11cf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.178.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85ddda13-87fb-4926-ad23-a317ab6d075b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.178.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af5ff636-ff64-4c1d-84b0-8663e1590320", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.192.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33346248-4fbc-414a-af52-9a3c2a29ea81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.48.100.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb241fc4-6cda-4468-87ed-4daa737cdeb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.48.105.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4313493-2984-47db-8d7b-a88a079688af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.48.165.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a8cc554-ed8a-4ee4-9b5e-0c04a530f2f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.48.65.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--062e0e32-1d0e-4b63-9b0e-2f1f2f1837b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.48.72.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52391058-c415-470d-8fa8-1984d8bcec02", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.228.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78417989-331f-4e38-8ea1-d6928a15bd4d", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.244.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec65d2fc-5022-4beb-aacf-82f1196c61a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.81.118.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02da3373-a35f-4e49-8bf9-d646ca60dd85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--053f2785-14ac-4ea5-a5f5-d72a29e522ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a9a516a-8d2e-490b-a54c-c7d0f8fd8791", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ab98924-7ad0-48bd-9559-05d90e3e62a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08f7b77b-d4d8-4130-81a2-86a3b03b41f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b072ad1-9956-4609-b36b-695456d99eae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f44316a5-86b8-43d8-bac0-3a5da5f1fe7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32e151d4-eabc-48ff-bfd7-a28c89c805a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c25aef3a-15d5-4fb0-80f0-2b2037400163", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c066a21-3291-4e8f-8752-af9eb7bec591", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3a0dac3-266c-41fa-9a50-568679c6f812", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c30cfe33-05cc-4a58-a641-ac566d5d3ddc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88b1d981-bd8d-4ece-8408-0e7e06d32405", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4fab777-96ca-418b-9532-9a87efd7a199", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e97026f7-aabb-4bba-91ab-6e65c5380a52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4968f45d-4214-4b44-beb8-75dd63fbfcd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02d1f2a2-6cfc-4d21-95ca-e6315e6ad496", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec294648-1ad8-4357-aa50-d7be4da36c6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--344d785c-0db2-43d9-85eb-e3fc76aca2a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf2720fb-f821-45d8-bd12-e4cacbb59d98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab512b40-a98a-488e-80e2-0e60b120c908", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1db4c9dd-a0d7-4982-8815-7c8026e5bd5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--436456d8-d0a1-4c1f-be8a-dafde1f126af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f0f698f-e6b1-4951-be3c-c7de4a355058", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--903b9a64-345f-4bfd-9ff4-bbd007f9868f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--926fdac2-cb63-454b-8d0c-4fa5ae13921e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d5ea210-348b-43fd-8a0c-bfd418f40418", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4c508ea-275a-4e5d-a200-7d229e633ed7", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '75.159.205.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5d8031f-4f87-4ef0-b9b7-2ada34e74a00", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.105.130.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e5a509a-d85e-4b33-a775-59642b98142b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.110.126.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c489a80d-a168-41e0-bb7d-166e30d48d2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.137.233.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0ae23e2-c5df-451f-b3cf-6eb5755f496d", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.137.43.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5052e49-8d05-4417-b9c7-15c50bc8d102", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.161.157.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--185c49d1-d175-4be5-83b0-65681d066c38", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.224.250.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8c8d9c9-2865-44c7-b208-6bb2bb2948fb", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.78.203.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--164f9af1-d86f-4e4a-8bd2-98e21fe3eae8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.206.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd61258e-a049-4b7a-9f8c-76b3e52cbc72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab1e3f15-e527-433e-907b-99a3f446e685", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afea2eda-55b9-48b1-961e-0e06cb48c7db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d8058f9-6d53-40f3-89df-601c1b96c277", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f596b7c2-3ac0-47d0-9e80-bf117e09dfe6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2344f899-5985-4d1a-8cbb-1864d2f1816d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30804179-b560-4e89-a2b5-ef9774a493d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--276679ae-8988-44a3-b5b4-625f90dcc73a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64060310-8244-443c-9f06-b63990e4786d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2655c0d8-743f-4ef8-aa78-b6395520db2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c99602b-b733-4ba3-b3ec-99f23578dea5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.118.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8366fbe4-dc90-4afa-9d58-05a4ce42c8aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.118.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d11ae53-7532-4e05-9365-0f678d115b27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bce5e330-a819-4143-9190-2068c4d1cfe0", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.96.176.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e416d5e0-c36b-408f-823e-b2d7f0821914", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.111.67.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f939fa0f-46e2-4f6a-97a5-c106c730283a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.111.67.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e678bae-5203-4296-8e03-8fdd5b9287d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.111.67.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2884f4c6-e9a1-4ef3-acde-d1bc3ef77efa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.111.67.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cb5c76d-93d1-4e7d-8755-e4f9fe42f39a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.111.67.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3df22e58-f253-4cf6-b1ee-57f6ff9ccd08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.111.67.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--760a476d-30fa-45a0-b2a9-fca5a86f3300", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.112.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82ff1ea8-79a0-4971-8496-62e3de2dc67b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.112.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ccd758c-a8de-447b-829d-505411ed74a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.113.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93dae356-404b-412c-94b9-d9daef2fd9df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.113.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5621bd05-99db-4c7e-9027-27f4ce7c1865", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.113.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3de9c2e-9fd4-49aa-8d94-a6da04da57a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b535b4b-6f72-4fbf-911b-7ef4f1c2632b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38e96e5d-d1d4-44b1-9b68-9d99d1e3a5d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53a107ad-5c0f-4d37-98be-ff25a8a09801", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25a0688a-50ea-445a-9956-b91ec4039b06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.135.12.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b877cbd4-3d1e-4c21-899c-449faafe70df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.155.64.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f431261-ae6f-4a01-948f-f5773e0d8a3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.167.218.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd3c3e93-d35c-4046-9316-aa361cbc9055", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.187.32.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50161a25-d622-4169-96a3-8979af730d0a", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.190.204.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48be25fc-6649-46c6-ac60-6d7ef8d6b2d6", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.48.19.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d355116-7069-46b4-89b7-f65717cceb6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.83.249.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aaadf063-2b5a-4737-a77f-30cc422d23de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e1b63eb-c5d8-438e-9441-ce7609dbc577", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdf54ec5-8938-425a-9d89-0a88c6f0b511", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6da91aec-82b8-4c28-af30-d96143d71c20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. CVEs: CVE-2021-26855. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--54da3dc2-921c-4e45-8e90-1b0e70d97a1a", "relationship_type": "indicates", "source_ref": "indicator--6da91aec-82b8-4c28-af30-d96143d71c20", "target_ref": "vulnerability--2fb7ed1f-1a69-43c5-ab5f-193d13a7f598", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--339e2137-5cb8-4d20-bf27-a6da60b58dd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.49.102']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2a7b6c7-2818-4d1d-8ec0-8ec4ea1b62c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.49.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ece6ebe9-5042-4a97-aa20-b914ee907a4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.49.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69d42c03-a89b-4fa3-a1b0-f5a8e1f31a49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.56.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a63577c-c7ce-424e-80d9-0e2af19d2b9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.58.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5856c0c5-2606-498e-9c31-c38672d04aa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.59.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f27e2234-7572-4266-b6b2-7b463c28f4e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.60.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--136a1580-839b-4d76-b859-c500421e705c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7666cf83-ce49-4e5a-9733-57a99dcdf676", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bb0fd37-3f0a-4284-a39d-aa5d5b065392", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38db32b5-b5a2-46f0-b6ee-1873b7cd9f64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9359c4d7-3722-4087-b0e1-ab985779d916", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.131.143.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d477ceff-de66-481a-acdb-0d675de9f2f5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.131.24.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b168eac1-0875-414d-a5ea-c6c359f73b16", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.192.76.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92688ea0-8311-4e3b-a5ce-6a6edfc5b46e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.50.38.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e361f283-ea09-4275-8f60-d0fa28f6e0a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.54.204.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60967c84-8dc9-4ef2-a361-7d95170c1eb4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.6.181.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d66a09f-342f-46b9-8259-7b7a328929f8", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.76.58.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b459192-8ab1-469d-83f5-e094b3e26180", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.83.33.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--440ed617-6834-4d15-b730-16069b77578f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.134.159.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e3cd5b4-ce16-4f57-9664-bf901e58ae2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.100.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc639075-7559-4380-ba53-45cfc6194087", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.107.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27a00ff0-09ef-4108-ab81-b5157323b1ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.108.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27a8381d-1b3e-4b2a-84ee-f816e3fafb85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.115.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--800aa807-a01f-4ac0-bdf8-83c06c8bb909", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.201.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcd2fb6e-88e2-45f3-8725-6cb7051ffecb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.208.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--053bbca0-6976-43cd-b9d3-7ae707dc7eb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.211.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cea021f-4ca7-4c24-8b55-b51304488aa8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.229.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09e08a5e-87d8-4d06-9008-c5751034fba2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.231.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3af26253-1899-461f-92bc-a14ce46088c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.236.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e66ac102-fcdf-4ce3-985b-4e015ad870c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.68.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d0c5d23-850c-4fc2-a05d-bd7df4e26b2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.70.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00d755c2-d75a-4fd5-bbc8-ba30ac72eb23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.75.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d631d05c-b93b-46ca-8d27-be4e8e49498c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.77.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1c11296-94bf-4ada-b8c7-8bdcfcb14096", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.97.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03dc2479-cdc1-490b-9d6e-768a0bdab6bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.138.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d78a3bc8-4b63-4602-aea7-6c201fada872", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.159.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d3e2979-ed97-4758-8f58-e2b2647ef7e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.173.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfc6b1bf-c9f6-44f0-8763-b22917ee8783", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.21.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a26e130-bd04-4b0d-945a-fb4e806820e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.24.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a3b6b69-d3ed-48ba-9ddc-74d549c921f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.26.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9d069d7-7ef0-420c-b48c-94d0dda903a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.27.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbaf0a44-0c48-4145-b861-04a7228cac0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.28.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3902b494-692f-4107-bb82-b9d9a412b970", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.3.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--309a853e-37eb-4e05-886d-3ea4d2b75db9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.37.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b445ff63-d3f1-4c38-8fe9-bf49c486ed58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.42.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b4b2888-02e8-43b6-97d1-8c829cc27aa9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.42.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc9cdbdd-0069-46d8-bf5f-2549bd0b7ff6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.43.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--187745ab-136f-4cf7-a2cf-05dd0431c0c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.43.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9644d48-fdd0-4ea1-b426-c3642a335633", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.45.1']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0098b8f-2a3d-4788-ab1d-003fc9a207ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.45.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7458dedb-e286-410a-9f4f-31ade071592f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.46.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e8e30e0-d932-4e70-97b7-3a9edf6ee429", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.1.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--129278c2-ec3b-497d-b3cd-32c69eb58ff3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.12.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e12f676d-0afd-4b74-9810-b51d2e3953ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.12.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4246ee6d-a844-45a7-8731-583bce02ae84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.12.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca380c9c-7cdc-4b2b-bbdf-066cea8418f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.13.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a4d717e-4681-4fa6-b2ed-e4f0df110009", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.14.99']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b2ba82b-1c28-447e-bb5c-c4a48b4be2f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.15.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e6c9654-25cf-422f-80ca-d240ef61d6c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.16.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17fcb63f-518f-45de-88b2-964db7998887", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.16.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--230a6820-b1f4-4b89-8af7-ca5c4991fa08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.16.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c3f537f-ba02-474d-8bab-ff1899753098", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.16.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf4119c1-05f6-41b8-be00-126e43d08b36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.17.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7715bd0-7c65-49d4-8a9e-7b7766ec8a6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.17.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ecaf125-6cb4-4788-806b-1bbfa8414d44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.17.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb8cc45c-151b-4e05-9614-cb7102316c53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.17.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7bc639d-0d1f-4a57-85bd-1295efedcc20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.2.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--750c0c1b-3b24-4776-bf54-5a057e586827", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.2.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7a5a16b-24e1-424d-a0f6-a2e37e3d7fcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aec5221d-4cc7-4a4f-bc4b-905b5d0e2441", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be01cff9-2ba5-452f-81b9-f29a1fde38e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--965f6fcd-61fe-432f-88e8-fe637a5c0a63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c937e1d-f631-4c92-a4eb-8b0232d602a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--110b120a-154b-4cc4-8d50-1af5489ca57e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c772fb91-1836-4eed-bab0-082b80b5bf46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6907af8e-62be-445e-ad20-ef75cab4d67d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac6e8f5c-b0e9-4f54-8c4e-fb0cb7166f1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4bd4a37-73a6-4be2-9cf1-0380619fd412", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cfa829c-0f71-48ea-9920-30bb3aeb21c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee670a6c-a53f-4352-b499-ac228e3ced18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aacb300-626f-4969-a75b-b32c7fb99355", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a403a7f2-980f-48ac-ad3d-101389d706f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8350e189-edf3-4355-9e9d-315f8562c39c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--519b1b90-d763-48ee-ad9b-338d99387818", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a48b6b76-e082-4687-a03b-23dd1cec62b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aac7ae9e-5788-4fe1-bab5-6bf3a4d79886", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ab09ff9-4403-4f34-a3a7-b111535194af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.6.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f3b6f64-8b3e-4b7c-9eb1-2ade5edd4dfb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.6.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bca56cef-aca5-4a1e-a46d-a767e255d82a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.6.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d0450b9-867f-4e90-adc8-cfcc88c7bab2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6e582d9-f018-4b57-ab5c-342c290149f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16d63beb-aab6-4fe6-b27a-2dacb21840b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7524994-6eae-464b-8f6d-cbb9cc140004", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52a68f1a-b2b5-4294-b02a-0f0a2e13a931", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dd90351-4a56-457c-b34c-22b9f9214d88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab2ee8ce-9f57-41b7-8f02-f3a0a4b1c229", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57a532a8-d686-4bdf-a8fc-2740f174bb5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.9.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07ada45c-f6ca-47fe-a756-eb2c74a74192", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.9.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5daeae92-6474-46b4-a4a7-0934fd0ba557", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.9.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c29ec1d-4fee-4fc3-9778-a22ff89282db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.9.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5dcc9fb-8167-4849-a55c-255e91461a6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.9.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fc92423-974d-4bb6-9977-158ed56bd7e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.109.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1980cdb4-2912-46d5-a265-196198392a7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.125.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63e27b1c-a64c-4d53-b618-ac9dea1933f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.79.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37a2aa8d-140a-4aca-b28b-41cfa47b487f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.222.135.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d889e05c-e25c-4901-8c11-0208ebd22b85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.222.225.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2795f9a7-a163-4023-a4a7-a904bdad1f47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.243.166.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3078b4a-d067-450e-8d43-096135a5344c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.13.153.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--215a462c-45f3-48aa-976f-38ba952f6416", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.179.17.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22bc53a7-b89a-4878-9b1a-f7d3a0906a3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.211.195.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49e3c9f3-ea2d-4b83-8247-766cc3fd0f0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.247.73.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--261496b5-3568-46e5-94cf-9d17d797678f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.66.83.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8369ea4-40ae-47b2-955a-e88a38523195", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.66.83.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1168dc3d-7107-4b3f-a7a1-92ab29a3a3de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.69.55.163']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--854bb284-9127-42d0-ae3b-3d232f74ff07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.82.70.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51b5a25f-7f32-4a7d-98f1-e04e4fd2ddf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.82.77.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38f9546e-398c-44ab-bf57-ed07d4c26d51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.82.77.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--832b726e-0ce1-4849-af8c-870699b96634", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.87.206.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b27307ac-7503-4ab4-846c-17b690c642d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.87.206.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef9d719c-081f-46ee-9ccc-6904714fc9c0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.164']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b3a7afd-6236-4026-b531-035e69136faa", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.165']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6917d264-8e1a-4895-94c9-c709b9363d0f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e67f26e1-92a7-4291-a7a7-4348087bea77", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--955a9919-107f-471b-a726-5712c229511b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f2fca4a-7afd-4890-a210-09c046cff642", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--115f68d8-f2e1-41a0-95c1-539e95e2c5b3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73fc46d4-a460-474f-b6b0-0ccf7f76c82a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfaa61f4-0555-47f7-a2f7-9557c7c5379b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f86b6b8-45cb-4e60-8e4b-f211bd92a9fe", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2485190d-c610-4cb3-89de-9fd4b382c881", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.95.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb6b40b4-dd6a-46b7-bf3e-f567f7b8a155", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.95.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab7c2365-2810-4aea-b5d5-e8a6e3ea6bff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.95.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b73bc0b7-5fe8-446b-8c0b-6d858278ba50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.17.99.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52583963-ecdd-4a67-aa31-6f4d98733e79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2b4a663-24c0-4e87-aad0-bf8033cb01b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42110688-d9cf-4279-b531-9725af0424b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0f5082e-d9ba-46a9-a4a6-4457bbe72964", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--511112de-2082-414e-9803-0928e7897b87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e0679b8-7733-4e28-922b-39d887e961b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3d7dd32-8e87-401f-82d6-9abae31f3472", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ecb8517-f303-4144-ae88-ab98671ea93b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--024636af-b5a4-456e-9732-64f4625d9f92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9539c7b7-5fbd-44e1-a6c6-b41902f045c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdd22dc5-bb6a-4f09-af11-72d6dc0d84a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b07ef83-0ddc-41f9-93c3-56af4961e5e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2394436-433b-47f5-b0c1-f935fedbfc2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64187a45-48c5-4404-ba0a-528fb21d68ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e698344-2d5c-4983-b535-87a711b0a15e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d632e111-2a57-49bd-af79-a659cd071ac6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--168e1981-4e58-4c65-b11b-3455f017ed77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f5d7e0f-43da-4d7a-b4b5-fc0e8163620c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efa8ca53-074d-4fb1-b28a-75d9578e6753", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c9922fe-c257-4d7e-a2b6-25ca27177a3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a69aa33-e56d-480c-93a8-0be489dda4a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--610903d4-dc53-40aa-8ccf-0bb2f2abd313", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07b6878f-faf5-490e-945d-fcc2679211c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--475a8261-25ec-4173-a867-c6dec141069f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--325a6ea6-c00d-417b-b761-7163dcedd9e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41c3ce68-dece-45ad-9e74-0d58d92a19d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7f91507-b793-4685-a5aa-caefaf724925", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc3fbe18-f0b8-4d71-998d-a82354d33698", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.96']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29f1e8ed-50fc-417a-95b1-77d5e8297da6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef5e45f6-06c4-4742-9497-2c2630711781", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e287c95-10b0-475c-aabc-1b7a79780ea6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dcc7426-1cdd-45e1-ae49-a71429564e73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c30fd006-2890-4e84-864c-55ec83f9255e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab4bf623-9e87-4b3d-8aee-ce8596878e3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b128b43c-9126-4fa5-80e8-336f4d73c246", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b91937fd-be2a-428d-912f-597d0f05696c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11ade6ae-5f4a-4be5-956e-a14176187f51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6523ed1a-4812-4997-8d68-7e6958478d38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--493f15f7-4a96-48b9-a18b-f4c266a3b779", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c9362c6-4749-4b08-bfe0-ba90e95254a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--441315b8-451a-4d85-83d9-fa0fa232006c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--871baa55-4aa7-4f02-92db-a86efd8e3adb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67d8f70e-cd13-46fb-8f89-b22a48aceed3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03971f97-d820-470f-a47d-d4752ab85e57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39959551-0649-44a1-99f2-c762bc268bf4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd4f9af4-2ed0-4bff-b12a-bd5a619eaeea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.213.175.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1286f655-0d37-4503-9137-55e1d4ab13ac", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.23.173.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63dfa406-bd9e-4575-8ba5-06db00a64ab2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.27.243.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efec2ba5-dc0b-40df-ac4b-3289b68a8902", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.4.199.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e272d9c5-8a38-4be8-adf4-9729c26d3630", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.102.253.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91e52fb0-6d2b-4b23-8f93-bde3962f1f99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.102.83.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7949591-a61f-4c0e-b2f7-68da765c8b6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.147.206.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f07eea0-15cb-4817-a4aa-1cbc6af76b52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.153.246.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f78e067-cfec-4f5f-99e2-51595a92c52f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.158.231.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2643f23c-66d4-495a-bc2c-ec1e8e81e179", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.208.22.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef01e6f9-1ead-487f-9ada-c8233b4880ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.110.153.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--040c22a6-07f9-4d54-9b0b-1730d0c25d74", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.111.76.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--010025b1-e1aa-4ea0-9221-5b2fb9a04f73", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.118.87.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f2d1a8f-c48c-4b20-9cda-9ca0f13ccf9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.118.88.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90a492a3-3c69-40ba-ac01-8089119fbca0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.142.209.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eec3d084-daa1-4041-aae8-0a3c40e9003f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.126.129.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27e53609-5c44-43f8-86ee-1d942dd76f72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.201.162.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bb86b41-d4f0-49e8-8b36-daf4aeba40b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.226.206.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2e6f412-85b4-4150-8b54-0f6fe93b9466", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.239.42.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fc364ff-8822-4c23-9f62-1a4940238e5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.247.147.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddc1054f-cdb3-4cce-9e79-18704a7dce8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.40.94.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ac98cca-6123-4a87-b397-1ce02cdab28f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.100.170.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3980ad6b-8061-4572-824c-43073080139f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2361a5a-9363-4ed0-a103-f3eac3495ccd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--523ea7cf-d168-40c4-ab4b-754dd91d1f09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3f1e60b-3cc3-41a9-8723-f39ef5e1e501", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.121.126.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6b70a9d-7db8-4689-b27d-186a18cf338f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.121.148.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--826f23a2-1279-4a56-93ff-c4ec7a1780b8", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.130.220.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9684c357-eaf8-44bb-92a4-095b321213f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.172.31.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73f9af31-1c74-4679-9ea7-49077cd4a3cd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99ec1dd1-6545-4019-b1f5-2c6e9bcebf9b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd12167b-128d-47d2-83f3-5c7eb78c56e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f4e01bd-e7ff-4012-b960-ccc2ae7ce6fd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b89a1c2b-92eb-4648-8f48-d4d459d61296", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd7fa1e1-6236-4e52-9db3-d006614d8f09", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--995afa43-43f2-42c4-bff1-df13bbf40f29", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dafb13d-2363-474f-9c73-e428871da9d9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b853ce6d-5d8b-4663-bd37-3816052c448a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f28339ff-82a5-4520-af98-e06bb88fe5f7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0fe1d91-6856-4d78-9452-3c4044af4ff2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2557604-45db-4476-89cd-82a8edc8757d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--718ddcf6-d868-4fef-92b8-61eff37a0c4c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--429ae785-70a0-4db4-b8ae-de9715e5c45c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--311a7b66-bbac-4a86-8d53-282aec6a1c2d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b977f626-9d84-464b-b3ca-c73d00c018eb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--390c48aa-a593-49e5-92a4-1cb4cb7dfa47", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b57d7ee-9f4d-4be9-aadb-99eb44cb8ba4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be3419bd-7c8d-42fd-ba68-25db0b1a4f3e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a3d8139-012b-4c69-b2ec-e6bd057dbe1e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0ec7fa7-3199-48f8-bc21-6b6cf30f2894", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab82ed73-56b3-4e27-924f-0cda33557453", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1aa47031-df67-4635-8051-8eaa90f72fb5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c75d91d-41d0-4ebe-8c48-ec945fefb82b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b406e5e0-39c7-4b50-82d3-c25770c71ad1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be9837b3-f1d6-49ed-9256-69ae89e60001", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae3fe816-04af-4d05-babf-9fe2edad2b17", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df216acc-8e2c-4227-ac3e-2efb6547b5aa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9615d46-7e9f-4340-a488-534c7f7a2729", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.215.181.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7128efba-5cf9-4ffd-a701-4e7ff511841b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c53e43a-609e-4558-bcdc-2301e01c83d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41613623-a69e-4a38-aa76-1e3dfe282204", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.0']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f74c353a-c5e8-4bb6-87fa-0aeb44f9dab4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.1']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38084297-e431-4e40-8a9e-be38e3d72f21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c625ecce-25b4-49a3-a252-083a5ca81a58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fe409ab-3cc0-471f-a3c2-3a4a8dcb17ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eff7248b-e2c2-4810-afe2-b2c83d5e2ac8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61a4d1d4-98f8-4652-b21d-486586c29471", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--caf033c0-907d-4b89-8a85-fcf38893b66d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e910178-5616-4ca5-946e-cab32cabbd0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba081c7f-23cf-4cca-8eed-6961c8043cb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93554704-835c-46b5-9bfd-9d84f546db88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8e799e3-fc89-4b03-b48d-48eefe5a45c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2014f852-9a37-4bef-a37c-b7b631309b84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32b7f7dc-3cb7-4b51-9e1f-512acd8a4ccc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cb9f81c-90cb-4f9e-bed7-cf2c7ff18f93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9b48d63-cbbc-40ba-9d47-3a144f785d5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--457aefd4-7021-4bcf-bfc8-f15a0aab57ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b46e01c3-3ea9-464f-875f-d4a7f1a29a53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f8dc68e-be46-4335-95a8-c52881001c6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd51f7e1-792d-4877-b564-f7182df5fbf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f17a614-a35f-4083-92b3-1b509cd76306", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f7b0074-c08a-4176-a319-848009fff0e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--212a6de6-4daf-459c-8991-f0d77fb38aab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec9e30f1-ac07-45cb-abb3-c9b8071c2ae8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--166cb469-7442-4e07-b055-fb68c5dc990a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03f18592-f747-4686-96a3-d8b0c70fed77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--273920cb-4810-4e60-81c1-233e03ceed17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e2abe8e-db1d-4897-9a82-7db68170d1b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f28b150d-f69e-4b2c-a88b-e375989c3f4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccb4e9be-4e2e-4a19-b553-b0cf07bfbb40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8822b9d-3be0-4976-b386-9c5c3650c70b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93090e79-79e8-489f-b6c4-e01c9b1db2ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7980591-6c6b-46c9-bcd1-b5ae503beb5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96152245-1853-45e8-af2a-e42c239a5083", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.41']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ea5fdb2-eb47-48a4-ae58-19c34ad50ba8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6880ddd3-b0e5-439a-8c57-dbc4289b5560", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0a43a84-1912-4718-84f3-871181eaaa86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7661bcd0-075a-4c0f-b9b0-14ac612b10e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.45']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae08f0f3-8db1-4883-a011-2917fdb14fce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66e4abb5-a2c8-45ad-a19c-876eacbda657", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.47']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--185faddf-f7f1-4b4a-808f-33aa2205f80f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b3afb84-892f-4fea-8dda-15348fb3e880", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.49']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87931118-fa00-4a0e-86a2-6e1c0cb08399", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95dfbd34-c0b8-4ee6-8f07-bc6201cd9c40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5618080c-e8e4-4f99-a146-f2104965926a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ccf7010-9bb4-45d7-95e1-ef0b2f083a1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5c0a61d-02bc-483e-9f9a-df2ad92d5915", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.53']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9671471-4076-4b4a-99f1-faf39f46678b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31a25246-2e41-4704-8db7-7bd028cd9d10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.55']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e759f4f1-ce8f-400e-b791-568a8257a482", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b808d461-1602-4d86-be05-c234a2ca12fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.57']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a837a8c5-69f5-4fc3-bf05-1db12797845d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--548e2a31-5cef-487c-8243-43afc1402565", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bd4d114-4ed2-4d1b-aabc-d959be6a61c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cb468f7-3b27-4145-afb8-9227b10bd0c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.60']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa1efa7c-8245-400e-ba42-80c5f5bbc8ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d088bda-e79a-4afc-8a70-b3c7a394b0ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.62']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be52edc7-2b23-4732-895e-2e2b9d9d1eaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d47bfbf1-0e05-4af4-aa47-b763aaea0eaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c9e6dcd-7766-459e-862d-9777bce873c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eebbee02-37e0-4109-8d60-9da5c47ce44c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d73f1b0-47fd-433a-962c-f7dad9e633d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26abb4cf-d329-4db5-9712-5c64f39a621a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2688ed12-d7bc-4fe2-85c2-b9e687daf665", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2250717-f23b-4310-bd8b-a676e47c1a92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eda45e03-6c7c-4368-acc0-f4f6ab817bac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c00a0da4-31ea-4a0f-a579-08466184fd5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--538e15cc-d62d-480c-8d66-521761591686", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fb2d248-a768-4a3a-8709-822aeb8abff6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--958194a9-6f5c-4f66-82db-97a8c5e1ca36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8fdefb2-06a9-41d9-aba8-cd39eb3997c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eff8ae47-db21-4e1c-ae7d-1b451f38b6d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98de5fa5-ecaf-4bc0-9b5d-f2c09aed28ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.239.151.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7574b540-2598-42a5-a1e6-88ae6a77373f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.74.221.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34214133-7748-4f20-8c61-ae2a340d64cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.93.10.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--211b85ac-5ef3-4563-9be7-5be7bb8b61e5", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.102.131.54']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c63cba0-7300-4775-b77e-ec99d998659d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.106.74.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f91539d2-dfba-402b-8e92-a431782fc4ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.107.24.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--508015e9-ae63-45b8-8015-5014df50e161", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.111.176.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b348b0d4-0f9f-4aca-bc45-506ac3b88199", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.111.187.163']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9ec41a4-0e4d-4193-8ea4-febc7a182a66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.111.187.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3ce543b-d83c-4741-ac7a-b20a6a49f56d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.144.45.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9782b09-dc3e-4413-822a-80dd59da330f", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.179.56.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4db94f3-7952-498a-a1be-e7ceb322c04e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.214.5.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ca95498-fec0-4338-aaba-e4286449641b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.52.52.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a84596f-1a81-40a1-90a0-cde75596d7c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e7c5853-5e02-43b4-9e56-8b5b19424765", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a21188a4-eca2-4b60-997f-1a2b54651402", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7944a0d8-3e13-4544-a354-c1c5fd31dfa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5659b45-0d35-48f4-9b82-0a3eadc16502", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.44']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--713972e7-35f8-4af1-9588-fc9ecb0ed713", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.8.184.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01911dd4-7de1-459a-91f0-4befbaa54993", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.99.246.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--492c4b11-31f6-4649-8038-852e51b9d63d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.106.65.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7c0241a-271c-4c8e-987f-3fa232fe2ac4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.120.104.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe6c9134-2f7b-46a3-8914-ea4d176a957f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.120.104.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48b1b395-9343-459d-b8be-502a48abfc2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65f4adb5-6d9e-4839-bbf9-d314a7a199e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--488adfa2-0cfa-4a84-870e-950e20ed876c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8087ab56-44d6-4977-804b-faf8ce50246d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6500fa1-ef29-424d-863d-be197f8dfda4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bb17bc1-0dd6-4a0c-8c65-59cfac196b27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41721708-9f80-432e-88eb-b5fa35d0ab9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.56']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c658b616-2e85-4b7d-96e1-f2bb096c8998", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de1dba14-1df8-4471-a6cc-3abf11880869", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9eccbfdd-0809-4a28-aea6-e617c22e99d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ac2f901-dc51-4096-b926-148bed8b7692", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c0dd96d-42c3-47a7-9151-f3a70ba23d2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46f8b183-78a5-470a-9a97-9ae4cb4cdd65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afef1985-b335-45a4-8c40-3c5666bbb201", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eef45ddd-8a5b-4364-aedf-d34f84a70a86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddf48e71-5f0a-4fdc-814b-b111d2edd544", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--623e8245-1e07-4c35-8af7-fc191c2515f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed88834d-fff0-413a-af6b-7a1ae181355a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7ca89b3-38e0-45f1-8095-869fa4b40da8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f08f9ac-0b3e-43c6-bbf5-755bd6c40694", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1668774b-2327-47ec-b6a2-b7f69ca8a115", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3f8d64f-3532-41a4-befa-e51c599a0188", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15aa788d-abf1-4402-b4d9-997ea5da23e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--312109ac-bb8f-462f-b28d-f2ed45da81db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--693c03db-6d3c-47d6-896a-4dcb6c991ac6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.63']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efa727c3-585a-49ee-ae3c-d9862c705efe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d185f92-a1f0-46db-90b8-a045e1e05348", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.241.164.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a44fbc9f-67cc-4df3-afbd-6b8cfa45873e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8b10abf-c5c4-480b-912e-ccf10056526d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa7c6bc0-6dad-4d22-86b8-f4b5d8a2dc9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d0155fb-6c04-4ade-afb5-a4422be3c3e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--497e9606-40f8-41b8-8e42-2cf738116ec4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.9.81.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0f36f00-53d6-4799-b9a4-89d87fda25bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.91.69.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80659b64-4438-4831-ab2d-44d09c1f967b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.100.231.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8669a19b-6dc0-4365-ad7e-372c4904ea7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.135.73.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6952122-3e26-4890-92b1-7b4eb419ed13", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.147.30.59']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68756e5a-72fb-4c03-ba18-88e97cd045e0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.189.62.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--129b760f-d214-40b3-9ce0-3a95be8d4e98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.191.146.100']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fff8796-ff2d-4b6c-8d1a-febcae44ae50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.202.190.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0faf3d0a-8dab-4ad4-88b9-8eebd1f7fa25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.202.190.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a20dd0d9-bd49-4acc-87fc-f05ad012e4a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.202.190.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e68d466c-d0e0-4af9-96b2-26feab58b335", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.202.190.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f716065-2ce0-4e79-a57c-201af36b6658", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.202.190.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33e56b98-aa12-4ca0-a5e0-acd7de18de6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.202.190.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab73d0b8-e0c7-4e76-9462-b11dad3b6b87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.210.63.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--032c6366-166f-4b32-a421-5dabdad9a6ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.210.63.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d06d2ff8-d7cb-4c78-965b-ff48f9184faa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.210.63.192']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fc65d49-4a74-4ec0-9c50-c5db7a60f78a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.210.63.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9eed6f52-a824-489e-9996-54038eba0d5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.210.63.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b86b2929-33f1-4425-ac4d-f585aa61b40d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.99.189.97']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d2be9b4-f09e-4839-a1a4-67cc741e8b86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.99.193.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--369ddbb6-59a3-4821-a9ed-30fd6f1957ed", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.134.210.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25f709b6-ad6d-41af-91ac-bdc4aec1801e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.142.244.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee4ea44f-aff7-4165-87f7-0ff6f43405ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.163.206.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11c39ee5-8f4b-46be-8709-3a3faaac9fb9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.185.81.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f29a8d1d-c63a-4902-9f78-97e8ef0fb119", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.190.156.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--909774d8-24a5-4217-8243-d04ef961b4f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c19035e-2405-4e80-9cfb-4030d015360d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9c90130-cc1a-4ef1-99c5-329e472d77ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b4e308c-7b70-4dc1-9939-881ca78e1b1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f152ced-955f-4b98-aa6c-9c0050a4817a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bce0561d-c095-4f25-9513-b8672a034d0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10047fad-9c4c-4a4c-b0d2-c41fc8be6190", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ada523f2-6b95-43d2-9a39-380a44b50bd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1343ad5a-9b95-4f7d-9eb3-515516e89d13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.167']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98557e2a-3e78-47ca-8dd5-bd2210df9b15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a17878cc-cdc9-459f-8deb-635bd3323e02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--096d8485-d258-4ddf-b752-6222317845af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c940eeb8-d9a6-4000-8115-325bfa6a76f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad35e643-6ce7-40a3-9d94-b17cb95c6f74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb4b1aeb-4135-46cf-9771-02ba95bcc4e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3844aeff-50bf-405e-b56d-19e3b1bb0913", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b55dd791-038e-406d-a286-ac14ecc3a0bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54a0c5ef-5af1-44e9-a9e2-fe9f9fc2ac32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a14d11f-be0d-4f99-bcd6-8f9421394cdf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79efb76d-1342-4aee-822a-8a6466263a9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--120ca318-f9fb-45fd-b7bf-e65d07d8bf56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a54ced32-c7fc-4762-8114-803ccb4c070a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fea23ef-6f88-43c6-ab29-cc491a8d1186", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db91c008-1a8c-408f-b49d-c4df9876d027", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d23ce76-4ad2-4947-a30c-5c5f09ffb383", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.163.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f35121b4-db3e-467d-aa60-d893f51a479b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.163.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2528c0b4-498d-47f5-bcc9-80956b7b65e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.163.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4751be2f-a30a-4ce8-a3e5-4764bc591621", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.163.61']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e427ed63-cc11-463f-b105-122f29b7edf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.168.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5aa780e-8dbd-4e12-83ce-137a39688572", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.36.160.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65628644-52e7-4f09-b46c-5f36f1e1c9fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.116.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89bea894-4f35-4e9c-810d-8f89bf94ed96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.117.103']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73d81f2d-51de-497a-8af8-19c9164c3b06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.117.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f40cd485-16d8-4f09-8ba3-4a3e7b03413f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab79b450-577f-4a3d-9542-95c5483981fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--364dcfa0-b037-412b-99db-8d135def099d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8c07fee-0897-4aa9-bada-b8d425e5a231", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a7f7464-802a-422c-bbc8-699d98bece7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad55f85b-2b0b-49eb-a8bd-8d10801bf67c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1560cdd4-f739-4fee-9e8e-1b1dfecbea84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a16a80a8-6310-44f2-8c93-3edd9d7dae31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77b992d9-1a03-4e57-9cdc-6691d10789bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bccca01-ff0c-4e2b-b127-aae93c63cfb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9a9c82b-8f50-4461-a0c9-bcc5cf784f64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10a7e4f3-09f0-4d66-b84a-85900653eb8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9df0759a-d038-4ca3-b597-83f3f16ff5cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09dd04bb-3956-4f35-a348-c77c24d27d94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e76cb0a-a4af-4d30-aced-2d74d5880682", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d573550d-3fc0-48ed-82b2-bfb532872eb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.42.231.160']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4999120d-0e79-4e94-8fd1-0a760d099457", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.43.132.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7024b1d-457a-48ac-8f06-58fccdef06a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.43.133.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f65d1449-bfd1-43cc-8588-bb7c9cecfd0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.45.12.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--204c683d-ff10-4124-b4f2-ccb0c52cfc70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.45.12.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c17e69ce-8cf1-45d5-ade9-0f1f62703dc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.45.12.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67b7bd92-f0c2-4b78-b3e2-248401e01792", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.45.13.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--413fb586-a80e-4672-a683-205c15418c08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.93.160.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd768e1d-fbf6-4e60-a55d-911a2f861aa9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '9.154.37.0']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e36690f-4e6e-41f9-902d-f25261c6b8f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '90.26.212.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0fdad6c-400a-48dc-86ac-93329df282e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.106.61.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d76e853b-53aa-4839-8ad8-e65802140b9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.148.190.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa91db99-1c80-4c84-9415-92f1c96e418d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.162.24.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5de84057-9c19-4417-9dd1-c866370127ee", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.184.252.50']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--748b9543-7dcd-402a-8d4b-4b81681dd2d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85388a5f-271d-4d7a-b066-91169c27b481", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7a32992-5bee-4d61-9460-dfedb9f66559", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--708057a1-858c-42da-900d-521b33e21cb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0648759e-0463-4a11-ac8e-3db297b72dd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--835d013a-e746-4b1d-8fed-1115342a6d39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.192.81.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0e3db28-534a-4f71-ae4a-dd76f851fff4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.193.18.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c0572b1-144a-429f-829a-86b57a06e0b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27910fcb-269f-46d1-9888-5c63f64ae33d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd2f2439-475b-4a13-b063-2a8e5b0fc435", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eb23b3b-c865-4e47-a2e0-1f5f9f69eebc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56923e1c-d05d-4e25-b62a-dc2eb793eb98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7008e17-0ae4-4b4f-a48f-67bbd9f434c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f2d4551-60fd-4530-b7d4-4d7a2d2b3482", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18acffd5-dd56-41a3-b086-b4955f439128", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e00180d-8135-4255-8c8d-6a6dcf2e0ded", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d24ffbc5-5342-417e-b2d0-80be243a54c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e915e8ce-4d9a-47e8-af4e-dc2b51b7029a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--775496b7-6b99-45c8-be3d-86ee86e5cae4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.162']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8365ca80-b6bc-49f2-b973-32b4855f94e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.176']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa8a0c50-4a8e-4895-a78f-bbde4d20876c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fd4ce61-54b9-474f-acf0-8978bf357b61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c372a96-4971-478f-9fde-b9f8a3998b36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de9f6472-08c4-49a7-865d-ea53dfb25aef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f352b54b-63f5-4c0f-abb4-c98ddd3b805c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bcff545-1652-446f-a03e-56bc7807daa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2be7ecc9-b4e0-4278-aa95-4501d3fea101", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.183']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00d78d48-d356-497b-8e5a-c4e93e96d4a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec03da57-f322-4b4f-b004-1e3bdd7f12e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--674b3cee-d953-4bdc-8a5b-d07ba7c59f9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cb92686-610c-4795-9b89-6f55b69f6e19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8198a439-e4b8-415c-bf28-6727d4f30fab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b5298bf-c28d-4111-b587-007efed5bc63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fa048b3-b32e-47e6-ba82-4974d94b2c4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc58ace9-284c-4556-a25b-0e914b9859bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81d9358e-0e88-429f-9583-54b0b1f722de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b9ca491-013e-43bd-a917-58cd0be846e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32c3f0ad-b295-4a8d-a518-a92f23dacc2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ab85d32-f054-48af-9b32-44ee819b68ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4d1c2fa-39d3-4edd-bf34-b45960e544cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--030bc1c4-8ba2-430b-8a74-d168d1cddf8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b9deef8-eac0-48f0-880d-039c4bc336d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--106cb46b-5a47-4e3a-9e75-6e46ce70db07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e9889f1-f33b-4942-9421-5e6eefea9070", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e1937d5-45af-46e3-89f1-f9466b5b8410", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.216']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd92c206-0498-4afd-89ae-aa420a104dcf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.217']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2a3bb4e-b192-4e6f-845f-5920ef1b908a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40744f19-313d-4e5d-aa3a-9ffaeea73cb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.219']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64eba0f5-33ce-4e67-b8af-82935f63a550", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.220']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7678cb57-c14e-4c9c-850a-5c2fc564e87f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.221']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc1c1a5c-dc5f-4f4c-b3b1-15ed3f5641f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.222']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af005ff0-c02c-451c-8dd9-a90923e9e351", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.223']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee2f0516-4375-47c7-b5c0-8fd1074fa215", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3e02d36-4747-4489-a720-6fb8e5c03c30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72312f41-f581-4645-aa58-00023a4ea61d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.32']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c3bad3f-4c48-4ad7-9b4a-296ad5cb81b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6489acc-5511-49fb-8489-f99500ead43e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b4b28d5-a2b7-4d7a-81ea-964b92bdd2ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.35']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db21e3f5-18f3-4a99-a9a0-bed54948ceb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48efbb10-3803-4189-b430-905646c74cb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.37']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29371b84-7a85-4f97-a9ec-cf60fb69e106", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d86a76df-a7ab-4e4b-8bf8-55492b3556b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.39']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--599811fc-dbd5-472a-8305-42fb2fcb3cfb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c9f6ae5-3394-4359-9005-45f5f9d9f4ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb164365-6e9b-4957-a91c-88f091e0c4ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad8a208b-569b-4ccc-88fc-34e6f58b901a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--310c076f-27ac-4ac4-afda-5e94d5440dcc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84584ea5-55a6-4d86-b066-c8f80cb3511c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.98']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50b53c73-b006-4687-9b61-a2df0e423f73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.199.163.52']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5bb151f-048d-4f40-bc78-3b4aaeb16f88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.215.85.101']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1373f02-6bcd-45e9-a02b-6a208e78a1b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.215.85.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b06d262-5ecf-4725-925b-960cd31c5447", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.224.92.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8a8fd7f-09cf-4f62-87df-a6272f945ac7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.228.196.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a874eec5-4d04-4934-a15f-81e9537ba819", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.229.239.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--621ceea9-b274-4a06-8fdc-0df98cb43c58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.0']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59a45c9f-ed51-4b51-9228-7b0f42999a1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.1']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1492f105-795b-4023-9331-07e421e0b526", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39691d53-c713-46a9-8344-5ec3c2894d62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebc91ecf-6ccd-4840-a6ec-270ae60a8186", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cbe5c8a-762e-49e0-a27a-7b773f38f0cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.120']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba964e65-c295-4665-b619-01a819293fb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.121']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70b235ab-957c-4718-af71-d27752fbc8ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.122']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d390110-4e57-497d-b2c1-bbdec8909d17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.123']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc311373-2de7-4614-8191-76f5a2422415", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.124']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3523b5c-5aa3-4e43-bd6b-a4e549356686", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.125']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba189423-2b16-4a13-9713-63651a22a1af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.126']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e8311cd-beaf-4728-937c-a590f53cf08a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.127']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--731b7d85-40be-4024-9b95-75454c2e2fa4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52a2a866-5b94-4bb5-bf3d-0870c37fcd75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14e15b06-018f-4cd0-8c40-0cf60644bed0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af2c23ae-08d6-498d-81a6-13e7df34a621", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7bf70b9-c1a8-4a48-999d-24397a26957a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8b5a1ba-3654-464f-90ea-eb215904adc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa828dbe-71ff-4d2d-9a3a-8c1cf76f6d87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93012a9c-182d-4ab1-92eb-2342805ce814", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e455ddd-ae55-4767-bbba-e111ee0b2ec2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec22e423-b49a-4ec2-9c81-d1bd925e9a9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--999d8cd4-cf91-420a-a5e0-e00d5e5cc421", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba9bc100-4033-443a-8ac9-4ea07b264cfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d558c52-17e0-4b7f-a284-67f70c39e310", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8865813-fc0d-4ee7-9f3b-fe598846b6b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21a32e4f-0a3a-4f7f-bb2b-960ab1b399c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fcda7ff-f8cb-4126-94f1-b49a4f4f08e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9a7b4eb-9f77-4025-9e27-32d0275865e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54c06215-3188-4c30-8a03-d30c1395659d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--234e5648-6c2d-475b-aa2c-87080ff4a118", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68045269-6d9d-4ea3-8da0-42004cc9a314", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ee248ef-2a05-4170-8ab3-3961f988e3eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7943804d-c9ff-4253-9a11-dd52daa805e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81a787f5-1d9e-45ab-9885-beab58e26909", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abf6ea43-a24b-4b72-8cbb-bd3216b1e02e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5f9cb38-5470-4efb-bfca-9a2afbe5c4e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.18']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ebd6e30-5125-4f26-83c4-332a6556e931", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.184']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ea2c891-23f4-4a9e-af11-9f6d17736b6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.185']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c927792b-7125-4557-95f7-d57e5f63e355", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.186']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6020bba9-64a5-4ace-8106-7209f3502032", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.187']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcfb0dc6-65d5-4b06-86bc-145fe85eaabc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.188']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cc979b6-5b95-4ed4-92f3-8eaea9229ba6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.189']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25d2b707-1b5f-4ecd-976d-7628020ccb3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.19']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81f550f6-a247-4090-8f69-3098f4aa96c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c822030-0fdc-4d06-96be-cdb0222fe59a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.191']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a49395e1-6195-4c82-96a3-250a1e0e2631", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--558426cf-455d-47c7-99cc-5f58aee7c365", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.198']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7057ac72-4bc1-470d-9e58-c5a101578196", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfd0d169-cd0e-4815-9d78-d3a56cfb995e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02702f85-4643-4d6f-851e-336f7e73f877", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--937091f4-5c89-4424-943a-abe1aeb04c85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--585dcb15-0eeb-4a2e-9be8-6b3cd58b5940", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1ab058e-ba4e-4d67-9167-5a955219334d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.21']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c813105-3dec-45ed-a4ab-c1f406effba8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bed0db7f-275f-4671-b7e9-fab077d91c2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52a18e07-eccd-49f6-92de-14498041b735", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5549f4c-95e0-4f17-aee5-af2536c58736", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e217b40-a417-4ef2-9252-f0f4069e2840", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--939605d0-4807-4780-86b3-b0625f16361a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7236b0c2-34bb-4c38-9e53-d237aebb65da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.22']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--606dd799-74e8-4f7d-93b2-99210a0cc5d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a01eb523-8540-4138-954a-0d86e2b07f1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2eee915-4155-4482-a5cd-5a2f16a88dee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d3110bb-ae10-4f27-97a6-74088b7d867c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1737d583-e853-40fe-b698-41d2eb9f2bb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59bf8dce-ab60-424b-8e16-b89fb3310f2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--196ec169-3a73-48cb-8cfc-4a192a8e1c63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--251f2c22-e743-4c0c-8746-7047c04d70a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e1bdd7c-0b09-498a-aa30-4fc6eb684f6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--feacdc26-698e-410d-b321-92c11c63097f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dc8b69c-09b3-42b8-ba9d-13537de1e2ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.24']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57645bb4-0110-44fe-8dd4-c631cda0d336", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b549875b-6303-4b13-8216-1784730b5711", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4521a3b2-d1f6-4f2a-995e-47264487db13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f418fe3b-b142-4200-82f4-766478774514", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b40139f-adaf-42b2-b057-dec87841a1f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fffcfac2-d9c4-4494-b959-729097e24eb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fffb658-e0b7-408c-9837-cd413a5a5ec2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4b24f87-60fd-4e03-a5aa-00452663706a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4194fafa-8b97-4d25-b07d-99c83900d97c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9483ac9e-0ae9-413b-8c5a-d0427f9256a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.255']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a2b72bc-f072-4075-9ef7-96aaedfd49c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.26']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16b6c5db-60f1-494a-920b-23aa51df8ea7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.27']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39f207b3-1c76-49d5-9376-738258a8314e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90115047-78cb-4d3d-80c5-5e2171e2f22b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.29']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00fe2cf7-74b0-4136-b4f2-e811f1dca9f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4ccface-a221-43e2-a180-4b3282ef9005", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.30']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73e7ee08-b6a2-4965-8e49-457f82c61d1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.31']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54f118a9-2a0c-41e2-a8d9-6d75a7fde412", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aee483cc-bd44-454d-8183-cf9600f83030", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40ae37c5-b259-4308-98df-dcb811e2e178", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8528dec5-990c-4805-8842-c0806c0921b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05879306-59d0-4f7c-81b7-20b6958129a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--969c8239-ea53-4282-ae3e-aa5ead5c7f87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c34fac04-13f3-4d34-8871-6aff2ad2828a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.88']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f33637bd-8f44-46f2-a68f-777bdbd3851b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70bf27a4-887d-4ffa-9734-321c019b21de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42bc23cd-0711-42ef-a167-1865efc2543b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.90']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c461147d-31f3-49f9-a081-488cc852af87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.91']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f073013-8ed6-47b0-9239-17405ec50fef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13f81898-1c3e-4d8c-928f-f499aef2f413", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4108e661-0bc8-450c-88c5-48543fc55861", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.94']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3320fd6a-1a09-4567-b603-f073f94a22ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.95']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a9ad2f2-1394-4e4d-9d7e-c19a2927c97f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.0']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec2db797-fe64-43c7-ab35-a85849f5e0bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.1']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b15b7f1-cca4-4868-b096-9d5ba8080842", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d61b04ff-8ddd-4581-908d-cb61b0fec692", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.104']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a504b585-5bd0-4ff2-b3f6-39caa50ca26b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.105']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6963657f-80ea-4326-9516-d844413725a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb2be7f2-b7ab-40a4-9b75-e8fad37d2b6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.107']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--111b050b-5c16-4309-acab-92c78960a29c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.108']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e38ea70-e8d8-4a2e-aae0-32133b4a16e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--243c1ea8-8189-48a7-a370-ffcde97356a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.11']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--837d2497-e07e-4f7d-98bb-e40dfde3e294", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c8eff29-4b90-448b-bffe-9844b100709d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.111']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1bfc056-f81d-45f0-8d2d-d360ca89fed1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.112']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bb608d3-e7d1-496b-bec3-d94f1bc3b040", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.113']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8118be38-c884-470e-bf15-19afa4d225e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.114']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6baf9f18-dc68-4275-ad9b-940a738a591c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.115']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b4b99bb-6bfb-496a-8f07-588718209a70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.116']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5008cc45-25db-4f16-a583-8c4c8d4e677e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.117']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f247642-fe00-4cc4-a85e-0a97a1d79157", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.118']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e575a89e-37c6-4412-a516-fe792096bd9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.119']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fab854e-2be7-4eb4-8da9-72173ca82939", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0341ba13-2848-4a95-9ede-4efd83e0cdba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.128']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3ad1019-aaff-4a72-be0b-9e14a422b9bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.129']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dfcae6d-3333-4efe-a967-027cbf202550", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.13']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--359af985-288e-4833-8618-ffb2b1715966", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.130']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0715eedb-8ee4-4731-b34f-5b8534a2f0c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.131']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa6d6824-3936-4d84-a124-7bfca01c5b8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.132']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef8f7ad9-f8ef-4f7d-8554-93037c4ee546", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.133']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--482d48d8-7cbc-4131-95bc-06e66fd5b67f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd10ad99-1811-44a2-8590-5a2ec0e84417", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.135']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42e32628-0f23-4be9-bf61-58b3fd2a04fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05e8d771-3116-42d5-87bc-16565c7b23a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.137']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--716a7906-bdee-4031-b97e-f118917ecba6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.138']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0813d55-95b2-4d79-bb91-7353d31a4d71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b8c2e86-7484-42ea-bb01-bdea2b3b4ad7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40ddcf19-b920-440f-94bc-558476ac885c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7624ce1e-4989-40b9-9711-559a8aa201bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dda4623-2e60-4b06-9405-e198d545c2ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.142']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc6afe95-84c9-4152-a5f7-b9cbbdc10db3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.143']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3229b49-01e9-4e8c-8f99-a8fda1c99956", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60d38dcf-c489-4704-88f1-4cdc15e3cf4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d9fa70a-53d6-4b65-bb80-7a95000528be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.146']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb2f59ce-a021-4288-b442-4a48f9f1ab17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.147']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--928ebfa5-7209-424c-9972-d2adeb9e9071", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72fe89c5-f7b1-4190-a560-22d0719487b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.149']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5823882-3b71-4d12-94d1-ac665fb0e846", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.15']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5af4c50-54ea-425b-8a77-c6019e062e4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c8307fd-8c93-41a8-b1f4-89f6422b9aed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.151']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--692b9b58-5ef5-420c-9748-0e333e773d79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.152']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a4614ca-c7a7-41ef-b44e-2dd672624a72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.153']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4bd76eb-f5bc-4c45-a99a-b71205f1dd26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--692c94c2-eb30-4db5-a3cb-5a1d0abd222b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e9db363-d65e-476b-9cdc-c8c58bfac589", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.156']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e91d828-f87c-40ff-bcfa-47caef47e210", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.157']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcce86ac-a2e5-41a5-972a-8be9ce4e6e3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef691512-e285-4421-818d-b5c9e4e73320", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--185957a3-46e1-4ddb-9247-deb459b1b47b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.168']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12d3a199-0f56-403c-a362-70dc1be178d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.169']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de220c3c-9d51-4696-a503-f84bc009c1e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.170']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--653d68f2-1764-4707-8064-aaa09d510c3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2abbc855-d498-4e0b-895d-b56bad78c05c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.172']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08665a8a-2554-403c-9ace-d3afefb8b894", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.173']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86b73b18-0a43-4cb2-bef6-f6bdb5c4c203", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f813f9d-5b3f-4571-ab5b-6f2a93a47453", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ed51995-1bb1-4b9b-b830-b8a699ec14c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.178']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c80f3b18-3ae6-411c-8b60-bc053848a41f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.194']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ebe8eba-a71d-4d4f-9d23-6a313263b4ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.2']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcf5799b-d43a-4018-9eb9-f4f6d68ed9cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.200']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef0ae29e-424f-4e89-8523-33b930de931c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d34339a3-9635-43c5-b7d6-c890538071ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.202']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6eefa21e-432f-42ca-aa7e-1e89a34bd23b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72a3730c-127d-4242-903f-8ade2dda58d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.204']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2978ab39-5d0e-4725-85f0-5a4afb77b8db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b19b609e-5788-48c3-a302-1602c9a92107", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.206']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f879a3f7-ec34-4aba-a54a-df6e3e679d96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.207']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1becb5dc-93d6-4cbe-b2a3-6e1449708728", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.208']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b3d3f75-bcc8-4c47-b95c-41889cbccaa6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.209']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28a525aa-2b5b-4d12-8ab3-5e261e482eba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.210']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d807bdc1-dc8e-4dcd-9daa-3ae4d4ee3604", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.211']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2642e73-be03-4aeb-8cb4-105cb3c379d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.212']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c02b4ab-c0cd-4b9e-bda6-6068a8454665", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17109e06-28d4-4f25-a89e-cb2934539ea1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df68ee0c-f49c-4abe-a2f5-611ef49c0dc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce98261f-75fe-484c-8fe2-23c6a4fe1caf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.218']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1717cfd-5a53-4542-8c8d-6c82c803be8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.224']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--765711f1-c27f-4f94-9742-d6d2eaeebec8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.225']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1bbf92e-edee-429e-8b53-e8431635162a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdf6ed10-8473-4aa3-83a6-a24897787d3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.227']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd0bbbf4-7a46-4edc-be17-3182ff15faa8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.228']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--262a1325-1b42-424a-9eac-1b411e396059", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.229']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dabbef4-09b1-41f2-b672-1dd4e5726835", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.230']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab8f5f00-2adb-4f51-b0b3-7209f2b88af3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.231']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0528d56b-e69a-41ee-a8e6-0ee53ff6f691", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.232']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7aed8c41-1964-456d-b3cc-141b4a3a24d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf6afca5-81af-45cf-841b-5589553d2f24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.234']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8cd373a-0451-44a8-aecc-a116b5391cd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3df7a840-aa6f-412e-b43e-85e300093102", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f362ff1a-ac0a-48a4-90a0-276c9e4b10d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.237']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c66bdc2-edd9-48bc-b3a9-cdc33af7580f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.238']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34c108fd-0976-407f-94c3-747b5bc13fbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.239']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--229b7065-b8b9-4d2f-b05b-6bc23418c6ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.240']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8191a32-e1f2-4173-ac18-57af4fd1db93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.241']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8b13e89-6422-4a77-bbb0-01abd0a037a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.242']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b20a503-5230-46f4-94d1-a40baad51ef3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd5ab642-2dae-42e9-b156-ccff3bf32d9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34adbdc6-7406-43da-b427-2ef1bf888a6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99a6b01d-512f-4fbb-8dca-400127cd21c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.246']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28488f33-d25d-4396-947c-c20a0dfbede7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.247']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5d953c8-38a1-4292-af90-cdc385cc6ef0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.248']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edd2041d-c1fa-4e69-8a30-f819c0552e74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.249']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c8d0357-2738-4fa2-8c1f-d4ee68f57beb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29352c0f-0e63-452a-9627-20513ebc663f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.251']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39e9689b-546e-4b24-b270-933e8a6fd342", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.252']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce2ea57a-0f39-4042-b253-14eca7351b85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.253']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4751020c-4963-4f29-8215-3e8eba632836", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.254']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71c9bd5c-27a1-4920-af7d-dd9ea9f34b53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.255']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bae0385-770a-425c-bfe0-f92db9cfafed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45bc4ffa-7671-4f4a-95fd-56b2298dd865", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.4']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91f517fb-1a7a-44e8-bde2-7cfb8e109fc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ec6638c-08bd-494c-8204-0cfb081dc6c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.5']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b720eab6-82df-4a03-810c-c66427a5483a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45e3f493-f780-4198-b990-ca57ebffcf09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.64']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50220007-4b88-45cf-b94e-6694178b6a46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.65']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46ed5752-f271-4cd4-8fce-14f0ad238bb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.66']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d64a1bf-e853-45ee-b5a0-9096d4f675bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.67']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9b4d1a6-ed63-494f-a41c-520edce285ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.68']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00769f1b-7aed-420a-b88f-752406003a99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ef524bd-ee28-436a-9346-629f38ae939e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a927890c-c432-4aaf-a3ea-ab893bec1a97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.70']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f3d56c0-9d8a-4742-a09e-0369d322ffe0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5e26cd3-f6df-4c43-90c3-097add22d57e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.72']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b330bc0-c1af-411b-b982-af5fb8a67069", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97fde660-c015-40a0-9e30-cb91b0445202", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.74']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--213d8774-eeca-4ecc-9e22-6e19c0874e67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.75']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e24b6eab-af68-4bc4-a004-53fb8e6051af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.76']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e05a9847-6858-4740-a8c2-c4e945fe2de2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ead0f5a2-b00f-4e03-bece-16381b9c3b46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad7754b4-9165-49b4-b80c-2dcbbd5d727e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.79']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c18c88f8-bd85-4545-b35a-bd6eda62649d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.8']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c2d4b25-66aa-49c0-9173-67914262277c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cae819d-e547-4ce9-bfba-0103842431e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.81']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e18c40ee-af26-471a-8882-b8db9beb60c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.82']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--915908e0-98e8-4772-9913-f50e02a2bb9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.83']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--748f9176-4ee4-4325-a464-cfe760ff84e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.84']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b17fc1b-2838-4808-9e6b-9d761d62a686", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55a39050-f6a3-459d-bf15-9b1ea498679e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.86']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--276594bf-c1a8-489c-aa47-ce701756e5c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.87']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a909105d-adde-4ce4-9524-c0222b1f714e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.9']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--308ee0a2-e8d4-45e9-9030-053213e343ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.24.1.201']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf86399f-14c0-4e03-9261-1853af183d0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.244.197.205']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c4c46d0-641c-4a92-ac74-3d8357e42b36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.21.134']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--460ea616-1bc6-445b-9704-52bdedb856d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.21.171']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7db4a18b-8e85-4ee5-a3c6-eda74b27ae48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.240.214']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd5129b5-ccc9-4a06-b04c-b3814793c136", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.241.226']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65bc4967-8db5-4b8a-80b1-9226643fb89c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.98.151.17']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21f1ce07-edf5-4c67-9c0a-4b9910f09ece", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.113.142.203']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1d5fb72-d777-4fc5-84c6-75f01e18b0d7", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.195']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30a928c5-e85f-491b-8fb0-05591329dbe3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.196']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e70a56da-13fe-43aa-8563-5f2fbface5b1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--667ca686-3a50-4082-be05-a8b14243a3fa", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.23']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--028f7395-e169-4496-8a25-96adecfbcee4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5502ee5-a4da-40e1-9f65-7d4010622c5e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49bec679-8bcf-487c-b958-e15f95a08c39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.124.142.179']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--886c25c5-0aee-4468-818a-be30eab85a60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.154.95.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22728968-c471-496e-87f2-8ee75c4b2bfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.184.141.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50f69f32-4bf7-4cad-9fe1-395e72a16a42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.211.162.235']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9d218b4-dd89-48c5-bac0-01f6ec1fb542", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.22.160.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bad835e7-2cec-46e1-9899-c8aa3ae002b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.253.102.43']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2992182b-862e-4078-8ac9-7c0a7908a62d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.63.197.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2fce54c-5f2c-47ad-ac6e-098474ff9f2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.63.197.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--754ab9da-aa85-40e5-a327-8bf79b658ad8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.63.197.181']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0697ef8f-21a0-47a0-9a22-5e771c77fc51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.63.197.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8598f3c7-af61-42ab-86d4-e788507717ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.63.197.236']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e334eb21-40c0-464a-9e50-5bcbd17f12df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.112.152.77']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3edca18c-d60b-49df-8573-03eabcfa1e1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.123.109.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02e4e720-2ab8-49e6-8d3c-eb77c839f219", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.123.109.182']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5ccf15a-12a5-4896-bf07-392bd64f7edd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.123.109.25']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c17e9046-d8bf-4d58-b18b-121d1b95db6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.123.72.166']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9854cb48-a3b9-49a2-83cf-78e364e8e86d", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.152.221.38']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8f1a748-b82e-4a2f-bc58-f3e1a41a5c0c", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.152.221.6']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abaca373-4914-473f-9637-14955547fd44", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.158.90.36']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88ecd922-6eda-4a70-8061-16bd3458332a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.158.90.42']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cb94087-8e7f-4edf-9db6-67d4733c2d18", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.158.90.69']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c523c076-b774-45fb-8f69-82ef6461359a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.158.90.71']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1872fdb5-7166-4771-b8e6-e8695293f17f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.158.90.73']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05a7e604-c01c-477d-a2c5-ba97aaf6d24d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.159.230.85']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a332df2-b95e-411d-ad1d-849866439a82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.171.7.28']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2e8194a-e331-4736-b3b7-c14938b77012", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.174.93.12']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--928049ac-ff3b-4bca-aec7-9dc1ff830381", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.174.95.106']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--461d3963-d24a-4a2e-a39a-038decf56229", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.186.100.140']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0de38ac2-57e8-4226-8a3c-0ef801c7bef5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.91.197.46']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--845c0e2b-0e49-4ed5-8900-ba64450b7b6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.102.49.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99a8c6a8-971b-4b4f-9c9a-a5ed7ee8d208", "name": "Malicious Host", "description": "Observed: FTP, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.102.49.155']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ftp", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b703c3ee-5514-49e6-be77-fe6f9b0738f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.102.49.193']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2edbbcae-978c-468c-ab3a-d15d75e27fcf", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.130.88.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79c917ec-2769-4857-ad98-a1c4eb51e38c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.159.47.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55ff7a72-24a5-4e74-af92-af7849ba0249", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.204.78.58']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b876586-7cd1-4a4a-8813-985632aa7955", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.23.188.199']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f44cc952-2b15-45e3-9ca2-a1d0c804dec5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.230.136.33']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23fee816-2fde-4dff-918e-1ed4d0b68b78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fc2af08-8d25-4171-8d36-4f1c121a8d80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.109']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c8315e2-26f3-458e-964e-458377c4936e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.110']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61e22ddd-b74f-488a-837e-5d360db1d397", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.14']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d20a781-480a-4fb2-9a8f-948d4546625b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.250']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed220236-33f3-4e58-9d32-adf69a313493", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.3']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eac34034-750a-429b-a70b-03893c95e1f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.232.40.89']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd50d749-4953-474d-800d-e736058da06b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.232.42.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09cdafa6-9065-4a30-bfd8-dadb40f818ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.250.203.163']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f78b5da-fbd0-4f84-8e34-69d9848a952f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.250.61.10']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--264e2d3f-b87f-4427-b662-9fbc48957959", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.26.106.139']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3daa1c8c-444c-4849-bea5-c871e756b128", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.26.106.190']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c12ea4ce-146f-4c60-8ba0-f5449230affc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.65.58.245']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96020dfb-e11c-4337-a1a0-23cc2bb67c82", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.67.180.92']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1fb678f-d2d9-429e-a3e5-8ac570018e2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.165.68.145']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b48d379b-f653-4843-9f85-b556ac790c48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.174.71.177']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--226b0875-56f0-4adc-bd4a-f0bc91e17801", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.181.232.7']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3305abad-95fc-4cf5-bf08-9b1dd15d621c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.181.234.136']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f074e681-3265-4641-b959-5ee2f48b4da4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.181.236.148']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3735959-da01-44b1-93a4-5a5d6a351fa3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.214.52.233']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eaa80c9-f7f6-442d-99b8-80e13105e99d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.215.0.144']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab240039-e3e2-4ddc-a092-1fd04395f717", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.220.204.16']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c650a10f-d376-4845-a554-dfe4f5160456", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.23.246.159']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05b8634d-183e-4948-bec9-e931e5dfa316", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.234.71.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b684d4bb-bf03-4dd5-831a-415240e12d65", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.24.35.51']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--078f3ba6-23cc-4e19-9184-9f1e075474fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.52.117.141']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63c34fb8-7273-4ced-81ff-cfba754952ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.93.23.175']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0adf5bab-d33a-47bc-86aa-63dcbcc80976", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.126.104.20']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0db3a9c9-e589-4643-a63c-d70ce9fb5b49", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.127.153.174']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccf4d386-dbd5-4205-8625-a43f545fa50f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.127.172.215']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7192faf2-91e1-42c1-a120-dafdae646d66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.127.175.154']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9b830e3-b12d-4136-bfd4-c37b731c7f4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.234.200.243']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c947be2d-569c-4578-9c42-b08b2d4a8b0f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.44.129.158']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abffb656-08c3-4cc1-a68a-3b99b8a72926", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.8.116.34']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d607783d-8eea-47d7-88cd-681d994dc274", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '97.107.133.213']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08c9b215-3a8e-403c-bd23-0cf5e34dbf06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '97.107.141.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3bad049-fffe-499c-875b-0835cf424aa1", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.70.26.150']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d0869a2-2cdd-486f-8b1a-e01044eeadab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.81.156.78']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e7a9849-cdca-491c-afea-bb7c68caed10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.81.162.40']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c693638c-52ed-4139-962c-225ccf032a97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.81.60.48']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--871f7f9f-2222-4130-927d-64b75a3569cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.82.6.93']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8e8be93-16ed-477d-bb0e-fdf014060dc5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.84.64.180']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bb4d753-4443-4642-8800-2cb7f737e0b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.90.43.197']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0511424e-ad9a-45f7-9ca5-5e511672f070", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '99.224.20.244']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0407562-e6e8-4bed-8d7b-867c43b9e711", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '99.254.18.80']", "pattern_type": "stix", "valid_from": "2026-05-14T00:00:00.000Z", "valid_until": "2026-06-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-14-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49ea57ff-6a16-4b32-97cc-c94d73b9db5f", "sighting_of_ref": "indicator--c22fb853-0cfb-425b-85cc-f4ffc77e64d0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5378017-7733-45d0-9e2f-e796760e8b19", "sighting_of_ref": "indicator--c978ed12-4e30-49f8-ad3c-4d5dfca1e247", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88dcbd85-a544-4542-b5f4-e1ee203db24b", "sighting_of_ref": "indicator--bbee149a-bb0b-4361-841d-2cd137108567", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f30c2d8-e30c-44b3-a401-d2a63a34e834", "sighting_of_ref": "indicator--34641c56-a3c3-4fd7-9add-9fe4820535c7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdee1d8f-e0fd-4385-969a-6260f2bafa8f", "sighting_of_ref": "indicator--e706e0ca-4c3e-4c8d-9817-fc2eb57de47e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--966c4895-f029-4603-8d9e-d8715ea6a26c", "sighting_of_ref": "indicator--e3138d53-972a-4392-b282-d21eff017409", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b82015e7-7ed1-4fa3-954d-b6284fa092d3", "sighting_of_ref": "indicator--c913543d-ba22-4990-a506-51848ead7072", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9daebb2-7f70-43f4-a15f-bcebd20cad3f", "sighting_of_ref": "indicator--2e4fa3af-2852-4950-8eab-ea26829f99b0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c74e5bac-64be-4f5c-b7be-859d8d38ab51", "sighting_of_ref": "indicator--dda416e9-49e9-46e2-9d63-95ffea7f7946", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--902a1da1-f18e-430c-b628-e03c3b7c42a8", "sighting_of_ref": "indicator--da5585dd-2e9a-411c-8dc6-f6c90ba8c2ae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9067aa26-5f0e-493e-b72d-15ed97dd7943", "sighting_of_ref": "indicator--da5585dd-2e9a-411c-8dc6-f6c90ba8c2ae", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90478d91-52c1-48ce-aef0-ed8b002fbb80", "sighting_of_ref": "indicator--8467a388-dc1e-4394-8612-80f165d960f1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1e9af6a-687b-42e9-b664-a4e560135596", "sighting_of_ref": "indicator--8467a388-dc1e-4394-8612-80f165d960f1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c70cd344-af09-46a2-8f30-fa16098b1359", "sighting_of_ref": "indicator--afaf9049-2d16-42af-a6de-8eeb58172e36", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fc96ee4-1edd-4dfb-9575-19c62fadaf3a", "sighting_of_ref": "indicator--b6026d77-5349-4c62-acee-ded32243e475", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b2d40f5-b6f7-4aa0-95dc-f620aeb9fce9", "sighting_of_ref": "indicator--6a73a57c-2892-4400-a180-a0c971706a50", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--896c340c-e6ed-41a3-9d81-7ce7bd86c4a8", "sighting_of_ref": "indicator--b97ab9d2-dda5-4408-98c8-c52b34710445", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bedf548-4e12-4816-9df0-b27dab3f692f", "sighting_of_ref": "indicator--8d3a0474-c379-454f-b38a-a7946d59b9b5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9e3cbfa-dbf3-4962-b6cb-924544d6f01d", "sighting_of_ref": "indicator--d0a93bcd-89e7-4473-9dda-ba9f9887eb36", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3d9a14f-93b2-4c2b-8e40-6fd309030aea", "sighting_of_ref": "indicator--6e5c2bde-42dd-4146-ad39-a7a5c79fdb9e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11b76e15-20e2-4504-b3ec-fc4786243374", "sighting_of_ref": "indicator--fb0d693d-2270-40e2-8f4c-dada92861e00", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eeadfb1-3149-41f2-970d-947043d9318f", "sighting_of_ref": "indicator--0374a3a9-3aee-4818-a419-c280f85a581e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8907b74-e584-4ea0-8f20-c0921984bd99", "sighting_of_ref": "indicator--ba3590ca-0508-4471-bc48-bc5d1675c1cf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf965068-a886-474b-b529-efeb069547a7", "sighting_of_ref": "indicator--10f600b8-0286-40e3-a9fd-f961b6e72f9c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--117fdcde-1288-4373-a773-79a174bdb6b8", "sighting_of_ref": "indicator--71327451-c03c-4287-ab5f-f56f7b580e9d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5e56e0d-3191-42f8-8955-f8f5ad289695", "sighting_of_ref": "indicator--6af4f832-ae4a-44f5-918e-d2bc1ec4f9dd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53fb2764-4142-4bba-bb19-ae33d08bd178", "sighting_of_ref": "indicator--fbcee029-94b8-4eae-8e84-4d57efc23747", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d813b65b-4bae-42ad-8902-973af1683101", "sighting_of_ref": "indicator--19b60e35-863b-4a6e-8130-adc1778aae57", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57da9e2b-3de4-459b-a55a-f09dc56be199", "sighting_of_ref": "indicator--19b60e35-863b-4a6e-8130-adc1778aae57", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f1766f6-cdd1-44f1-8b97-703c4555c04a", "sighting_of_ref": "indicator--b0ca2cc3-0b99-448b-bb4b-8ea5badc327c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--921164e6-4028-408f-acd4-5c7248323413", "sighting_of_ref": "indicator--b0ca2cc3-0b99-448b-bb4b-8ea5badc327c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--870ce6da-833f-4b43-9fac-a314a23a6bb1", "sighting_of_ref": "indicator--538b8011-7574-49b7-8a90-0bfcc56128fb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d285d6b3-53c3-4adb-9252-7d78e9c054e3", "sighting_of_ref": "indicator--44df3dcb-b5d6-4952-b306-58fa522f6113", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cfde99a-3867-404f-95f2-0fcb789884af", "sighting_of_ref": "indicator--48d76e7a-0c4d-44f7-af36-d5891d30ab12", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df0eff69-57dd-4ec7-9835-212fd25d2ea2", "sighting_of_ref": "indicator--d7c725c4-ce77-4a13-9002-0f2e889aad3d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfc192d8-9d2b-4390-b481-cef18014ac11", "sighting_of_ref": "indicator--56e95025-fb0d-4d07-82a1-b7b9e0809af8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f9f0789-5f65-4174-b472-31bbde6eac40", "sighting_of_ref": "indicator--e21bf05c-9e0d-4754-9395-11db12bcb17b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ec2e04d-547d-4dc1-a2c7-ea422651cf0f", "sighting_of_ref": "indicator--eafa3f06-d923-4d9a-8648-ce2066ba8797", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b1f2553-b94e-40a4-ac5f-ff08d8c13305", "sighting_of_ref": "indicator--0658264a-d8e3-4b8f-827b-12342905e283", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bccae0d4-33e4-4d82-b72a-619079d4282f", "sighting_of_ref": "indicator--5ce7422b-b577-4dd6-967e-90dc9d01b39e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c81a5930-abd4-4955-b769-272324fbe849", "sighting_of_ref": "indicator--dae13c76-0dec-40b2-a9a9-03eeeb549d7d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--daf2fa4b-ee69-4c2c-a794-398335e69009", "sighting_of_ref": "indicator--f783dfa1-1453-44be-b7c4-c8ef157e8f24", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3754bb83-d2c3-453e-b0f2-40fcc0fc9cf5", "sighting_of_ref": "indicator--44f647a6-55fe-49c6-b1a0-4efa4e43dc5f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fe640cc-a256-4e98-bdb0-9b8cd93a0e94", "sighting_of_ref": "indicator--b889f681-6ebc-4f25-b677-18b1a3b2a18b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--418d3941-9bf5-4618-b172-37d89d9c050a", "sighting_of_ref": "indicator--5c5adfc5-463f-47ce-91e0-db0b10d57a58", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce3161e8-6eb5-4d20-a7ba-2e1537c8990f", "sighting_of_ref": "indicator--e098f764-243c-40ba-aa93-7d55e1846f1b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c80e0e6f-4849-47ce-bc58-7712755899f4", "sighting_of_ref": "indicator--e54b5e1f-2bfc-45fa-8832-7973a328e9c4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4020656-838a-467d-820c-746eebcdd3e1", "sighting_of_ref": "indicator--e54b5e1f-2bfc-45fa-8832-7973a328e9c4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--367b4de7-34eb-4f51-9b76-71b3d9bea7fe", "sighting_of_ref": "indicator--63bdacec-fef8-4268-856e-99d24bfb64df", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a5da2b4-2167-45eb-be6e-c101b0881c29", "sighting_of_ref": "indicator--63bdacec-fef8-4268-856e-99d24bfb64df", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3fee87d-e6be-4f25-8794-2b50d33ac4b8", "sighting_of_ref": "indicator--0eb5d63e-6c81-4ceb-add1-cc54f556d6a0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17c8f310-251f-4a66-a896-689c29107c0a", "sighting_of_ref": "indicator--c3f2dfcc-2ec9-4f4e-ab0a-b8b9e392b9d3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acaa3343-ce2b-4af1-a39a-c9d51729d066", "sighting_of_ref": "indicator--3b70212f-1108-425d-be2e-8268da74644e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--024741e2-9e6a-4bda-80b5-44f416da0cda", "sighting_of_ref": "indicator--889d639b-80df-4b71-99be-cf4e22db1ebd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f918fb8-1d58-40de-9095-b663d10efc7f", "sighting_of_ref": "indicator--cf3cbae3-8406-4adb-8d84-dd0c3d7cb6fe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c564db5-3287-40e8-a438-33ea07af5bae", "sighting_of_ref": "indicator--cfbaf6c5-0cbb-4b51-a09c-fb20a01c05bb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3d211cd-a5ea-4541-9474-4c810376d335", "sighting_of_ref": "indicator--2bdb5ffb-e726-44bd-b14c-0ce49cbac6f9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be7ebc45-d184-4552-9b66-e13d2b0b8b07", "sighting_of_ref": "indicator--ae33233f-a941-46b8-a500-0764a6ae83ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f449394f-b409-4372-a8e6-3a6a5b8ef8e5", "sighting_of_ref": "indicator--66fc6b5d-70e0-4db5-92c8-5d403001cd5d", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c5deaef-3341-45f8-ae85-874065d58feb", "sighting_of_ref": "indicator--bde5f68c-24f0-46ba-943b-b89059805387", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bcd7a05-cb7f-4143-ad32-4c255f398ffc", "sighting_of_ref": "indicator--19630739-9962-4cad-b277-ebd4500dee61", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adf32c9f-1747-4454-8d7c-f6a2b0fd55b6", "sighting_of_ref": "indicator--c564a5de-653b-4100-b259-193804166ea0", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--265467da-6491-493e-a57b-35665ff86c2e", "sighting_of_ref": "indicator--58bc3f85-7942-4c3d-9d93-975299580437", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7f65999-7508-43e9-a0f0-8dfc6490a57e", "sighting_of_ref": "indicator--f1e3d595-7515-4b48-8509-c3227e26e31c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae69b349-5d99-4963-a762-961d9bdde9b5", "sighting_of_ref": "indicator--7dc5dc21-1496-41f5-8317-84fdaddf00d9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cde86253-a664-4091-9fe1-7cfd943efd67", "sighting_of_ref": "indicator--7dc5dc21-1496-41f5-8317-84fdaddf00d9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f601d397-4180-4255-bb15-550edaf0ba04", "sighting_of_ref": "indicator--96243d77-b216-43c9-904d-9d457e930414", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06d24351-e293-4c7b-abd0-bb1cc2e57189", "sighting_of_ref": "indicator--69732358-2d63-465f-9a51-82ec3c9c711a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac213523-1b1e-462d-b991-de7a200e76d0", "sighting_of_ref": "indicator--69732358-2d63-465f-9a51-82ec3c9c711a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2b77043-e7f2-4944-b02f-53955aaad094", "sighting_of_ref": "indicator--94cbbe45-e441-48e2-9caa-bd0fe50e0584", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--565ebea1-0936-41b2-b46f-af8af9258965", "sighting_of_ref": "indicator--30c909df-55de-4e3e-82f3-a668d5a2082f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a15312f7-3f7c-4e4b-8585-69dccea2e2a2", "sighting_of_ref": "indicator--30c909df-55de-4e3e-82f3-a668d5a2082f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab2b5446-dac9-432c-89b4-e473dc698e5a", "sighting_of_ref": "indicator--e5231375-b4f4-4b09-b508-8e279c3bc358", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a83aa8a-ea50-4ce7-b473-8a476c5cfda4", "sighting_of_ref": "indicator--ed8901f6-e35d-4f1a-9642-4852ca421356", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcec768d-fd96-405a-b551-3b2e72db5652", "sighting_of_ref": "indicator--e26b4e0f-b628-40fa-8dc5-b17da46a8273", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fbf8771-4739-43f6-abc3-cf9c8c735349", "sighting_of_ref": "indicator--e26b4e0f-b628-40fa-8dc5-b17da46a8273", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fe59b6c-7ebb-45df-bb5c-f01676a51436", "sighting_of_ref": "indicator--0a455a4a-b4d4-48d9-a5bd-19a69b5bd660", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bfe1cd2-01f0-424c-a867-5c106a605d6c", "sighting_of_ref": "indicator--98b49e92-fde9-4989-9362-91601b5f6a97", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22d27f6d-12bc-49ba-bbe4-44587a9ee638", "sighting_of_ref": "indicator--4d671bb6-79b3-4b73-8e7e-0f7a02c8ae07", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf33f30d-3e9e-4b4b-8dea-37f8d91063ac", "sighting_of_ref": "indicator--4d671bb6-79b3-4b73-8e7e-0f7a02c8ae07", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99babe5a-0d86-4046-9369-7bd5c745a291", "sighting_of_ref": "indicator--90578a65-d388-4c60-afb6-7f9a95623494", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1b55626-356e-4ae9-b97f-68211744356a", "sighting_of_ref": "indicator--63448f13-b372-440c-beb9-f5cfac192c4e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ed382a0-6f50-40bd-b1d1-81a8effa66d5", "sighting_of_ref": "indicator--8272356f-5e75-422f-b97d-4a80a540c9dd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00df50cd-5954-4d9b-bd01-53d02fceef9b", "sighting_of_ref": "indicator--a5f7ce97-f720-4d0d-8b30-6312a9c37a99", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0871939-5855-47f8-befc-2b98e4d2797d", "sighting_of_ref": "indicator--31099ce4-947d-4acc-816f-06ae581ca7af", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06246c09-3c03-42bf-b626-51fbb3361a68", "sighting_of_ref": "indicator--358874f6-ced1-49c6-a5f9-96190a78e8cc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbcfda55-8233-4a3b-850a-85a333f21bb7", "sighting_of_ref": "indicator--709828c0-0a2f-4838-8420-515a6a93b4da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--badc0ef7-c1e9-4218-9abe-2540c02335e2", "sighting_of_ref": "indicator--709828c0-0a2f-4838-8420-515a6a93b4da", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--575996e7-91ce-43a2-b78e-748101f43196", "sighting_of_ref": "indicator--d70684db-e5f9-4c52-85c3-ccf46ab30f29", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b639bf8e-a569-4719-b376-5aeb13e92a34", "sighting_of_ref": "indicator--5274407a-d1e7-4446-be09-0397ccc46b7f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c7b1b95-6054-4fb7-8feb-8f4240a56dc1", "sighting_of_ref": "indicator--3f90ea8c-3df4-4312-bb1f-8be290c97f2e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9724a6d3-7c34-4d07-807e-51bf24ff3832", "sighting_of_ref": "indicator--3f90ea8c-3df4-4312-bb1f-8be290c97f2e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1974684-c65e-4596-b0cc-20876f239c67", "sighting_of_ref": "indicator--f68e0d8c-f8df-4e57-b87b-3e13fbe34352", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23c04352-ef28-4513-8a63-a6d867c97f81", "sighting_of_ref": "indicator--aceb5b03-a865-4799-a291-33c3818e3dd4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afd23772-00b4-4599-8a0c-b95a428badd1", "sighting_of_ref": "indicator--8901726b-b703-424f-abad-fa80386e9701", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--458a636c-4fb9-4470-8359-1068f8bd0ce2", "sighting_of_ref": "indicator--b9c21c3d-9b51-4e2a-9701-0b9c4841b438", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27bac033-c7a2-43d0-9a53-4665a7f020a4", "sighting_of_ref": "indicator--39656d92-2c74-4326-bfee-a59d8ddb7231", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--022e2505-7cdb-4ca8-b03f-b24090e7025b", "sighting_of_ref": "indicator--1ad2bbc1-31da-446b-abd6-a9fcd28e2ddb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0577153c-0728-43f1-b720-917ecedeaf7b", "sighting_of_ref": "indicator--a925bf43-ef43-48a7-98e3-fa1341184d8d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1661b79-4dfc-4dc6-acd7-20f3b665ebd8", "sighting_of_ref": "indicator--5a6e17b3-f4c6-4874-abe4-cbd0db3c1b94", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc993f92-fa3f-4979-ace7-2b96c143432a", "sighting_of_ref": "indicator--d44f1de0-3940-4689-b1b0-368e2f736f86", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ca284dc-93d6-4074-8ede-a2f391ea7ed3", "sighting_of_ref": "indicator--c85839c5-6131-47e0-932d-a338ef5d5131", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--627013c9-15a1-480a-bdd4-7f50da2a9560", "sighting_of_ref": "indicator--aab163e9-13c6-4296-9a01-6999ad5253c9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9db34489-e8c4-48d9-ba82-ab55da9af37f", "sighting_of_ref": "indicator--b37d7245-852c-4e04-a81c-49610df04c1d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--369a07cd-84a9-452d-b049-8f98541455cd", "sighting_of_ref": "indicator--97749c7b-452a-4dd4-8910-a53377a1ef9b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4dacdbb-ca59-41ca-80a0-83316cde491a", "sighting_of_ref": "indicator--426ce966-ac2b-46f8-a4a0-b17151e23e8e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4357e0c-cfa9-4b35-bf90-61553141e531", "sighting_of_ref": "indicator--a4f410d1-50c2-47cd-892c-2cbb4ab3aa32", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f2d6974-bfca-4fe4-8d92-b7562c024732", "sighting_of_ref": "indicator--a4f410d1-50c2-47cd-892c-2cbb4ab3aa32", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--970c5b0a-46ad-4061-bb17-17c13c22dfd9", "sighting_of_ref": "indicator--06edb523-8840-423a-8981-052143c837eb", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39482416-5fa5-48ed-aa61-0008398c8562", "sighting_of_ref": "indicator--05447483-6a7d-448d-95f6-40a34739cbc4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6be5665f-8309-4281-ae87-53790ec8b7bd", "sighting_of_ref": "indicator--720938ba-91c8-4fcf-9dbd-e9ceec67a00d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ffb4c56-ef27-4a3e-9bd7-e795bb8e4a12", "sighting_of_ref": "indicator--b7037ccd-ebe6-443f-b9cb-a30c2c534752", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0975a374-dfcd-4f21-87a3-765cf624633f", "sighting_of_ref": "indicator--2dc1c146-cbfe-412b-a214-4f6addca4bd9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e4851db-75a4-4afb-a48b-2426b5ed5160", "sighting_of_ref": "indicator--61358551-e28c-4859-b5f3-eb48ec8eccb3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32059bfd-7c83-43be-b86f-a61b8d7e87df", "sighting_of_ref": "indicator--dfaa4d65-75ae-40d9-8ca6-3289a02f92b1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f4ea07c-20ba-42e6-b210-03cb50452e83", "sighting_of_ref": "indicator--baebdbf3-6d55-44be-a447-ae146596fba5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f15525e0-16ab-4d3c-9fc2-c9d5a8970230", "sighting_of_ref": "indicator--2a7fab66-ec8f-42d8-8111-4286d1bbb30f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b687e638-9893-4ffc-b2e2-48b35530c8de", "sighting_of_ref": "indicator--f4a0541d-24bd-448a-a5e9-453813068086", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac6ad281-878b-45b4-b6a3-106d2983d61e", "sighting_of_ref": "indicator--7e094c6b-b5d6-401c-bf4a-10a332a9ee63", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0c58443-3606-4eef-90dc-ef973f91ff60", "sighting_of_ref": "indicator--7e094c6b-b5d6-401c-bf4a-10a332a9ee63", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4212894e-b3ae-44a2-af43-11aee2856b23", "sighting_of_ref": "indicator--9c8ac6e9-7b75-4bae-8f93-8882aff7624c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6cf5f7e-14ea-4441-a7f3-c7248f30d236", "sighting_of_ref": "indicator--9c8ac6e9-7b75-4bae-8f93-8882aff7624c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--909e0e06-d197-453b-863a-6fb310316c54", "sighting_of_ref": "indicator--a7e1636a-b563-4c2f-8aff-711b10d0af06", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b040e37-20b4-4bb2-bdbe-6ec52ed53ca7", "sighting_of_ref": "indicator--98cb1824-6311-47dc-ba85-5d5fcbfffa56", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04730c10-3e73-48b5-a9ec-dcd28c785784", "sighting_of_ref": "indicator--919f5e01-1735-4932-8076-d6c75bb17c62", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5fd2a3a-99a4-418d-8bd6-09c6cbe54374", "sighting_of_ref": "indicator--521b780e-b0a0-4ac6-854c-07716a5245fb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36b99df7-8204-4041-b0df-d6435c79fde6", "sighting_of_ref": "indicator--099b35d0-a898-4fed-9474-b0b2dba99d86", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a843d428-9977-4d69-bc20-155c3fa10cd6", "sighting_of_ref": "indicator--08bb7415-d22b-4c1f-8c7d-67a43b41dc7d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baec87a1-85b3-4ff1-95c5-222c0bb90c0a", "sighting_of_ref": "indicator--6835740f-afe2-49a5-9ec8-aa5bb6ec6dfc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc116019-6288-49c7-bfc6-ddd36af2c239", "sighting_of_ref": "indicator--c3502ec9-3b49-497b-a4e4-31b6ade238e7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b15e0ba0-8007-4b99-8346-bcaf13842463", "sighting_of_ref": "indicator--323e0c56-7403-47c9-af8a-41f6bbb5339d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eadc6fc8-8f9f-4a57-9a15-a4306b55e830", "sighting_of_ref": "indicator--323e0c56-7403-47c9-af8a-41f6bbb5339d", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--227dedb7-ee12-4a4b-9cdb-271721679b00", "sighting_of_ref": "indicator--bf9002eb-e49d-4a78-ad4d-f95e921f7d85", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee2dd7e3-2c19-4fce-9bb3-273630524545", "sighting_of_ref": "indicator--f2a957e4-1f09-414a-be14-7ed39ba92601", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5b1296b-5eee-47db-82dd-62335a5514ed", "sighting_of_ref": "indicator--fa008aa6-37ab-4462-92c8-a720fdab2e00", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a84a91b5-62c2-4258-8f0c-0d6bb169345a", "sighting_of_ref": "indicator--4c907030-10f1-4c6f-90ee-15492997c1e2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8acea477-10f3-4fed-b2ee-0e8b45426a5d", "sighting_of_ref": "indicator--112d36c3-d9f2-4dc1-9a1e-23753b3ebc44", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22638ed1-f508-473d-998c-0398a6feb21f", "sighting_of_ref": "indicator--e9ac623e-b5a9-47e8-882e-ef654dc07770", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a49ce687-f46f-4bac-b3f6-1d8a35074819", "sighting_of_ref": "indicator--93c2fe3a-eb97-4b0b-886b-c14f1f8dfa6b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08a5015a-dccf-44d6-8ca3-a30b02f005e9", "sighting_of_ref": "indicator--974e0aeb-5729-4e19-a018-845a7b362191", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0bf67b0-5167-4ce2-9c60-ed5f7c7ad5db", "sighting_of_ref": "indicator--974e0aeb-5729-4e19-a018-845a7b362191", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acfef85f-c535-446d-bcac-7be1516d8dc4", "sighting_of_ref": "indicator--1e174166-92b3-4746-9ef0-e121804e1961", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2ee8857-b8c2-4773-8db2-8c5ddd8bccf7", "sighting_of_ref": "indicator--1e174166-92b3-4746-9ef0-e121804e1961", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8d88c6c-e2f4-4855-9efc-eebb6ceac166", "sighting_of_ref": "indicator--cbb28408-e39e-4e74-ab29-fdf37f6b9a11", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f27a196e-3813-41b5-b77c-b541e25ca350", "sighting_of_ref": "indicator--bd63b271-4363-4eac-bb77-740da4eeced4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89072fa8-8b04-434a-8254-90df3b0d2889", "sighting_of_ref": "indicator--b15989c0-6b4f-4ab8-95e3-16121048c9f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bec03c45-d104-4ae8-9ed9-c9dfbbf5a3e6", "sighting_of_ref": "indicator--be4c6669-3389-4cce-b4e7-8aaf04e850a7", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aec99dfb-8256-4595-becb-a32461308773", "sighting_of_ref": "indicator--05381785-07bd-432a-a893-2d91c6757222", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5ec800c-6556-47bf-8038-a200087dd5c8", "sighting_of_ref": "indicator--d56d37f9-1bf1-43cf-91ad-974f07e0cf04", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a30ee30b-3144-4285-9fe7-c9981606f7de", "sighting_of_ref": "indicator--bacb0ccd-a970-4b33-bb49-3527dbdfb57f", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73cc6025-2a39-4094-9bf7-67ab2c8d2102", "sighting_of_ref": "indicator--b8dee123-5e98-485b-98db-98a6ef91ffc0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4fa89ce-3755-4505-aa41-8a2dcd75b7fd", "sighting_of_ref": "indicator--83cb6ab5-41fd-4cc8-9efa-53b17681a1ea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f00d336-9fb7-4e34-934b-80017477256f", "sighting_of_ref": "indicator--acc3b059-8504-4282-a7a8-ff42f67e0ffe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77d01cdf-fed6-4abf-b2f3-0b9f4ee50cef", "sighting_of_ref": "indicator--3c02e2d8-4e65-4e58-b9f7-1f1402ece82d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89dae52a-46e9-42fb-b674-d2861f002e49", "sighting_of_ref": "indicator--d5a2ad9e-f95a-444f-ae25-01ee26e2b164", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f797776d-a7f7-4a24-8108-4d380d5b299f", "sighting_of_ref": "indicator--5111b3db-deac-4901-89a7-140ba0113d6d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32ac51d2-0217-419f-b99e-303a5baab885", "sighting_of_ref": "indicator--c5fe0172-fe67-498f-b882-10a7138413f2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fe1aeae-6c26-4438-a769-68255d035a4a", "sighting_of_ref": "indicator--c5fe0172-fe67-498f-b882-10a7138413f2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48695293-298c-434e-8648-40bae2900284", "sighting_of_ref": "indicator--7a718064-16b2-47c4-947b-3a0f5fe71532", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87df4003-1443-4d52-bc99-424888c7e4f3", "sighting_of_ref": "indicator--5dc92643-8f0c-44a2-94f9-ed8651d6b26e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40a83668-8aa0-4c88-9e36-5b0cd538d8a8", "sighting_of_ref": "indicator--77626f97-f057-4324-a593-d5afdef2d07d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--622d2faa-2c57-4a7d-b595-efaaf399924a", "sighting_of_ref": "indicator--7c2804eb-c3f0-4460-b37b-64f65ad8c859", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dec708de-d6ad-4a68-a991-180e8a62a160", "sighting_of_ref": "indicator--b9d6e36f-4c87-46e2-8ded-a308ebb35019", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33b8c5be-6d50-4acb-ba53-0ed01140251e", "sighting_of_ref": "indicator--d0647f0d-f790-4ea3-a34c-04b76ffc0a5a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43b9afd4-09a1-40ee-9b18-3ec91bab1b35", "sighting_of_ref": "indicator--ad6c9ac7-3888-41f9-b7dd-33fc8132ac6e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66cb8a57-d01d-4e8d-b408-7dc376ee1b28", "sighting_of_ref": "indicator--50cf6d23-54c2-4eca-84b6-c693479140d7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ead38d4-71f2-4c88-9818-4ac47220e816", "sighting_of_ref": "indicator--daf30211-0dee-420b-a715-f164de3785fa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--463c650b-01d5-4b34-bc91-d751a44ca30a", "sighting_of_ref": "indicator--e46b9f63-3dce-4a82-8724-c27b6232b651", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdafda84-9dcc-4521-acc3-4fc42ca67899", "sighting_of_ref": "indicator--1d95e836-7da5-4be5-81ad-ac4f1e082bab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1614818-09ef-4854-90c6-8246233c3b06", "sighting_of_ref": "indicator--1d95e836-7da5-4be5-81ad-ac4f1e082bab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c438991-bab5-4156-9372-fba3dc682507", "sighting_of_ref": "indicator--b0f2504a-a5ce-47aa-9fe6-31cc6018c77d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbd12fa1-4e85-4afe-bed0-3c0226c6ed75", "sighting_of_ref": "indicator--5fa152a3-e2a7-4c0d-9999-eed4c5b5a445", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9500e09-ab99-429a-a8de-5a7dbe9138e8", "sighting_of_ref": "indicator--623c91d6-1ae3-43b1-9551-df89ababc0ef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76131d1b-4ac7-43ff-82dc-1cbb3786c694", "sighting_of_ref": "indicator--54673ef9-34c1-4359-be2f-6da0388df869", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8ebd8d2-0707-495e-a505-cf8e76bbc028", "sighting_of_ref": "indicator--729d6f74-66ba-476c-a97d-75bfc17ad397", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7d026a3-360d-4849-9df2-5838e2c8fed0", "sighting_of_ref": "indicator--c8e294d1-719c-4b15-8c09-3a55c846b81f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84d110d5-84a4-4201-b1af-45072d0aa0c9", "sighting_of_ref": "indicator--bac08e19-3fe6-4e61-bcb8-654a4befb3fb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--039143d4-83dc-49af-8241-673fab2df27d", "sighting_of_ref": "indicator--43a2d8bb-8612-494c-a735-3fb8de0453b2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--142eb318-4682-469b-83d2-42af9631ab68", "sighting_of_ref": "indicator--9907f00d-d96d-4f6a-b1cc-702e75500894", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--337016a5-1a73-4a27-913c-4cb7966900f5", "sighting_of_ref": "indicator--e10b51e1-58af-4e41-8b85-c5b7965e2c61", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3bd8f43-2a04-426c-b7b1-8e29186543b2", "sighting_of_ref": "indicator--f1e0d6ec-1e9c-475d-a434-645bfa56afd8", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01e8cc55-3af7-4ff1-8eed-7e424ba9cd67", "sighting_of_ref": "indicator--e1de1fad-f1e9-4390-9efe-0a091ef23828", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f335584-1858-45d4-a3a5-d8487147e0a3", "sighting_of_ref": "indicator--74978029-0510-43cd-b27f-7a18bf702db0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0512bf87-0468-47de-8e63-e5b75a56f3c4", "sighting_of_ref": "indicator--ad72c0a7-6a78-4e5d-8edb-b255cda4e5bc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3fe6fcc-047c-43ed-ba3a-ea3d54142318", "sighting_of_ref": "indicator--6ddffa84-95cd-4f96-b259-556528b12397", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--287d7a34-c9e1-4950-a951-be2b6e6a51cd", "sighting_of_ref": "indicator--6de3fa10-dc95-4b1a-908e-b31b5a4c9630", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bac4023d-f2d5-4016-9bea-64c8e8195525", "sighting_of_ref": "indicator--96a528b1-75af-4542-9661-7ad7fef1dce8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--526ce971-d402-4e49-b52a-0348b02edf44", "sighting_of_ref": "indicator--96a528b1-75af-4542-9661-7ad7fef1dce8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1ac5eca-a8cd-4411-b881-19a4f3635a57", "sighting_of_ref": "indicator--46672ead-2f13-4028-9316-e3afd28566c5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39f1f106-75a6-4aa6-bd29-56d864da9dc0", "sighting_of_ref": "indicator--79b2f3ad-ce06-4d34-8d1e-3b36ee2e20b4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--543dc008-b754-42dc-a8cd-66cb86cbea26", "sighting_of_ref": "indicator--d96e409e-ef03-4837-8eef-7abe375436da", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1b7b797-0a12-4735-87db-6edc62a10970", "sighting_of_ref": "indicator--4b98792c-c49c-4ddc-98e0-86bf434597aa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cd56f2e-da88-427c-aedc-6ff886ae6040", "sighting_of_ref": "indicator--bff13c28-5877-4941-8038-3e8fdaf469d6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de96b8a2-e0fe-495e-86f5-ab9fc33055ef", "sighting_of_ref": "indicator--bff13c28-5877-4941-8038-3e8fdaf469d6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33f250d6-3a50-40ed-baee-9fd4a24129bf", "sighting_of_ref": "indicator--48ef96a6-780f-4952-a144-3dc7a185ddf9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e49787a-5833-4698-a2c5-704007067b4a", "sighting_of_ref": "indicator--1c237745-e53d-48ca-b140-714f131865ee", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0531921-c720-4509-9df1-526191e034b4", "sighting_of_ref": "indicator--28778b69-b5ed-4641-8340-6521e3c62c07", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--174ba75b-6c89-41b2-b4e3-caa6f80c5eea", "sighting_of_ref": "indicator--8913c985-d516-407b-b840-b638c95860d8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7264422a-a0a6-4a30-8a28-6417576cda09", "sighting_of_ref": "indicator--8c4a1569-28ae-41ce-84b3-be4c020e8972", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7695fa4b-b787-470e-83ca-755953b475e0", "sighting_of_ref": "indicator--5bb30ea4-4447-440a-9970-41deceb6ad2a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c7b30c6-63fb-427d-801f-225ad65afaa0", "sighting_of_ref": "indicator--54e6f9ab-2004-4c08-93d0-bcb01da1530b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bef73202-98c5-437f-ad2a-9918dec1c2c4", "sighting_of_ref": "indicator--76dae6f4-6046-4279-90e7-2fb65c4f56f0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdfb9cb3-bab4-4815-9ba0-27bcf6c5d8f6", "sighting_of_ref": "indicator--954de1bb-da22-4abe-8f0e-4f413762f8a0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea9ff03b-befc-4f41-a7d3-f4366217656c", "sighting_of_ref": "indicator--c024719a-ae85-4b48-8c3b-923ae96c14a5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc7d59e4-da51-4057-8fe4-05bc0b3fc5c9", "sighting_of_ref": "indicator--fed53361-de9e-4aa8-ab75-505e96e53d33", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4e2f74c-3b38-49a2-a4f7-93a1c65b0489", "sighting_of_ref": "indicator--affbbd40-b0dd-445a-8490-84556a5ca176", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53b6845d-58b4-46ab-9e14-2e7b666926d9", "sighting_of_ref": "indicator--483b7881-a33e-45e2-8ab4-e4a720bcc40f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--752239fa-bf18-4764-b18f-f8a4f349871f", "sighting_of_ref": "indicator--fa9693bd-432c-44d5-9bcb-a2fb93ab5139", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58f0c3d5-c35d-4220-a5e1-99c23ed23219", "sighting_of_ref": "indicator--bd393160-f8bf-4d3b-abc7-a322f464cda3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7af8e7e5-b20f-420f-b185-dea9f68530b0", "sighting_of_ref": "indicator--6e5e0393-378b-4901-8c6a-6053d2e61353", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e97f455e-2f8e-4e24-9a9d-e33dbadfc302", "sighting_of_ref": "indicator--d9579b18-4f12-4ba0-912f-6c79a71f9b12", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e47fee5-1ad6-4102-852c-573fd7b3e349", "sighting_of_ref": "indicator--d9579b18-4f12-4ba0-912f-6c79a71f9b12", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--556b02f8-6193-453a-8823-4746a4e7f93c", "sighting_of_ref": "indicator--f830432b-58d4-4b19-b615-f9ed5ca76942", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc7a776e-ebe0-4044-bd54-a2026d4aa76d", "sighting_of_ref": "indicator--bf64fdd7-82dd-4a71-a5c0-1cdc9ad86ad3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef1ae8cb-d563-452e-bfd4-16a6f14df42e", "sighting_of_ref": "indicator--0da99aee-5981-4c5f-808e-308bf66b3d6a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--536e11d1-9014-4334-ae0e-c01f4e6cf1b0", "sighting_of_ref": "indicator--92d9f28d-4679-48a1-96cf-ea6992521e67", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--694f4a6d-51c6-470e-878f-5d5b16622de0", "sighting_of_ref": "indicator--5f10badb-1265-470f-8f77-d71bc4af714d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2525e0c-edec-4d4c-8c44-f6e69bfb263e", "sighting_of_ref": "indicator--5f10badb-1265-470f-8f77-d71bc4af714d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7475f3af-b4dc-42e1-a003-c11a782dcf8e", "sighting_of_ref": "indicator--dcb2cbbd-f26e-4dc1-8de6-c487bbafa3b6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4008c17-cbe0-468e-82bb-634e2ab90c6e", "sighting_of_ref": "indicator--fc9078b3-e4be-49cc-b8d4-ef4cdd0acf21", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59883d53-bcc4-470d-a2c9-a934d866e3d0", "sighting_of_ref": "indicator--0e07571f-8f8b-478f-a880-8d129e28e36a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--962899b8-32c8-4836-b66b-8f2f81b85d28", "sighting_of_ref": "indicator--35c16b8e-c97e-4e31-8dd2-1dbf3ecee22e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c93e5b5-8218-4c53-a5e7-07b1eec1ec64", "sighting_of_ref": "indicator--35c16b8e-c97e-4e31-8dd2-1dbf3ecee22e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a9d8432-5187-42d8-af41-b6da2083f35f", "sighting_of_ref": "indicator--b3b4dc21-21ac-4b9e-878f-c2170b9e642d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6044103f-7bc4-4965-8129-c093de94cebf", "sighting_of_ref": "indicator--68c6f2ee-367e-4743-9a19-9434b8e10936", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20902ab3-8b3a-4852-8e5b-70ea5b0ec685", "sighting_of_ref": "indicator--2c2fbb1d-596b-46b7-87af-ab99b48b752c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e32ae0d6-dbbf-4eed-9a7b-b00fae70446e", "sighting_of_ref": "indicator--e15fd08a-51fd-4c3b-97f9-8eb6fbd1f3ea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fa924f4-500f-4785-a626-ffcd6cf0c457", "sighting_of_ref": "indicator--96428db1-8e52-4cc6-b214-058e62e9585b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42d56dd7-996a-4787-933e-99fd7333642b", "sighting_of_ref": "indicator--40478924-85cb-4c7a-abcd-3121a909aea3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--929b053e-cbfd-4787-9f1e-3bd99078c795", "sighting_of_ref": "indicator--40478924-85cb-4c7a-abcd-3121a909aea3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73baa36b-cc61-4d7e-abfb-f12550490909", "sighting_of_ref": "indicator--4086290b-cf25-40a9-9cf4-5af362bc1f33", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--502e088f-2994-48af-a42b-d5cd266e75ec", "sighting_of_ref": "indicator--4086290b-cf25-40a9-9cf4-5af362bc1f33", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8207dc72-0148-4985-a6c2-1aa1c380a58f", "sighting_of_ref": "indicator--4086290b-cf25-40a9-9cf4-5af362bc1f33", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bfc29b1-e85b-49c7-b1e7-8d159e653202", "sighting_of_ref": "indicator--4086290b-cf25-40a9-9cf4-5af362bc1f33", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c41bb54c-e2f1-4c49-96cd-17b9c6ef6039", "sighting_of_ref": "indicator--b2dc91c8-fbfc-4fa5-a675-ba2309bd92d8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df2425b0-83d0-4647-918f-db2e0a88c695", "sighting_of_ref": "indicator--b2dc91c8-fbfc-4fa5-a675-ba2309bd92d8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf30d963-13ff-423a-a7b2-c20e2fa41bb2", "sighting_of_ref": "indicator--31607b4b-e4f9-4502-9dda-33a4b624e129", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a6c4a38-a87d-49d1-ae77-f9513e3a5b5b", "sighting_of_ref": "indicator--31607b4b-e4f9-4502-9dda-33a4b624e129", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68accf7c-c06d-48cf-b5e6-375aa0b93c83", "sighting_of_ref": "indicator--6e194ffe-3f66-4337-b3ac-d055c4964c0a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c1ebc9b-9688-4005-9d43-cc4f4d4452b4", "sighting_of_ref": "indicator--1462f14a-9aae-400b-81ba-537861bbd590", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--205d38c5-d755-4993-aa81-3d01be4ecfe5", "sighting_of_ref": "indicator--1462f14a-9aae-400b-81ba-537861bbd590", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c8c0e05-18d9-4b23-b32f-c70d72f33d8a", "sighting_of_ref": "indicator--c73f8fe4-2015-47d4-8d49-2eebc47f159e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e4961fb-ae6a-43f1-a350-d0829de7bb15", "sighting_of_ref": "indicator--72c18edc-3cda-4bc4-b22e-37fe66a963b1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--661226aa-f5bf-4610-94c8-a7adb622e076", "sighting_of_ref": "indicator--94ef9de4-a9d7-44ab-99c4-2cdae9c512c7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67d3c63a-d849-49c3-a3a0-23f37c0b01a4", "sighting_of_ref": "indicator--0393550a-3c88-4e5c-9983-cf34b268f43f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d11003d-2409-4e35-b2ff-1e10eb367396", "sighting_of_ref": "indicator--9d1289d2-2f6b-4876-9c87-7a5388d4a024", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f4fbe71-bd47-4d08-852d-f637af543ba4", "sighting_of_ref": "indicator--0877a1fb-f5af-4191-b228-259948aa90ea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fdf1456-6b68-4b3c-bfa5-05c93bda5912", "sighting_of_ref": "indicator--c7b34ba4-d88c-409f-904a-c966e0bd06cc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--880dd107-ea93-45fb-b060-d8089c160703", "sighting_of_ref": "indicator--ef3a8746-a869-4318-89ab-a94c2e0c89ca", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d0b75d5-9397-498e-b895-672888ce1aab", "sighting_of_ref": "indicator--ef3a8746-a869-4318-89ab-a94c2e0c89ca", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a05f9c14-38a9-48d2-8292-dd21c9e37349", "sighting_of_ref": "indicator--45cb43e6-8628-4a02-8e7a-474f9294f134", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--787d4e4f-3509-413e-a9a9-d513bafe67d5", "sighting_of_ref": "indicator--45cb43e6-8628-4a02-8e7a-474f9294f134", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7982351a-ef86-4002-8590-e4e3656e1db5", "sighting_of_ref": "indicator--1dc456e0-2e54-43b3-96e0-08d655cd55a4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34d2715f-7f36-4ffa-bcb7-dc6affeb8d8d", "sighting_of_ref": "indicator--6a01e35d-0646-4031-a5d0-0659de6ea385", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0855a914-b958-4b10-9fff-e67f56a7fc76", "sighting_of_ref": "indicator--4c48b3d6-e5d8-4cb9-b6be-517e01bd6555", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d769d51-faa7-463c-b49e-e1fe2bbc775d", "sighting_of_ref": "indicator--4c48b3d6-e5d8-4cb9-b6be-517e01bd6555", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12457b53-f14b-4a1e-9795-acd7d8f6daaf", "sighting_of_ref": "indicator--123958b2-aeed-4029-948b-4d06ac44a17c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a91a6844-0175-430b-83a6-b6336381cb9c", "sighting_of_ref": "indicator--123958b2-aeed-4029-948b-4d06ac44a17c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a11a4ca2-9c03-4d86-b7e9-f0c846a1376e", "sighting_of_ref": "indicator--ee422511-8340-4552-8582-2e75254b7af1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98e0c6e9-f568-43f9-bfb9-5de08840f9e9", "sighting_of_ref": "indicator--998d0017-78ff-4380-bad3-d63941c44704", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cdb5b91-3454-4332-a9bd-fd90642ad664", "sighting_of_ref": "indicator--7004ac8e-85c8-488e-883b-46514dece460", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77b335b3-b18e-4ade-89df-1bd79b1117ca", "sighting_of_ref": "indicator--89ab4b31-eb12-4bdc-84c1-b3eb62328db7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d69e4250-e3e7-44f2-87a6-3c81cba26786", "sighting_of_ref": "indicator--86bd80d0-0ce3-496f-8738-b293027cfe19", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1444318f-c7d9-45b9-9881-c09ad97b49c9", "sighting_of_ref": "indicator--dfd71f15-c8e7-45c0-82fc-5ff141946be3", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f58e4246-13c6-4442-94fc-0b7e72b3b832", "sighting_of_ref": "indicator--a015fc75-b8b4-496d-96a5-6a07240a3673", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--105ce90a-5d15-44dc-9ca0-58d59c871e92", "sighting_of_ref": "indicator--5977580e-8c1c-4dbd-9521-a9111efb10c7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18294a9e-f47f-42a1-8a86-db6d805e995c", "sighting_of_ref": "indicator--ccb21e1c-2740-4017-b562-ca0ecb26c930", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82eb985b-ad3a-4bdc-b61c-d871d58dea57", "sighting_of_ref": "indicator--4ddd9fd8-41ff-47ff-a353-fc53ba35c210", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2012f90-ae9a-4094-bd77-68c1736599e5", "sighting_of_ref": "indicator--88d057d5-07e5-43ed-9432-4de0c6c0c7c4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a429ca5-c43f-4e3f-92b6-0ec22bd87463", "sighting_of_ref": "indicator--2a65427b-9560-4ba9-b6be-fd9435ad3fb2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d4613e0-2268-467d-acbf-60464cabf242", "sighting_of_ref": "indicator--8f3894b2-e9b8-47b4-8858-9816365c656e", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1719a76e-5cec-4431-8dee-7a9004451a16", "sighting_of_ref": "indicator--79be4dc0-5e9d-44b1-a763-70c8e323dd75", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba9cfa59-05de-4722-a116-e6d57042fa11", "sighting_of_ref": "indicator--61b25826-d71d-43ff-80a6-dc316e29a1f7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--215cf123-f1ce-446d-9e89-af92736dc138", "sighting_of_ref": "indicator--74ad9178-f912-4245-95c6-94acc2032538", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aba96270-9b89-4f38-90be-a81bb0048c42", "sighting_of_ref": "indicator--7a9f3582-15c3-491f-81b8-c1cef95fdb6f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--592b9d89-86cb-47ce-8585-e9081d26f000", "sighting_of_ref": "indicator--9571ddf8-77aa-4a6d-8a4f-470c7b954d94", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--804ad910-79f5-4068-a8f1-59807023dc68", "sighting_of_ref": "indicator--999b1346-0788-426e-bce2-4c19f9767735", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f705a67f-a8fd-4126-917b-9692fdba16d2", "sighting_of_ref": "indicator--530824aa-cfbd-45f4-82dd-87d59a8e7ff7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d295a479-cb66-43ab-9a26-58f6a15a700a", "sighting_of_ref": "indicator--530824aa-cfbd-45f4-82dd-87d59a8e7ff7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a9501ea-1589-4292-b019-7e38506296bf", "sighting_of_ref": "indicator--75abd05b-1333-423a-af76-f1b9c541503e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f56257f-f881-4fa3-a440-ab92bf2145bd", "sighting_of_ref": "indicator--29bd3dfa-eb6c-4291-8ee3-3ef1c1b20c88", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79ef0db6-12fb-4fc7-8747-a08ff5a48bd9", "sighting_of_ref": "indicator--16e1b3c0-c70c-4a41-8fa6-3f7a048159c0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e79660f2-b801-4c00-9893-7a34ecf695d8", "sighting_of_ref": "indicator--f3585dde-caa0-4d45-9d49-d90ff62bd6d8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8584dddb-95f1-42df-90d6-6b78509188eb", "sighting_of_ref": "indicator--2c9f2184-7d32-402c-80f6-b3146bb3002c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6078d5a-5c64-4b5d-8777-6b78010a3354", "sighting_of_ref": "indicator--b8c1b8d5-01a5-4563-90dd-98ee9c86d427", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2f9617f-1ffe-4dd0-ac81-06ba87d106b3", "sighting_of_ref": "indicator--7c3f554f-fb48-4cfe-860f-323da8f246ab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c4cf2cd-bd40-4961-b421-763ac5558569", "sighting_of_ref": "indicator--7a47125b-813f-4de7-a4b9-ee67e40f71d0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4641962a-8229-4334-ba29-21f5854bfef2", "sighting_of_ref": "indicator--e7cb61f1-5835-4528-ac17-fc7b37d10e5b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbb0bdac-8db0-45e8-aec5-42c98af8d792", "sighting_of_ref": "indicator--691c7c88-a82e-4eb1-8897-30e713a9fda1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--030dda05-9724-4570-9973-16c036ff88b4", "sighting_of_ref": "indicator--00b1269a-f4bb-4418-95cb-a903b38fb6ff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46ffc337-4bbc-49ca-b719-8d6929aae764", "sighting_of_ref": "indicator--edaec7ac-1763-4ce2-8458-9c74298d3bda", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06cda6b5-b9b8-46cf-a985-c16c6ff075ca", "sighting_of_ref": "indicator--edaec7ac-1763-4ce2-8458-9c74298d3bda", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15df78f0-78b8-4ab2-8f33-3e09476fc67f", "sighting_of_ref": "indicator--01ac3493-2ebd-41e8-9ac7-9e933d0ee516", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04b9b7a7-3437-40d1-9e3f-7abc8b38982d", "sighting_of_ref": "indicator--31b8c45b-8021-4763-b66b-f804bbddd7be", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1f41071-3b96-43f1-9216-fef5d8879308", "sighting_of_ref": "indicator--1b016f68-deb4-478d-864e-29b5d29ea24e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d6cc30a-16a2-4dfe-898f-f4ccf3598a9b", "sighting_of_ref": "indicator--3d11cd58-171c-4523-bfdc-731e86ba7d86", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5157f44a-9953-49c4-915b-cca398b7f406", "sighting_of_ref": "indicator--d616c179-8c55-4cfe-81f5-88a656623e61", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b779eaa-c02a-49c3-90e5-8b15246a1075", "sighting_of_ref": "indicator--a9b48a63-8a95-411e-9af4-9ba8c2af00e7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05fc9d9b-6ece-4a27-91f8-2bf73308f9bb", "sighting_of_ref": "indicator--5047353e-08bd-45d6-851c-813c7a5c337e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2cc7f48-8314-4b68-8cb8-936cfaa2e0e1", "sighting_of_ref": "indicator--d1f5dcfb-d187-4a79-be1a-c4e16ac34341", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fddd4ad7-c7d9-4cfd-939a-d4cce6c89c1d", "sighting_of_ref": "indicator--d1f5dcfb-d187-4a79-be1a-c4e16ac34341", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3cd0944-4a98-4be3-8d5d-6cf3e1a506c1", "sighting_of_ref": "indicator--36d93eb5-89dd-40eb-9678-d486caa01f08", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7334d863-cb41-4101-92f6-ce749793274f", "sighting_of_ref": "indicator--068e6212-64da-4918-b4fe-b61874c5b93e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed74582f-0c20-4f1b-b700-6a780495cd9d", "sighting_of_ref": "indicator--e36242fe-eccc-4ad8-a3a7-9c536bd923fa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc9e1111-f43a-4e2d-9a0e-3ac774a59aea", "sighting_of_ref": "indicator--6bbdab4f-a761-4038-a48c-9077fe20c110", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a23c0dcc-c262-406a-a601-1ebba4608a65", "sighting_of_ref": "indicator--af4c6fe5-8c27-49db-bf5d-734973fb84d4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98814373-a8ad-47b5-8419-97ef367df3be", "sighting_of_ref": "indicator--9b931d50-6109-473f-935f-0a01ad54f355", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7de885bc-cbc7-434a-91bd-a6cd8b32cdfc", "sighting_of_ref": "indicator--db722ec3-2900-49e6-9b39-be9ff42bd594", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb024aa6-1f89-4519-bd2a-a660bd13d92f", "sighting_of_ref": "indicator--db722ec3-2900-49e6-9b39-be9ff42bd594", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b9d58ad-b56e-43ea-bcba-4a5dca690364", "sighting_of_ref": "indicator--b4e7102f-b018-455d-90eb-f669ab67ea8d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--990a9341-1b02-4092-abd7-95ee449ea436", "sighting_of_ref": "indicator--5a7bc64c-0b74-4dff-a3fd-9aa31c04f890", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--125fba03-71e2-46c5-aa1c-b87ffe34451d", "sighting_of_ref": "indicator--5a7bc64c-0b74-4dff-a3fd-9aa31c04f890", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78afe6b2-ce7c-41ff-9be4-3ee4a97dd127", "sighting_of_ref": "indicator--8b07af48-3d4b-49bc-a997-d8b9486f0032", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a5b4a89-8a67-44f2-b1d3-aa10b3ab1f62", "sighting_of_ref": "indicator--f6c0faa0-d29a-4637-96a4-140ed38cfd3b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e744d4a9-65b9-4f30-8ed3-d5364f273a34", "sighting_of_ref": "indicator--2ae88c7a-9b08-4f6f-9211-b7d93f224ece", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--188d1815-10b7-4cdd-aee5-21ae38444e61", "sighting_of_ref": "indicator--18a42328-07d7-480b-9ac1-b876a5c15c03", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d118c705-9646-4c7e-9be1-919f180acf75", "sighting_of_ref": "indicator--18a42328-07d7-480b-9ac1-b876a5c15c03", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98e05c54-cca9-4506-82c1-9a01f41c80b0", "sighting_of_ref": "indicator--c2a3a4c9-bf81-4af8-aa9f-51538c35cbd3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--406c8936-9e58-4a33-a5f9-c4f48b1ff99b", "sighting_of_ref": "indicator--0037aca6-115f-4df2-96ab-67c29a52a699", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c08b7ae1-ba70-459c-8ec2-817ebadf48de", "sighting_of_ref": "indicator--9e170f0b-058b-4de9-b791-368dc8624d40", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5e72dab-315c-4f98-acde-5fbaefed16f2", "sighting_of_ref": "indicator--af125852-cd41-4787-8b7a-d2b018e5a1cf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f549ec9d-49d0-41dd-b722-ff639a9d9f97", "sighting_of_ref": "indicator--44cb3429-d01c-40a0-baf8-654b98411940", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89d732ba-5fe8-40eb-b902-1ec3e76b0c57", "sighting_of_ref": "indicator--44cb3429-d01c-40a0-baf8-654b98411940", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29bda178-4c14-4d5f-9bf2-5eb27b447995", "sighting_of_ref": "indicator--159289a8-112a-49d1-a796-155f0d773fc1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a7ca256-009b-46a4-a1f3-acf456f7a233", "sighting_of_ref": "indicator--52ad3050-d035-4851-8c83-95a1dc620a8e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b6d0713-53a9-430f-a107-889adcea3b42", "sighting_of_ref": "indicator--52ad3050-d035-4851-8c83-95a1dc620a8e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c1dd40b-953e-4a3d-914c-a2a78c20de9b", "sighting_of_ref": "indicator--756754a2-74b5-4a6b-9bb2-2a120cbb2b3a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06cb0392-731b-400c-b946-d11224df1c77", "sighting_of_ref": "indicator--18873d1e-482c-49f7-bc80-ba24dd3fc384", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afe60d79-d398-49dd-b05a-71d91a3b8baf", "sighting_of_ref": "indicator--da64a600-4de6-4802-9be9-ad92b0383230", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72aa3a9a-f91b-4713-90ec-546e668b5b72", "sighting_of_ref": "indicator--da64a600-4de6-4802-9be9-ad92b0383230", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d72accbe-716a-4569-85a6-837ddbd03c92", "sighting_of_ref": "indicator--b4a9fa3d-d71a-4830-b126-2a424e90157b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11ea2ffc-7451-4f9a-abae-3771a327c5de", "sighting_of_ref": "indicator--24530788-617a-4520-b067-bec1824f480b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adada3a7-3f9f-488d-8047-f57fa0dac3b3", "sighting_of_ref": "indicator--a41bac35-293d-45df-99e1-0710c7fff72e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e3d954f-db19-4ec4-9ed6-9b0be270fcef", "sighting_of_ref": "indicator--edc50519-8977-4cc4-b2fd-06ebfba214aa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3b2621d-a321-493f-b2f1-8af29167e221", "sighting_of_ref": "indicator--edc50519-8977-4cc4-b2fd-06ebfba214aa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8a1e8c6-0e0a-4721-ac3a-3b959fda3719", "sighting_of_ref": "indicator--fd230bf6-056e-428d-ada4-ac7d4156447e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--658c4428-8a87-442e-93c7-2dc026f71197", "sighting_of_ref": "indicator--4ae190fe-6aea-40cc-8314-43ff4d1dea95", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e34d5245-9fa1-43a5-bad2-4925997f9cc9", "sighting_of_ref": "indicator--c5290692-ce00-4d3c-85bb-9919ac4a7948", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a2d84f9-f038-4660-806d-8a8c602dab44", "sighting_of_ref": "indicator--33414f54-9065-48dc-aec0-a88057b3b9b7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68e54a09-afa5-4931-8c49-3e0ad599a19a", "sighting_of_ref": "indicator--7819fb73-7253-4a30-afba-663e1642d034", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10495ed1-82da-4f34-8065-4c003e9b7b3f", "sighting_of_ref": "indicator--0208236a-b694-4f2b-8ed0-a0b350c5a1c1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5a09253-143f-440b-be15-74337c9bf11b", "sighting_of_ref": "indicator--0208236a-b694-4f2b-8ed0-a0b350c5a1c1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d79693c9-8d74-4580-9951-39c0d926c10b", "sighting_of_ref": "indicator--b0dadfc4-a96b-4b24-8616-ba6452917cdb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e042136-96fa-4956-b4fc-395748078d1e", "sighting_of_ref": "indicator--14497694-a37e-4ca1-8fac-e8f5de5a6984", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d9323c4-d707-4b2b-89d4-3caf039e6ff3", "sighting_of_ref": "indicator--14497694-a37e-4ca1-8fac-e8f5de5a6984", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9674a555-7395-4287-af23-9354596c94e7", "sighting_of_ref": "indicator--c96b2208-209a-468c-a63a-8ab854c3b4b1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70e42458-21d1-4a37-b8d5-f486cbd4c642", "sighting_of_ref": "indicator--fe76b897-5719-4c9e-bdb9-8b57c4aee618", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10a59480-8bc3-4695-b45d-a5deb16fe0c4", "sighting_of_ref": "indicator--754ea8d1-be1e-4748-9cc4-990fdd529277", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd423fc2-6bae-4684-82fe-66132f7db64e", "sighting_of_ref": "indicator--754ea8d1-be1e-4748-9cc4-990fdd529277", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6afa0715-eef7-4361-8532-4ef9e2576e38", "sighting_of_ref": "indicator--42fd4366-57b8-4199-b11a-b63e639a5bb6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--420858cf-3599-46b0-ab7c-288a5ed460d2", "sighting_of_ref": "indicator--7d81a61e-de96-4bb4-9510-4cf25ac61048", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21ab649e-b91d-4242-83ac-f93ffe7965d3", "sighting_of_ref": "indicator--82244c52-d12d-47f5-991c-1518d93e4c3d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48b70ffb-5a59-44c7-a6ab-4c12b80332e8", "sighting_of_ref": "indicator--9a240ec9-1420-4795-8bb6-b3facb54f8ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbbe0d82-a979-4889-859a-2a15deeb867f", "sighting_of_ref": "indicator--9a240ec9-1420-4795-8bb6-b3facb54f8ed", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48c03a4c-e09d-4c8c-8459-b763789cfaa6", "sighting_of_ref": "indicator--770b72b4-33c1-49bd-9c48-b2837af9978e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--034d259f-ba44-401f-b326-d438c4119cfb", "sighting_of_ref": "indicator--90b9fc3d-68b7-48a4-840a-5961c9fb2bad", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bd7996a-ebcb-4735-9935-50e277c21c1b", "sighting_of_ref": "indicator--d4466070-a675-43c2-ab27-65e5b849d0bc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e38e8a5a-95cd-4a73-9d37-c3401a6dfcbc", "sighting_of_ref": "indicator--a88d91e3-45f7-4c77-8c6a-e8361a3b1d72", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fd6d873-403c-4eb9-ac28-4d6054a1a4d1", "sighting_of_ref": "indicator--72d30f0b-a6e0-4c7c-a9e4-0af48642904a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a31e80c5-027f-49c9-b007-b1fc12d7bd73", "sighting_of_ref": "indicator--81687ed3-670c-4a0d-b956-02a21bbfeb6f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f00cb21-4868-4e06-81be-9347af932129", "sighting_of_ref": "indicator--a9a67228-1b05-4072-95cf-a9040e449431", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f17e7671-1b27-4289-829e-7b7f09df75e6", "sighting_of_ref": "indicator--89331dcd-5f6e-4e19-8527-fcd7291b22e4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fda9de94-c34f-414b-9693-aa3273a56e7f", "sighting_of_ref": "indicator--92f74196-426a-4a1c-b6d5-f8bcaa779796", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56be65ab-5ae8-4f48-b4f3-72a004bda224", "sighting_of_ref": "indicator--a204055d-64d0-4c03-b504-99aee43856ff", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e00f2635-77ad-4307-9dc4-d612f8628126", "sighting_of_ref": "indicator--a50235f2-f619-4b2c-9ed8-224be62a8335", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f602df1-f0e3-4a1d-84e2-a342d2ff3e90", "sighting_of_ref": "indicator--a50235f2-f619-4b2c-9ed8-224be62a8335", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f052c8d9-4358-4b7c-aff7-8d785fc9af75", "sighting_of_ref": "indicator--4dfd54d0-213f-482f-9796-3b3d8c629817", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--161e5af7-5ae9-462d-8052-6d6b272a3b17", "sighting_of_ref": "indicator--53948bf8-df06-46b5-8233-d25007b6da6b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f39f23e7-cbcd-412a-af95-fffa4207b24d", "sighting_of_ref": "indicator--757b998f-ed2d-4d04-906c-afb65744eb6e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d50ae099-2448-4d46-ab14-2ebace716511", "sighting_of_ref": "indicator--6366b526-2887-41ea-a87f-dbfc4e090a2a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e69bf609-4b0e-4bcb-af1e-cdc3c78426f3", "sighting_of_ref": "indicator--eaed296a-4ef2-4abc-be78-5709a9745f63", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7dc86ea-b78f-4f48-8701-008c540bcdf1", "sighting_of_ref": "indicator--eaed296a-4ef2-4abc-be78-5709a9745f63", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bc7647b-e1a9-4cf6-bdb4-545181ecf3da", "sighting_of_ref": "indicator--502a635c-c52c-4ecb-8faf-addef8419a86", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71248397-f09c-4ed7-afef-e0e6bab01052", "sighting_of_ref": "indicator--b9bcf88e-7370-4d6e-917b-16e142516a44", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9ffcc1b-b109-477f-b385-f14417db4fbe", "sighting_of_ref": "indicator--00a4a975-0c49-4e97-be8b-75953dec3920", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c015134-86de-41c2-ba5d-5a15ef61cbde", "sighting_of_ref": "indicator--00a4a975-0c49-4e97-be8b-75953dec3920", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0777587-98b2-46c3-ba99-687010535216", "sighting_of_ref": "indicator--653c0639-1877-4d0f-b88b-221794f0cdcd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57fea71d-8861-4bc8-b93c-c00735819b01", "sighting_of_ref": "indicator--653c0639-1877-4d0f-b88b-221794f0cdcd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--958a5505-06af-403f-8fe1-4045486aa49b", "sighting_of_ref": "indicator--74e86635-d1f5-4eb8-aa09-68e2faa43338", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd35c3e2-cf10-416b-a6b6-af2864d8ba5e", "sighting_of_ref": "indicator--38ff0b10-79ea-4be3-8e25-c1a8cae7e711", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a5aacde-9b2c-4b37-b713-ff74b9883918", "sighting_of_ref": "indicator--f5497a78-6148-4038-9726-36ea352cba32", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b36ea01-27d7-485b-b0f7-f714c3cb2a89", "sighting_of_ref": "indicator--55f66e6d-5177-44d0-a537-3758d5263d6c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--027a1ba5-2c18-4c88-a083-5fdd8a3f2442", "sighting_of_ref": "indicator--9fee2262-2bc2-4d6d-844f-0f3d6cde031f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73b06d2d-eb21-4aca-a4e5-8b1858958978", "sighting_of_ref": "indicator--5777742d-6cc8-479d-8430-21cac844d73d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a21c4835-5aa2-4ca8-8744-42e5de00a7db", "sighting_of_ref": "indicator--41c0cde8-2463-42a2-b5ae-e70b289a2e49", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b95e2764-8228-4be1-a74e-cbe9b44fd761", "sighting_of_ref": "indicator--72029306-bb60-4530-9142-9377e6d51203", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a813c69c-ca6b-4259-9673-98d822ee4e96", "sighting_of_ref": "indicator--a49ed38e-ef46-40ca-aa05-c7277474fb0c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--178507d1-70c8-482e-baae-020846554bcc", "sighting_of_ref": "indicator--e938f2c8-ed27-4ba3-a98a-aac9541b4116", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12d84a67-408d-4f6b-9093-c1017b950285", "sighting_of_ref": "indicator--bef5c805-79d9-49e3-80f1-82b7963707e1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec29945b-db8b-4b56-804d-3e4bc738b4d3", "sighting_of_ref": "indicator--13226e11-e11d-40da-a37f-324c12358a2c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e687f26-ec5b-4900-a88a-282bb7417174", "sighting_of_ref": "indicator--958916ae-91e3-488d-befe-65d183249877", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d3e298f-324b-4ee3-88cc-928e0c4b4db0", "sighting_of_ref": "indicator--6f6d15ad-345d-43b3-9e24-1b601f1d9dcc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57f435a0-8941-4b99-990f-cc116e81cacb", "sighting_of_ref": "indicator--501f00b4-5847-4bb8-8af7-4e9737d61586", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5fcd925-3380-4187-998e-e29be6817564", "sighting_of_ref": "indicator--0f7056b3-0c40-4ab5-86b6-7fe3c47dfd3c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--360c8578-e6ce-4fd0-a95d-f91fea86f1a1", "sighting_of_ref": "indicator--8e75e54d-bd87-486a-aebc-df1dc16a1020", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f59298bd-c0d2-4c67-ae34-ab79f18d4f57", "sighting_of_ref": "indicator--8e75e54d-bd87-486a-aebc-df1dc16a1020", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a90a51e3-8caa-4604-8937-fc442b78d002", "sighting_of_ref": "indicator--3f4b1cce-339e-45e1-8def-848b1f7af986", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ede16486-633a-4255-a4d3-33dd9e18f935", "sighting_of_ref": "indicator--d4a7b5c5-8c38-40b5-b665-49fff17196d0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a911146-2ef1-495d-a146-2a7b5fe808c0", "sighting_of_ref": "indicator--45924ca2-56d7-42a1-8399-ab151dcbec09", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c582546a-98f8-4c55-af70-bf7c398e21c1", "sighting_of_ref": "indicator--23f5db63-f14e-4efd-ac18-a18a2532ba35", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64c8d5a4-d1ed-40a9-9b77-becec75f8c24", "sighting_of_ref": "indicator--8ecf216d-49ad-43d6-852e-d0d529a70c81", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b47613b-0c4c-4258-be56-6f41d4deadae", "sighting_of_ref": "indicator--8ecf216d-49ad-43d6-852e-d0d529a70c81", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fd4339e-e5e5-43b3-bc06-579e2bf41ea8", "sighting_of_ref": "indicator--6d6c1d12-293c-443e-b454-6dabb65211e4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fef7f34-b363-4b1a-bb6b-9d3d811622d4", "sighting_of_ref": "indicator--37b605a9-1144-4d0f-a82e-136ee1c9244b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ed87b6e-e08e-4d14-b718-b9c31906e2d4", "sighting_of_ref": "indicator--78c6cc98-6e54-4063-ba34-1b66865c2bae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--106424b2-b4e0-478e-93ac-4f8b73897845", "sighting_of_ref": "indicator--edc602ca-6421-4195-a527-6fa4360b1aac", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67d4ba53-1a2f-47c7-96bd-cb7cd654e461", "sighting_of_ref": "indicator--3e758c31-435d-4872-b56b-90a6900dfeeb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d8ea2f8-679d-40af-b2cb-19b93fae4311", "sighting_of_ref": "indicator--f49b2ffc-b877-4761-b66c-38900907fe1c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--201c1a35-9833-4126-8bdb-874734e18579", "sighting_of_ref": "indicator--368b6598-7f7b-4615-851d-59aca6073198", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d2f78e3-6963-47f3-bfe1-c617dfafdfd1", "sighting_of_ref": "indicator--04ba0a4d-280b-4d21-b05d-56e1d63748c2", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b1ecc76-4b0b-42ce-8f86-44ae3611ca0e", "sighting_of_ref": "indicator--ae9108b9-08e2-4204-b4be-fc1c86be34c3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c601212a-08be-4ade-8ac9-8fd30d2968e9", "sighting_of_ref": "indicator--3bd4b68f-adc8-4f0e-abe6-dfd6769b756e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--249bf3aa-df81-4a49-a4c2-09ef791c4dab", "sighting_of_ref": "indicator--27a6ae6c-3c8e-4dce-9af1-2dd6c785dd59", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5121ba8c-f2a9-4611-897d-6e985a8684e0", "sighting_of_ref": "indicator--88ab8cb6-c37b-48fb-9e01-a756aa21e070", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e27f285e-87e9-4316-9263-e68960e59574", "sighting_of_ref": "indicator--5747b993-ccad-49dd-8fc8-d3fa4c7b9387", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a59267f-3e71-4a97-854f-60e4bbb9c1db", "sighting_of_ref": "indicator--be22b1fe-0881-4b4c-9e7d-44603862263d", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3312c63b-4ca0-4730-9348-6cf9d57bee88", "sighting_of_ref": "indicator--f669563a-4ccc-43c3-9fc3-e1aa76d316f8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1a3fcc8-9122-441d-96d2-38bb3988f167", "sighting_of_ref": "indicator--d8c13082-ff62-465c-88d8-fc7215ca43c4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d98621c-3dd8-4675-be89-5d7a22b7b862", "sighting_of_ref": "indicator--a44d7fcb-9e4d-4ee7-82c5-45c3995eb583", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60024622-f0c8-4dae-8d22-c8b66ce27c62", "sighting_of_ref": "indicator--b6eaf422-d1f8-4a4c-908b-1f2e13ba94f8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0d778bc-8c44-488a-894c-6081a9dad41a", "sighting_of_ref": "indicator--bbc4c643-b564-483a-b8eb-139db5d8f32f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dc08036-995b-4b40-b5de-0b037090fa35", "sighting_of_ref": "indicator--ae32fb60-5be7-4517-9fd3-4000b1f5d45c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cac3d1d3-1da3-49d4-ad96-7f957d74ec24", "sighting_of_ref": "indicator--71cb1222-0cee-47e6-a4b5-0f951384306e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be5eb54d-7b9b-4355-ba42-868b892c0426", "sighting_of_ref": "indicator--1c5dbd1f-8c3a-4ef4-9648-c60e83b857eb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7122f34-d9b9-4b5e-abde-ca3aeca9806a", "sighting_of_ref": "indicator--070e8fa9-f998-4f19-b4fe-7004b3b61005", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--536d5097-50f8-45c6-815c-083788c99099", "sighting_of_ref": "indicator--a78d1827-2337-442e-a56f-d1b89119ab9d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2ada72d-be12-431c-852a-d245476b6962", "sighting_of_ref": "indicator--a821c2e7-b9b7-4598-85d9-891040ba873c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ba52c01-e6b4-4ef2-a98b-1dbdb39f24ef", "sighting_of_ref": "indicator--27d2f3a3-a7be-4659-9968-36f83553ea5c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--720a94c1-97fc-4cde-82c7-d6c42d79c1ee", "sighting_of_ref": "indicator--df7cfb3e-8132-4734-9a7a-574ad6a27f78", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e886c5d-37e1-443b-8df1-75feb2f2ba5e", "sighting_of_ref": "indicator--9cd68253-bdc3-4681-84ec-15c59610233e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a165cde-bce7-438f-b547-ce4c4aa98ac7", "sighting_of_ref": "indicator--4c0fa6f7-2805-4616-8996-154038246e54", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9aab1bb3-d1b2-4cc1-932c-b1fa6ba2e066", "sighting_of_ref": "indicator--0fdc4abd-421e-43ab-a169-423e5a8492f1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5a7e70f-c1a6-4c11-b00d-c34a18df2690", "sighting_of_ref": "indicator--30467fb1-9078-4ff7-85be-b7716fa8a76e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b441dd3-a84f-437d-bb8f-a16088c1052d", "sighting_of_ref": "indicator--1599398f-7dbb-4dc4-99b3-5189dd75c4e0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0b7b320-2341-4c85-a098-8eb00102978d", "sighting_of_ref": "indicator--f0af9a01-23bb-4113-93b1-d5a35ee6d7ec", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a81604b-45b3-4c35-9911-4c35dac31e73", "sighting_of_ref": "indicator--ff7c2804-7f50-4fe7-ba21-be4a0928de37", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--096dc57e-5422-443d-a810-799966920a26", "sighting_of_ref": "indicator--5a7b0818-b53d-4965-ae47-b1a6a4d773ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0f855ef-b17c-42d2-866b-486d51a10c5b", "sighting_of_ref": "indicator--7174df1b-9039-4638-a6bd-419d82d27d8d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a75f7e9-80b3-4574-98f7-77d1b0dfdfe0", "sighting_of_ref": "indicator--c3218061-9381-4e96-b5ea-a2a1b0d2d6e4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5c753ff-f96b-4a4c-a21f-5243f731d7ca", "sighting_of_ref": "indicator--c175db37-3646-4263-9527-b33db3578b8d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53d55e1b-798b-435d-bad7-d26ce1fa457b", "sighting_of_ref": "indicator--ffa9970a-1514-484f-9d5c-2802b1495362", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a43ad224-52b1-40da-bc01-bfa3d71b138e", "sighting_of_ref": "indicator--ffa9970a-1514-484f-9d5c-2802b1495362", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f300b8c6-964d-4b18-8f71-49c8d0b2cb70", "sighting_of_ref": "indicator--92d33d85-5c7b-4b1f-8b42-7056d07545f6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef81778a-7141-4ffe-b44e-92a2119ad4d1", "sighting_of_ref": "indicator--042101ef-fd44-4fab-a36d-7cb02a322b93", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11abfb1a-e95e-4a34-8ccd-caead97abf92", "sighting_of_ref": "indicator--ebe66c4b-ea73-46f2-a987-d488c7382579", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b799a232-06b9-4a32-9324-63605af0145c", "sighting_of_ref": "indicator--c9a17cdb-4ad6-4cc2-95ea-ab63d26b92fa", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e300369-bec4-470d-9b52-29651a57aff8", "sighting_of_ref": "indicator--e960aff9-07de-4106-a894-ca2d8aa81255", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61f238a3-13ad-4ad8-818c-f7d3f1318d56", "sighting_of_ref": "indicator--fb9456cf-81ac-43ce-ab96-ee6bbad8fca4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3885da8d-119e-4add-a60b-d0f2b8041b1b", "sighting_of_ref": "indicator--a4edde30-766f-48da-accc-edd996910045", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82932aa5-99bd-436c-af71-1de52ee04882", "sighting_of_ref": "indicator--7a69ac5d-09eb-414f-93dc-dd81e756fc2f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a76912ab-4fee-4fd4-a1b8-5076d40fb06d", "sighting_of_ref": "indicator--50ba40dd-2990-4dbc-b8c7-6a3e0749fe99", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f225e354-2c88-40b3-91d4-d2113e743378", "sighting_of_ref": "indicator--1fdae452-dd69-4a26-a7f2-3d16d98ea126", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aabcffc5-ef3e-4a6c-adff-4fd823295f70", "sighting_of_ref": "indicator--531aabac-047a-42ed-8955-972b7ed300ac", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10c265a8-1e6e-4592-90e1-230d0c57b213", "sighting_of_ref": "indicator--7b1dab0a-491d-4046-88d5-cb6baa16e651", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dce02e49-8909-492a-80c7-dccb9c545be4", "sighting_of_ref": "indicator--082e6b31-4f3c-40b5-bf8b-21dae6bbd6a0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71969009-c662-4ded-9c84-98685f91c3eb", "sighting_of_ref": "indicator--9a73febc-b88b-4e09-96fd-4ff0a29ccb7d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3c9c842-70cb-42c0-b9ad-9eb26aff0d1f", "sighting_of_ref": "indicator--f76b33e0-caf4-4159-a9e8-d691ffc6632f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--016539f5-2e5a-40e9-be2e-9bd0b9dd38e3", "sighting_of_ref": "indicator--039be80c-aa3e-4541-a63d-cc5f2647523d", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4e1063c-a17c-4abf-b587-f28cd9f28989", "sighting_of_ref": "indicator--7c1bbe71-dc92-44ae-af35-02616761847c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b37906d6-ba80-4d24-9532-fe72e9ae19d0", "sighting_of_ref": "indicator--cb72f20c-6cb7-482d-972e-b16e8ef91b8d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb4639a3-1c8d-49b7-8ea0-f9daf09769b9", "sighting_of_ref": "indicator--fd6aa648-4a30-4719-af7e-a8a93c5f22e0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--249f2f5b-db13-4811-abc2-d2a7a7c2706b", "sighting_of_ref": "indicator--6f008d03-0398-4893-b500-11ad0f2a6151", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fa19252-16c3-4476-8931-055318b39c81", "sighting_of_ref": "indicator--1527d6d9-7c07-453f-9f1a-472b64b00681", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--237daa25-d3a7-49f2-8b77-a38a541d5917", "sighting_of_ref": "indicator--fd48b35d-4e04-460c-afe1-7f9febc7eca8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0835181-2240-47b9-9e54-77cacd2f374e", "sighting_of_ref": "indicator--076f9c53-63d5-41a1-9293-23954c398150", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--192c3591-9463-4bb4-aaf6-da1337f7fbe6", "sighting_of_ref": "indicator--d97f57eb-3eb2-42e1-aea8-b741f555401d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cacad0b0-6dad-4e24-9d06-414aa644c343", "sighting_of_ref": "indicator--af85d166-a463-4569-9399-1cc76d5f467b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b5817e5-4f04-4532-aaf1-142ce86f13aa", "sighting_of_ref": "indicator--750cbdd1-aa93-49dc-8bb2-89ec43c6e8fb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5554cf3e-0d32-4217-8838-542e8a4521f2", "sighting_of_ref": "indicator--02679cad-5486-4fa4-8b30-9f1910b505bc", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c78186ad-8394-4a3a-821b-2e10e0a20379", "sighting_of_ref": "indicator--50a1de17-b44c-46ef-a5cb-a508a69ae662", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7367bb5c-cd2f-482a-9d68-37674cf8c3c0", "sighting_of_ref": "indicator--a24d31eb-0fa5-4d25-b616-46f86307cbda", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5def05e4-ef7d-4cb8-9076-be6927d9a98a", "sighting_of_ref": "indicator--a24d31eb-0fa5-4d25-b616-46f86307cbda", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e75ffe2-246d-4f2c-9468-23f444dfbd72", "sighting_of_ref": "indicator--f88804f2-7ad1-4fb8-9df4-e129c003c79d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecd90960-af56-45c1-86ba-503359028260", "sighting_of_ref": "indicator--1666bfb7-a4a1-4c50-8a1b-f8bed57b6802", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d108e3ba-3f92-4af5-a8c7-b49814e0f827", "sighting_of_ref": "indicator--8a64cbd5-9694-4c6b-8dfe-246c448175d5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--823c8041-64d5-4c45-a1d7-08dc61e6b9b3", "sighting_of_ref": "indicator--8a64cbd5-9694-4c6b-8dfe-246c448175d5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9a6665b-f7b9-42e6-b508-de3bc278026e", "sighting_of_ref": "indicator--7988ac11-611a-4c41-9834-a32214cc51ef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6a052e7-ab34-4efe-9fe4-bf78533467a4", "sighting_of_ref": "indicator--5d732aaf-76a3-4e20-a2a1-c6e3fce5d891", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbcec9bc-f2b4-4ed7-ad75-3888225e888c", "sighting_of_ref": "indicator--6fb29fd9-4acd-4a73-a73a-5e89a3254cde", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57ab69c0-fc74-4ffe-8186-2cfc3190f865", "sighting_of_ref": "indicator--b807ef26-953d-48bb-abe6-38957f560a73", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b399196-6486-462e-a6df-c54a5714eae3", "sighting_of_ref": "indicator--dbb74262-09b7-4f07-897a-fdfd3fa8fd79", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a25c9b43-a7b1-4100-abe7-a343f6f9990b", "sighting_of_ref": "indicator--a95e4d16-4001-4056-9edd-fe847d78218f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e9185d6-ac0a-4a27-8b73-da84b7be27ee", "sighting_of_ref": "indicator--5af4f611-2db0-4bae-b860-43430d096525", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64f17438-c6b4-43b2-87a2-cc9863bd937a", "sighting_of_ref": "indicator--e79ee857-d221-4e37-9ff3-1994c1426259", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d12c941b-5d20-47d5-a21a-de2aa6a6a7dc", "sighting_of_ref": "indicator--9c25b49c-068e-4975-9e19-ef687bd7fb2a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4f0cf9c-b371-4cf7-8555-ba248dd25f23", "sighting_of_ref": "indicator--bebb4ee0-fa41-4511-997d-af79b36ee03e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8dd1988-09bc-4035-8d85-77de83f2bd30", "sighting_of_ref": "indicator--bebb4ee0-fa41-4511-997d-af79b36ee03e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f81a11a9-8f0b-4ba6-a1ae-ebdc6ae4480d", "sighting_of_ref": "indicator--55ab126b-86aa-4c45-823b-c87b48b18b0b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--973a7ffa-e85e-4184-b070-d885024b224a", "sighting_of_ref": "indicator--2048edc6-580f-4d91-943c-9b062afe09b8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40572f5b-01a4-4573-b815-ea18fe24ec6c", "sighting_of_ref": "indicator--b4b8e869-9e8b-45d2-96db-b3d50296f04d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b84a5c2d-3c17-4197-ac58-98b6eb747bac", "sighting_of_ref": "indicator--c1e995f9-9942-4557-9122-989468aa4892", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b183e6c-789c-4b1b-8af2-38c9a463d1ba", "sighting_of_ref": "indicator--9eeb0269-fd7d-4bbb-aa95-805906bccedb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de5830d8-dd46-43e1-8087-70a07f80d586", "sighting_of_ref": "indicator--ec1267a6-20c4-40a8-b031-27cb021ed812", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6df4577e-7041-4ace-b90f-4852f21b5cce", "sighting_of_ref": "indicator--ec1267a6-20c4-40a8-b031-27cb021ed812", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adadfc1c-8f91-4763-8a23-0fface3642b3", "sighting_of_ref": "indicator--ffb4a397-82ae-4bed-9609-e1226c29b503", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1b59b10-d95a-4d6d-9fe7-00bc8dec4a8d", "sighting_of_ref": "indicator--aba34986-5818-4462-be5b-dffaaad67fe6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd745efe-a176-49a5-9508-6b4c3160195a", "sighting_of_ref": "indicator--ba7b45da-4d3c-47ae-92bc-3662816c5759", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb1d7555-3e6e-43bb-96ab-e2a37fea6b5c", "sighting_of_ref": "indicator--ba7b45da-4d3c-47ae-92bc-3662816c5759", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05352e43-f07c-4d0f-8e62-6ca871242ce4", "sighting_of_ref": "indicator--28f71a58-93b4-4b6e-a3ec-ba5cc249e9b8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7329a832-d770-4691-af7d-8011d10eaf24", "sighting_of_ref": "indicator--3f053bb6-6a27-4ee0-a80b-dd6f3d05b735", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e900e68-a763-4c17-9c6c-57b1315b658a", "sighting_of_ref": "indicator--08f82ee4-6577-4956-b6ed-007c6a7c7909", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4683bb22-e0cc-4637-a06c-f403f13d4fb6", "sighting_of_ref": "indicator--bbab8607-a939-4761-a30b-758d5fdc3ee0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af2e050b-bf0a-401d-980b-90528dd3de1c", "sighting_of_ref": "indicator--3f2857a9-7ba7-43ee-b1d6-ce3a9cfb1cd9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffaaaff7-9120-428e-83fb-e05aebf8898c", "sighting_of_ref": "indicator--f08b7f9a-3dc7-4f26-99a0-ead566a60f8b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94d9079b-3fcd-49af-9446-21a2d7a915cd", "sighting_of_ref": "indicator--dba53137-2e06-4315-9f4c-c376d2708640", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b916475e-1e18-41e7-ac41-3c95df78fc0b", "sighting_of_ref": "indicator--dba53137-2e06-4315-9f4c-c376d2708640", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dd42948-7fc6-4d57-94ce-c2daf893c807", "sighting_of_ref": "indicator--b4affa5e-da79-4207-903b-0389e8cb8820", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c08ad7f-34ef-4427-a9ef-7cb3244ee2f1", "sighting_of_ref": "indicator--4042cd5c-cfe8-4ee1-91ce-b1a87540d192", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa15f53e-cd8e-4536-af69-a3535179c534", "sighting_of_ref": "indicator--796f94a9-0993-4e2b-b1e1-1ddc06978b8e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7df86ea5-c180-49f2-8b65-3973dc0bd7aa", "sighting_of_ref": "indicator--51958ac3-65a2-4988-8dd8-80345a5b4a4e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f033a76f-fb3b-4ada-8736-494378137d8d", "sighting_of_ref": "indicator--efd5eea3-ce52-4815-99ac-16075ab3bd72", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a5a152b-9453-49c5-bbd1-0fad15d33ab4", "sighting_of_ref": "indicator--bd801cd4-c69b-45af-8e76-2c5459b8eecc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9cba125-e9c3-48b5-bbde-10d125947fb2", "sighting_of_ref": "indicator--488f5151-405a-43b2-9e78-a836162921e9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cb5f52e-0d79-43bd-b0f8-0d904785ee42", "sighting_of_ref": "indicator--6c5fc086-a37b-45f2-ba64-31b83f484b43", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24a83d2e-dd50-4b81-b68c-e3e7cb279d92", "sighting_of_ref": "indicator--6c5fc086-a37b-45f2-ba64-31b83f484b43", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a21f8965-ea68-42b8-8c0b-53bbe8d5460f", "sighting_of_ref": "indicator--da862c4e-655b-4cb0-8fe2-7487a9e70e03", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bc4df1c-8f43-433c-a95e-8a2391c902a8", "sighting_of_ref": "indicator--d0a31e5f-4c4d-49e7-845a-67f0ef269915", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc2775fc-5439-4f48-b11e-61359c279b65", "sighting_of_ref": "indicator--218b0f12-5cff-46d7-a4da-0c88a0ccf925", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--974b19d0-e275-4e23-8d8c-f25514cb2727", "sighting_of_ref": "indicator--f48b1a94-c867-44e5-97ad-3803bb5a87d1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a5cbdaf-027c-4523-9425-c33e03bf31db", "sighting_of_ref": "indicator--699eebe0-5ed1-4ce9-b4d4-50284ce100c9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cff424a-2c94-4c26-aee6-ec78a72f73ab", "sighting_of_ref": "indicator--a5a76585-51d7-48ac-a23b-736088bbd5d9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--043cb906-6b13-4e88-98e4-a6b18bc53c05", "sighting_of_ref": "indicator--dbb3ca67-a9ca-4a4e-bfb4-5e89925f6fec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5de3eca7-c1d1-4f23-9f4c-a7f3d124db65", "sighting_of_ref": "indicator--70a3a250-6407-4435-8d01-dc3938652908", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5c6609b-8c03-4a99-b9da-0be344edb892", "sighting_of_ref": "indicator--943f58b5-8083-473c-92ac-371803d8ba4c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b3cdba1-25e9-498b-9cbc-e05ed64b98c5", "sighting_of_ref": "indicator--be5c31e0-68b4-44c5-a644-4f3d96f91753", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4966fdc-5ca4-4cde-bb31-01f94e990531", "sighting_of_ref": "indicator--bf334130-975a-4563-868d-e0b415eeb9f5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--264eac0c-56f1-408f-8bda-71b50cca7110", "sighting_of_ref": "indicator--92c8abd2-7175-4807-aeea-dc85ecd7845f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b84ff8c-fcf8-43ed-8364-5165d265459e", "sighting_of_ref": "indicator--82306891-9962-461f-a301-aa97cb255469", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a38ab55-a8aa-4f27-9774-6cd1997547c9", "sighting_of_ref": "indicator--2d7e4ba2-f277-42b8-a512-55d1ce4427b4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--276cdb7e-bcde-41c8-84d4-0ff5ffc53c28", "sighting_of_ref": "indicator--94511da3-1dec-4ddb-93fa-e14d01a1192f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e686fd3-fc8a-4de5-bb64-78a8882acb4c", "sighting_of_ref": "indicator--b13020a9-22b2-46dc-904a-2a463086c0d3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d03d7cc6-9a6c-4ae0-877e-a27fc734e630", "sighting_of_ref": "indicator--2b7f9951-e87d-4709-a421-cbb89381221a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c11aa924-9416-437b-934f-168abb7c52d7", "sighting_of_ref": "indicator--2b7f9951-e87d-4709-a421-cbb89381221a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69722467-fe37-4655-938e-5bdd56938c7c", "sighting_of_ref": "indicator--c024da64-7140-45fc-a645-a1d1a36e48b5", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14744faf-b613-4a06-b63b-b9ddc73f626f", "sighting_of_ref": "indicator--c024da64-7140-45fc-a645-a1d1a36e48b5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df08ad9d-dd6a-45f6-b7d7-9b5707c23c99", "sighting_of_ref": "indicator--73a1a5e5-60eb-471f-9ff3-e586460a4870", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92cf3800-c507-4613-822a-777122c5b5b8", "sighting_of_ref": "indicator--fc4e822f-1b57-4a92-9b03-4f5059fc1edf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3526f027-5c50-4bd9-8dd3-380bf93a40f8", "sighting_of_ref": "indicator--66f7cc9d-a1eb-4c24-85d2-db59800418d3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce6183e1-deb2-43ec-b3da-843447e12ebf", "sighting_of_ref": "indicator--eafa8bf2-ac16-44f1-8dd0-6e41be533495", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e3bf9c3-046a-4bad-b887-3da41ebe1763", "sighting_of_ref": "indicator--eafa8bf2-ac16-44f1-8dd0-6e41be533495", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d646954-5bef-4551-8ae8-58654ce73543", "sighting_of_ref": "indicator--5a22ea06-ee94-4787-a914-ac2577b6a523", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd2088af-464b-4c97-813a-f105b097d1bc", "sighting_of_ref": "indicator--5a22ea06-ee94-4787-a914-ac2577b6a523", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb34b733-336f-44bf-a3a8-2c893ccacc59", "sighting_of_ref": "indicator--8e59e8f7-12e8-4a2e-81f6-120ad8ce4f3a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aeba479-fd23-4c91-97bf-2734edf9a973", "sighting_of_ref": "indicator--8e59e8f7-12e8-4a2e-81f6-120ad8ce4f3a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7953124d-f058-48f6-9f22-61176f546f06", "sighting_of_ref": "indicator--049dbaa6-6f34-46db-880f-ccb145a2875b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f812d0b-7615-4748-8ef8-b9093375caa0", "sighting_of_ref": "indicator--01a537c1-bc77-420f-9e02-51c6135c548f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf931bf8-f7d1-4dba-986d-fcef946121db", "sighting_of_ref": "indicator--4c51cb02-595a-4954-9642-abfb6539f1d4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7aba3f69-d05b-4ad6-b4f9-45dfbf76f782", "sighting_of_ref": "indicator--1e4bfb4c-e67f-454c-b562-6fbf4a98737c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fad615ee-e829-4186-8871-3e89392034d3", "sighting_of_ref": "indicator--1e4bfb4c-e67f-454c-b562-6fbf4a98737c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--164abe45-67a6-4a24-8809-192a249d27c4", "sighting_of_ref": "indicator--7cebf61f-3604-4a18-95cd-5c097deafa20", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--303f37b8-45f2-4ed9-965a-4f3381c35248", "sighting_of_ref": "indicator--a12cd545-9897-44bc-8e46-2dccf60f0fe2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d99bf019-57b6-48ba-ae15-b771388ba719", "sighting_of_ref": "indicator--7abacb77-3fda-49f8-abf0-83626afd0dbe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a229f325-f1f0-4bc5-b360-4b218bdc6425", "sighting_of_ref": "indicator--db97457c-db48-4b24-a958-f2a5385e6774", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82c35bec-48ad-4899-83a5-cb0f7a2cd6b4", "sighting_of_ref": "indicator--85af1990-d495-4414-acbd-f79d714208a1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bc723f2-b48c-4fa9-b5b3-3ec0f6dfecf2", "sighting_of_ref": "indicator--ff3890e2-3ece-4a52-bdf7-20f798b261e0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03ebedb8-f24b-42b2-8e4b-fff31ee44494", "sighting_of_ref": "indicator--ff3890e2-3ece-4a52-bdf7-20f798b261e0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca041a00-6dcd-40cd-88fd-07564513c7ef", "sighting_of_ref": "indicator--94f00ebb-7cb4-4f1f-b477-aa904c1db220", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--634366cc-5cd3-4b5d-ab32-3c55440b014d", "sighting_of_ref": "indicator--b3e33998-571f-447d-b0c2-feba9bc6968e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ff3953f-efc6-454b-824a-633aa74a63d0", "sighting_of_ref": "indicator--a24c0f0c-0154-460b-9ed5-987a895adced", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff4f75a3-cbe1-4409-8622-9e678700e448", "sighting_of_ref": "indicator--426cd3fe-3541-4c6e-9a97-8c7b5aaa8679", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a0196d1-05e3-4ece-ad45-fe86c351784a", "sighting_of_ref": "indicator--426cd3fe-3541-4c6e-9a97-8c7b5aaa8679", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a49dcf7-6464-4f2f-9e4c-a388bab4e684", "sighting_of_ref": "indicator--beb8904c-8ac9-4e63-bd2f-7fd6b6c222e5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1a3457a-6a4e-46d8-90ca-833769e10acf", "sighting_of_ref": "indicator--f2a26239-72e6-4602-9fb6-b0e6edee011b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c954d668-e0a3-41e0-a793-f9abf0ec1d5a", "sighting_of_ref": "indicator--f047b1d6-717a-49cb-8ae8-9d4ed533bed1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98f4743b-951f-40ad-9db6-849889ca2975", "sighting_of_ref": "indicator--a84c111a-c1f0-4f5a-a3c2-33c4fdf84010", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01e80791-c3de-481e-a6c8-1800b2361a93", "sighting_of_ref": "indicator--639c298b-8998-4285-b205-91c7d4c0dc1c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc2407ae-e408-4798-9729-6ca81361ed9d", "sighting_of_ref": "indicator--000c5034-2681-49ff-9a2e-c8503b74dab3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d3a034e-3be8-4276-9744-64c9c35184a3", "sighting_of_ref": "indicator--9451b4ea-ef43-4dab-a95f-3cad4a3374b2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbd1d406-d465-4066-bafe-94cf08240c29", "sighting_of_ref": "indicator--097681b5-366d-4417-a943-aa7357d97c7b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6eec342c-58a2-4563-a2af-d8b32464bcb1", "sighting_of_ref": "indicator--bfc95520-3edc-48af-a164-7a3f1d89519b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54e9b7c9-73b0-46d0-a0a4-967d56772a8a", "sighting_of_ref": "indicator--617c8079-f261-4d85-a14f-d6fdb3fca535", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--896e3ea2-d0d6-4848-b42c-3fbb871c03b3", "sighting_of_ref": "indicator--a4021c29-a62d-4f35-b2cd-f905e8ce5715", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--596f4071-d2e9-4337-9a21-d06416e538f5", "sighting_of_ref": "indicator--a4021c29-a62d-4f35-b2cd-f905e8ce5715", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e323ebc-bb9d-438a-9904-09f84a6aa2ef", "sighting_of_ref": "indicator--cc46dc68-43e5-43ef-a825-d92df6a8dfba", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2450ff85-13e7-466c-a94c-5e7ef44dd4fb", "sighting_of_ref": "indicator--8af65899-368d-4688-a9cf-f67fb675f782", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9d05de3-51e5-484a-aab6-a049fc579840", "sighting_of_ref": "indicator--06d822b2-c40b-4569-a5c3-e6d78b807639", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2df173e6-1f3d-4666-ae03-850d0979dac9", "sighting_of_ref": "indicator--658c8738-ee23-46b4-a72b-8c738a8ab547", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e568ebef-9fde-4188-a6f3-74b76ffa27e6", "sighting_of_ref": "indicator--a4d6ece5-db2a-41c8-867a-c9693a228c97", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a17bdcf-99a2-4aa7-93a4-5cca9d04d077", "sighting_of_ref": "indicator--97d1535b-1c1e-4220-8342-e4bc02c504a1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e220dc0b-c1b5-4e0e-abc9-3dc8a06f53fd", "sighting_of_ref": "indicator--a7ade04c-5914-4fac-b159-0a974246a775", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69cd59f5-0f1b-425d-b183-d7bd84ceceb4", "sighting_of_ref": "indicator--8faf8683-6c55-4f79-b3f1-c8fd7901e7ca", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59954e16-3dd7-4438-993a-bc24ccce0a4d", "sighting_of_ref": "indicator--ef04328e-e0ec-4952-9461-1a06cb7b851b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--423111be-eb1a-4965-8170-ba53129ebdcc", "sighting_of_ref": "indicator--87147bd0-635f-4a2b-87d2-73ee8b9b4491", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53aa65a0-7797-4137-8a7e-a00d8c89cad8", "sighting_of_ref": "indicator--e01aa818-0f71-4a0f-9ecc-10f83ce2338b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44a11993-5d63-47ad-a04a-261d493426da", "sighting_of_ref": "indicator--d6630628-1436-44d2-af29-93f3bcfb7201", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faa64562-3f81-4940-9adc-36f5d56a192a", "sighting_of_ref": "indicator--3d6587a7-c7e7-42f8-8c62-8b1f56dd1901", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02fccad2-15d0-4ff2-acb6-437b49468657", "sighting_of_ref": "indicator--6acfb0c9-f51e-47e2-905c-8a724b1a1d1b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff9e47ff-14bb-4c52-937e-4cf932acb5c6", "sighting_of_ref": "indicator--ca58123c-f585-4281-87c5-b01869bb16ca", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d9c49ed-e408-4984-8019-844f0f873d8f", "sighting_of_ref": "indicator--c5462a71-a855-4c6a-905e-7416858cb9f4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--422e66b3-6670-4436-9c3f-70230c78cf3c", "sighting_of_ref": "indicator--5d596824-51d5-48b5-89c5-8eec5b77d23c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6143065-7dab-4ad2-a7fa-fba9779fb66a", "sighting_of_ref": "indicator--d14e277c-7bab-44fe-b0da-b5ffd4ad3cbb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcde2963-634a-47a2-b8f0-ce1be00551c8", "sighting_of_ref": "indicator--38fe9c0a-eb4b-4f1e-b4ab-97b82b1138c5", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7f715a2-f132-489c-b454-e634baa8138e", "sighting_of_ref": "indicator--bb99627f-f0da-45f7-87fd-6116979f51e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1706724-867d-43b6-92ec-798378d62fbf", "sighting_of_ref": "indicator--17c7fad1-d995-477e-9fc8-015132d9085b", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5df5e488-95cf-46db-b45e-9054d8450842", "sighting_of_ref": "indicator--0a9722aa-6b54-42a5-98a9-0580b079a5d6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55ccafb3-6dfe-4d86-87de-4fc0a05747ed", "sighting_of_ref": "indicator--de52069c-3af2-46e9-bbe7-96a442546c0c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--110f99b2-b5e4-4d0a-9fb2-f8d8cad4e8d3", "sighting_of_ref": "indicator--8146ee3a-894d-4bb3-9f04-844ddd67ea37", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb4b8bd6-1182-4531-8082-d29006305ea7", "sighting_of_ref": "indicator--575d6fa4-13b2-46ee-b1b1-87ddc7fd694b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9277eded-8004-47fd-ba0c-d13fafc2fb18", "sighting_of_ref": "indicator--785ca154-c522-4982-b302-f0a7f17f51da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f44aeba5-525a-4943-bb0c-c240bda63381", "sighting_of_ref": "indicator--3fda589f-2016-4eec-8d03-2edd936a88ba", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc19a7af-be61-425f-833c-0705ee84f17a", "sighting_of_ref": "indicator--76754b5b-0814-449f-bc11-ff0c5dcebbc4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab058a20-4c0f-474b-9728-4ed26dee6fe6", "sighting_of_ref": "indicator--f440b65c-5985-4650-b5f8-a1ed85afcd27", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0954fa9-bd48-4f0d-b835-7128b5489417", "sighting_of_ref": "indicator--1f17a072-79f3-4119-984c-e8ccf96de6bf", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b5c65f6-f09a-4250-b02f-811ee2cda443", "sighting_of_ref": "indicator--4ca61669-0a39-46d0-80cf-343b15016821", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a25f7f0a-87c3-49d8-b92e-4c72ee711f11", "sighting_of_ref": "indicator--4071f0e4-a58e-4657-a692-2cbd291cf278", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e636cbb-19f3-4fa9-9b3c-964ff5f0489d", "sighting_of_ref": "indicator--5cbfc01d-db58-4383-82a8-cafdb4c4e2af", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--441881c9-4fcd-4144-9145-10229d90023a", "sighting_of_ref": "indicator--8c91e585-b8e7-4922-96bd-09c4273f5534", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fa18a88-bcd7-4c97-9e01-2f8b38601449", "sighting_of_ref": "indicator--897e1970-cb0f-4b8d-b53e-80f8b34c09af", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2112a80-4192-4388-be5a-6a6ffe59f67c", "sighting_of_ref": "indicator--ea3a43b8-4a96-4796-bf0c-ca388e5a1509", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45f06e6a-3a2b-4e38-be65-73efc543c0c4", "sighting_of_ref": "indicator--5bc55a73-505f-4240-a184-deda86d68976", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfd647df-4d92-4399-9df8-57498304316f", "sighting_of_ref": "indicator--5795aede-d28b-4b6c-aa56-8b6143865389", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf98d621-1a68-4564-8540-639fe8888f3d", "sighting_of_ref": "indicator--1d58f754-749c-4de8-a363-1406350af737", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1098354-b453-4076-9a4b-c4c406f82f3a", "sighting_of_ref": "indicator--1d58f754-749c-4de8-a363-1406350af737", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f9d61b9-9847-48c4-95e9-de2219ce7b84", "sighting_of_ref": "indicator--0ad2ec18-a01e-4bdc-a0fc-f986c41dc3a5", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b32e296f-e0ca-4428-ae8d-3791f67e3a2e", "sighting_of_ref": "indicator--c0153087-8fdd-470a-8b14-3080b2b20ca4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5366cc97-649c-4b11-bd63-40b460fecbe2", "sighting_of_ref": "indicator--d42e3127-5a51-42f6-a331-12a76fb07ece", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc04b924-a79f-4153-8413-5491ab1334a9", "sighting_of_ref": "indicator--b37564ab-6f33-47a8-addd-820ba178ca00", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7ab65d3-d69c-471a-a9aa-5ac9b3b65ba1", "sighting_of_ref": "indicator--79e60524-c905-4eff-b659-40e3985bceed", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c51314e-ae10-457f-994e-273183aa1b97", "sighting_of_ref": "indicator--72a99dc2-b779-4e35-839b-c82706e27014", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--519cfbbc-f10b-49df-a3b9-0fc2c5666a0d", "sighting_of_ref": "indicator--cd220c57-8ae0-41a4-a2fc-28b083c108a3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3daa8dd6-cef6-487f-b00b-6811632f7870", "sighting_of_ref": "indicator--43519c99-d829-49b3-8afd-6eefd77b94c9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcabeb74-7fbd-4066-bd20-6f17b493780f", "sighting_of_ref": "indicator--bdec1068-e690-4981-8ee8-92f3ad1e67d4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5643d754-10e3-42fa-9ba0-eeb9292f950f", "sighting_of_ref": "indicator--bb34a044-8ec6-4618-87c9-a3546f142254", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--775b7ffd-9254-4a72-a1c4-bc45449e6d63", "sighting_of_ref": "indicator--c1756735-2074-401a-a75b-a379afa92afc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7a5df1c-ad53-4ab5-8ccd-c4cb726cb444", "sighting_of_ref": "indicator--4f907948-1960-4142-a89e-cd3a9abe2c38", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--131b5776-6f3a-410f-87df-c5123d9a05bb", "sighting_of_ref": "indicator--94c27c88-f899-45b3-8714-714efc9ff708", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75a999cb-6487-4887-85a7-8ce049b05b33", "sighting_of_ref": "indicator--a141df88-8140-4b48-9736-b32ed384435c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07b5cec9-f737-4bc7-b097-1f36fb20603e", "sighting_of_ref": "indicator--b73402a3-6989-4745-b983-35a08ba56891", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49c6cf41-47c9-485a-b2d0-11a3b8f0d4ac", "sighting_of_ref": "indicator--6502a842-f4f3-4666-b9b0-dcededdcdae2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7056930b-79da-438d-945c-9b2dd3d69d28", "sighting_of_ref": "indicator--47bb9f96-729e-4757-92fa-75760ab66c0e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07892fde-208c-4aad-bc0b-803b5bd575e8", "sighting_of_ref": "indicator--aa8eb8f4-13c8-4070-9ac1-3f0b6680e1a8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c9951c2-fd8b-470b-94f4-86d59b71dc78", "sighting_of_ref": "indicator--d7b372ae-69a0-4e1a-b5e4-c704e856e7b8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--544125d9-ab4d-481b-9fb7-d4096661ab07", "sighting_of_ref": "indicator--14feb005-a538-4f13-bd26-ac5d36a3767d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f10245b-a750-4fdd-b9ce-588389884744", "sighting_of_ref": "indicator--e6951bd9-68db-4298-8e12-ae632aac1720", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2138a678-1ff8-43ba-a69d-a11f21dfc535", "sighting_of_ref": "indicator--790aa396-ff0e-4cbe-8eb0-c7aedf30042a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36fc812a-7266-4a6f-86a7-a4a19eb4ddc6", "sighting_of_ref": "indicator--ffbc3f2c-bb30-4ab0-ac21-0cbbec977a67", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cb979d7-59ba-40c2-87ab-b946bd9aa7b1", "sighting_of_ref": "indicator--8e904440-6558-4f86-b350-d1280929c429", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--292986ac-32af-4c99-a13a-66ce47fa8d9c", "sighting_of_ref": "indicator--8e904440-6558-4f86-b350-d1280929c429", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffc49790-9213-49b6-a47a-a999e9e4303a", "sighting_of_ref": "indicator--eade7fa0-67d8-4ea9-9cfb-b1e3903bdae6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84f1d2f8-755d-4bb6-98d0-1cefe838760c", "sighting_of_ref": "indicator--eade7fa0-67d8-4ea9-9cfb-b1e3903bdae6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a2a2b41-ee3d-43fc-a1c8-e27e5112b481", "sighting_of_ref": "indicator--ece89926-6c6d-4ab5-81d4-b9819e50f25b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ad2cde3-0a03-4d21-b83c-50ea82e834c2", "sighting_of_ref": "indicator--c0bbbb83-521f-4bfc-bc17-2d5fee98dd13", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--117bb7ee-efd7-4692-8de1-9212c1bce582", "sighting_of_ref": "indicator--a48ed720-49e0-4aaf-8e00-cbe84128b286", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e16d752-0d77-43ef-93d9-a0419c76a0aa", "sighting_of_ref": "indicator--807b710a-1ae6-4f8d-a095-2815da9a1b6b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84d73a52-4473-49a4-89da-8bb011d80fe0", "sighting_of_ref": "indicator--5762975c-0ebd-419e-8d6a-bac6a44a8bbe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--091edf04-e994-4da4-9f0f-c8d9db7aefc6", "sighting_of_ref": "indicator--f0a5389e-0ce1-409b-b632-42bd8106530a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8294bbda-af4e-4d71-8d7c-ef6ecda08869", "sighting_of_ref": "indicator--917b63cc-ca75-4a16-b70e-14fc457bf1b7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9ef5f29-05d8-4a51-a610-1c2cbe275036", "sighting_of_ref": "indicator--858f9926-ad6b-4bd3-b5b8-6a48425c9d0c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c856374-c3db-4fa8-a7ae-5fd55d47a171", "sighting_of_ref": "indicator--143c1c88-35f1-4055-8d03-808bc06e950e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65eea421-f283-4df7-ae65-b4ba82c84920", "sighting_of_ref": "indicator--dc14057f-8f75-4785-896b-9d87c66f4ed6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f514c6c-295d-4618-81cf-c96c206130af", "sighting_of_ref": "indicator--ae1a40fc-2619-4686-ab7e-358e491ff226", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d02a8d6f-8b08-48dc-93ca-a0b1aa1cd49c", "sighting_of_ref": "indicator--ae1a40fc-2619-4686-ab7e-358e491ff226", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1aaee7c-1de8-4056-92d9-1108a0f1879c", "sighting_of_ref": "indicator--9461d2d3-57a4-4051-8ee1-1d7f36eacd4e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18c417ac-42ff-4b9a-97ad-2fcc788ba182", "sighting_of_ref": "indicator--9461d2d3-57a4-4051-8ee1-1d7f36eacd4e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffabf9a2-73f2-4471-9812-24735e8800a8", "sighting_of_ref": "indicator--cab3b1d9-720f-43a6-8493-1257f563ec1a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d03211c-c1c1-460a-8cdd-af8948944b47", "sighting_of_ref": "indicator--1d75c8e4-b6ec-4da3-9be9-8e101f1dff71", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed6806a6-46e6-461b-910a-043e0a8593ab", "sighting_of_ref": "indicator--1d75c8e4-b6ec-4da3-9be9-8e101f1dff71", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c0812bf-c2b7-4a47-bb54-56f0926e8b50", "sighting_of_ref": "indicator--dd056346-1f19-4806-8c50-fe9846c613ba", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e0cafac-23c8-481a-a283-ec7bc56fa2d8", "sighting_of_ref": "indicator--9476b91f-3afc-4da5-ac2f-92b662fd0974", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e415d326-1576-4a6e-a779-11d06e6a2668", "sighting_of_ref": "indicator--adacc8e5-8824-4490-aa52-481605ae65ed", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--044c1fac-31ba-44ba-84e8-1e2fd1c5bd17", "sighting_of_ref": "indicator--0653ed81-c48a-4176-9be8-56a229d19e59", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc57e905-9368-4208-985e-39bbe9f48050", "sighting_of_ref": "indicator--973d784d-908a-4aa5-bb28-7147bee3e929", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1c05b10-4fba-4543-b398-733bef9b1b7b", "sighting_of_ref": "indicator--3a654c36-d58d-4683-8bfc-fa7aa6b0ab0a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a6365e3-7bdf-4b6c-a091-70f965326c48", "sighting_of_ref": "indicator--e92192cd-85d7-43c9-8343-69fe1dbbcfa2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee1832b0-1052-4610-a587-23300e5bc129", "sighting_of_ref": "indicator--1dc370ca-39d1-4df6-ae77-2f4320cd5c97", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be7b2eed-634d-436a-9d69-4501c3fd407a", "sighting_of_ref": "indicator--32b161e1-cbe9-493b-b8c6-878db50d7399", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbfd2279-d6a6-46db-9319-c3eb59f5b381", "sighting_of_ref": "indicator--32b161e1-cbe9-493b-b8c6-878db50d7399", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad8fd93a-027a-4855-a9d8-0303e7d5c92a", "sighting_of_ref": "indicator--cc909233-bb03-47bd-a9a2-73fdbeb1226d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51ae2944-e225-4759-b964-46ba6296dd87", "sighting_of_ref": "indicator--de38f487-229d-48b8-abb7-490b18b1e1d2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d6e8a3e-ec26-4558-bc0a-37ed719bf956", "sighting_of_ref": "indicator--3956d957-0db1-48ab-94c2-c9056dbbbcec", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d480d93-bd6c-42ec-a869-11486d97e571", "sighting_of_ref": "indicator--3262eb8b-1a2f-4234-b3bb-3ea8353a739e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b8e04e5-03e7-4255-a9aa-8af7bcec37a8", "sighting_of_ref": "indicator--270a3f01-d491-4ba8-8139-2790412a0bc6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b867c16-26e0-4f97-9742-de5dd9b1dc8e", "sighting_of_ref": "indicator--706538af-850b-4e1f-994b-54dcf4137318", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8117ab9-66f3-4a1c-8358-d3536cdc96df", "sighting_of_ref": "indicator--668a2a42-15bc-4754-b708-44fe41814cb6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba407900-4fec-4ea6-b1f6-7568c23cfc61", "sighting_of_ref": "indicator--60fe1820-1ba0-40fe-9092-aa5b20e4d002", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--718fe0ff-940c-4d4d-a265-5d0af986151f", "sighting_of_ref": "indicator--ed209121-219e-4fb3-803f-79c6e508d51d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a897ac94-a40c-487e-9fe6-651f56002e1e", "sighting_of_ref": "indicator--a0f133df-5765-48c3-bab1-cdd8b8e3757a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--515ee98b-9201-43f8-acb8-4e57b4fca4d7", "sighting_of_ref": "indicator--41b4c3ef-dc8b-4ab2-ac63-524e0682c315", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--262ab84c-fd55-4e58-8ffc-8d7b2ce34daa", "sighting_of_ref": "indicator--ae1d2ee3-e1e8-4d57-bd2b-6d581601d605", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea3a8b22-271e-452b-a893-02814d2aacc2", "sighting_of_ref": "indicator--79c798a0-4dda-47b1-9085-648ed0ad8d31", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5a907ab-6386-4898-ab21-c22946afc5cf", "sighting_of_ref": "indicator--f708d3d8-5694-4227-bf0e-bb071e3bebf8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--702cf2cf-2c22-4612-a13f-30d0a571606e", "sighting_of_ref": "indicator--ad596ed6-4269-4812-ac87-8f2c92cd4153", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97ab2b36-b828-416e-9b02-8ffdd659e004", "sighting_of_ref": "indicator--ad596ed6-4269-4812-ac87-8f2c92cd4153", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95925000-0bc8-4c97-aa13-ff13aff0c654", "sighting_of_ref": "indicator--dbe88bac-25e8-4710-bc9f-a1cdb5b7d829", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03efc8e3-ed3e-44ae-b7db-dbd02ffa0a46", "sighting_of_ref": "indicator--dbe88bac-25e8-4710-bc9f-a1cdb5b7d829", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddf5279e-811a-420d-9671-d40c225354b7", "sighting_of_ref": "indicator--795f7539-4df0-4cb9-9a5a-b67960ed06ae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08ec41d6-0634-4959-a401-f1a4fbe4dbcd", "sighting_of_ref": "indicator--b0889a3d-afe8-47d1-b8b2-f1f7975e8f87", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae63e7eb-2cea-416a-9def-71fd852c4901", "sighting_of_ref": "indicator--37e691bf-acd8-4e73-bb10-1dad19f34496", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4635ccc-e9e9-4258-b66f-ab70b2420102", "sighting_of_ref": "indicator--b2a9dc64-596b-40bd-b7d2-2fb320bd506b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95fa0f91-b076-4233-9989-a6455c24f3e2", "sighting_of_ref": "indicator--72cccae2-a1d1-4331-9b49-aa168b1875c0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--471e2e3f-b1bf-4a28-ade3-ae84a4714423", "sighting_of_ref": "indicator--db612617-3775-4935-b342-dedbd5c72c7c", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79b479b4-2e43-4957-9759-079a5972b452", "sighting_of_ref": "indicator--a0dc0c51-ba38-407f-a72c-b1b934ce9902", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46153ab3-8806-4ddd-b575-7d22cbd19906", "sighting_of_ref": "indicator--a0dc0c51-ba38-407f-a72c-b1b934ce9902", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--726a5098-6452-4053-9b9a-a6aaf277954f", "sighting_of_ref": "indicator--365499d8-b1c8-4f67-81f0-0a34e0ca3f7a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17a3c383-ca57-491f-b08b-5a15c4daabb9", "sighting_of_ref": "indicator--9e00a4a6-c2ec-4cfa-a511-e54d623ff7bc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e079920-4b32-44f3-85a6-0e0fd019e4fa", "sighting_of_ref": "indicator--9e00a4a6-c2ec-4cfa-a511-e54d623ff7bc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4569818-9906-4aa5-987c-b122b870fdea", "sighting_of_ref": "indicator--ede9d68a-73a9-47e6-89a3-ea94aeb5f2bb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1ce0162-c5f0-47b5-a9dc-67c924edddc3", "sighting_of_ref": "indicator--9efa72fe-7774-451a-9478-eaf8ae04d07a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34bacc21-dfe3-4be8-aa03-e60f450b6229", "sighting_of_ref": "indicator--2497c0e9-f2b3-4b88-b79f-90a418900d32", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c853cd0-2391-4fbf-bb2f-544345bcc4cd", "sighting_of_ref": "indicator--cc3bdc34-c3b9-423d-8f21-fec226d72410", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bed86b96-2eaa-4f76-970f-fd62830d5f57", "sighting_of_ref": "indicator--587356f3-50b5-4c2f-baf5-f5400fe02652", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9507ee13-75a5-4fc9-a966-10f8f855a60c", "sighting_of_ref": "indicator--dc70ad7b-0a37-4631-af57-9ea1d9cf5c7a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48d5d753-54eb-4ca2-b896-9b8dfb2e5261", "sighting_of_ref": "indicator--788f97ad-c6a2-42ea-81c2-a95b3ef361fe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1b1d7c8-ecf6-42a0-95b5-abfd5f2f5160", "sighting_of_ref": "indicator--64b828a7-e1a7-4aa2-980f-f774708cfd41", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8456e31-e16c-4b0b-b53c-779ecee01307", "sighting_of_ref": "indicator--a7899e8f-dc0b-494d-8b44-5314c245a928", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b54fbc54-210f-4c85-999c-ebeb35c42f96", "sighting_of_ref": "indicator--a7899e8f-dc0b-494d-8b44-5314c245a928", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--026dfd51-99ee-4490-81d1-2a351aa51b6b", "sighting_of_ref": "indicator--581738fb-0e1b-4610-bf9c-0c80a67e4775", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7021b9f2-9d9e-478c-946e-55cd09d588fd", "sighting_of_ref": "indicator--f1c56db8-2f67-4933-881d-ed181a37d9ac", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--475b973e-5adb-47e6-8fa1-718c447a4c94", "sighting_of_ref": "indicator--271b6d1f-407d-4051-9309-9e44c340c534", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f63b8f3f-f665-4828-9a3b-017c30c1b6ac", "sighting_of_ref": "indicator--bd05c17e-7361-474d-a1af-18896892882a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b8d8b4e-3416-43ad-9d10-ab45dafb4679", "sighting_of_ref": "indicator--47dcb875-df06-487e-ab5a-c8153838f969", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61b590f1-d842-453a-9dda-0a81d9631021", "sighting_of_ref": "indicator--b222f73b-23ca-4350-8c37-09c9b76ded1a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--845d2a00-3ca5-4817-8e27-d98e84430581", "sighting_of_ref": "indicator--f3fac308-0592-4361-abe6-f67fc11bf64b", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eed69d16-cae4-4e90-844a-fd43e55bf67a", "sighting_of_ref": "indicator--528e8384-0c84-4af1-8221-017c07166279", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--539a706f-91cc-43b4-9e28-31eefe833621", "sighting_of_ref": "indicator--5670bf60-2942-4691-bafc-7cfe9be6da55", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a97f0e3-3e59-48a8-9895-878972b1e756", "sighting_of_ref": "indicator--5670bf60-2942-4691-bafc-7cfe9be6da55", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b5e4113-2109-4687-a2ae-d3e7116b141e", "sighting_of_ref": "indicator--a6429ad8-7df7-4fca-afc1-09fe1b679bda", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b5d2d10-28bb-4b5b-a91f-121a78688789", "sighting_of_ref": "indicator--e7cf3c0c-18ff-4b2c-8806-b2e900a6f2c3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fa8145e-d420-4723-9406-f683b8449af9", "sighting_of_ref": "indicator--5f9f1eb6-da92-4fe3-8610-646a5477cbf2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57f4435b-0bdf-4975-ab62-189c766a8f77", "sighting_of_ref": "indicator--b5ff5721-8ecb-4a15-91fb-452a7e15d53c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6c774d5-b4ae-47db-aab8-28a1b7361261", "sighting_of_ref": "indicator--bde576fb-8672-4366-ad4e-b5cc4873b650", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5086c333-0e24-4186-8264-8a3052df1527", "sighting_of_ref": "indicator--9b1a6fd4-d499-4a1b-a64c-f133f73937d8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0209393-5167-44cc-b152-4746b2abc004", "sighting_of_ref": "indicator--0381cbb7-87ca-4936-a5d1-421284cb963d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77221b1d-8de7-4350-b55c-c8ac0f82500d", "sighting_of_ref": "indicator--3c6a4292-875c-407d-8ffc-36b45f5d6da7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ff82fcb-51c2-4f4a-9f83-04482a8344d7", "sighting_of_ref": "indicator--90f0d269-1b72-4ec1-948c-efb1d02f76da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e10d5916-143f-47d0-b05d-c2f32bcdb1fa", "sighting_of_ref": "indicator--903d599f-db02-42c5-89c5-755eaa03c2d5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a6a93e9-a43a-4557-9853-7fd935d629f0", "sighting_of_ref": "indicator--1cc5e1ca-f558-46ec-82f9-2d25621ea5d9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9cb6b7f-241c-4f9e-94fb-08b1a858677b", "sighting_of_ref": "indicator--fe483bda-b4be-44a1-99c3-70a6f8c2ffd3", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60db5941-a6ee-4054-87f2-c375918057b8", "sighting_of_ref": "indicator--3a59ff32-9508-438b-83d4-31949c31459b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--800a9bfd-2414-4845-90f4-0c1246a7334a", "sighting_of_ref": "indicator--c0f7148a-cf57-46d6-9bfd-b62c18e27096", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a8b3706-b660-4b8d-9a22-7418b17ebb6e", "sighting_of_ref": "indicator--c0f7148a-cf57-46d6-9bfd-b62c18e27096", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0074c9c-decf-48cc-bbb6-20d75c0d222a", "sighting_of_ref": "indicator--e29a71cf-7a6b-4256-b7c5-01660a471566", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32aa38ca-252e-4d15-a16e-5fed592798e8", "sighting_of_ref": "indicator--1d1b5b76-86b7-411e-8cdd-d38feba808fd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4800bd1-847a-4c51-acf1-72c5a98372d5", "sighting_of_ref": "indicator--1d1b5b76-86b7-411e-8cdd-d38feba808fd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--835fb3a3-4686-4c2d-8a55-96f9c871ac30", "sighting_of_ref": "indicator--84a3fede-a96f-4314-8913-d9cc7df7955a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1347a0ce-954c-49ab-bb37-5d0719c8084e", "sighting_of_ref": "indicator--17c47d40-439c-444c-851f-0655b455396d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8c7acc7-fde5-44aa-b9bc-2128640a16c3", "sighting_of_ref": "indicator--f7ae533d-1ab3-4533-9d81-143a09821cd7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c9c9f65-c03e-468b-9ce8-a3d9984e7c80", "sighting_of_ref": "indicator--59051225-2da5-4c4b-8eeb-264fe3584b15", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d73f5d7-97ed-4836-898d-e651d1465c26", "sighting_of_ref": "indicator--67a7988c-474d-4502-85ce-f95f53ed07a9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bc0e22c-9c00-49e4-9487-2d3591b83074", "sighting_of_ref": "indicator--03624803-e9a7-4328-ba6a-0b23b2e618f7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85952527-900a-44e2-a7ab-9ca40e888689", "sighting_of_ref": "indicator--03624803-e9a7-4328-ba6a-0b23b2e618f7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6dec3be-8024-44b2-96e5-82a759e4982a", "sighting_of_ref": "indicator--c0e779a5-c00e-4989-acd9-e5d34a0dd489", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea3549cd-fb86-41cb-aa6e-1913e17c385e", "sighting_of_ref": "indicator--8b9d5542-e37c-46d5-8270-1de86846b288", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b0ecbf4-d7c4-465f-ae7c-d4f49b8f9dcc", "sighting_of_ref": "indicator--922fc56c-9897-417b-ace3-8d30b22fb0b4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2493abd-90cc-400a-8bf4-9cd6c04bf62f", "sighting_of_ref": "indicator--677fada3-e0e1-4fd2-8e41-0aa029c04ae6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbc863a5-7170-4d14-800b-f85a6dcc6b20", "sighting_of_ref": "indicator--7d44b24f-9157-4c8b-afc8-930c718a78af", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28b2cf05-71c7-47f6-9e4d-522bfb275d64", "sighting_of_ref": "indicator--b5694bd2-20b8-4ef5-b34e-e92fabe8ca0b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb0ad99a-30dc-43eb-b1b6-7734755750f9", "sighting_of_ref": "indicator--ce3985c3-65cd-419e-8467-8594097043cf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--265880df-0ed3-408b-9bb8-f53d48e16fdd", "sighting_of_ref": "indicator--5f902fdf-c2e1-4474-b58c-b43e02078055", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e3d9d8c-59bf-4129-aae8-896b434b1673", "sighting_of_ref": "indicator--5f902fdf-c2e1-4474-b58c-b43e02078055", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9901fbb-e85a-45f0-a8dc-f83ac0db90c9", "sighting_of_ref": "indicator--b2e106ee-b78b-44fa-b6eb-c7e9f67cc673", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39364928-07a1-462f-a1bf-75e21f806bd5", "sighting_of_ref": "indicator--b2e106ee-b78b-44fa-b6eb-c7e9f67cc673", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19fa2933-c5a3-4085-8e98-f4114acfe452", "sighting_of_ref": "indicator--ca82629b-4861-47d8-b6ac-475fff280d90", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34702e5a-be71-49ff-ae9a-9318432ea361", "sighting_of_ref": "indicator--ca82629b-4861-47d8-b6ac-475fff280d90", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83fd3f77-cc42-4f30-9f39-7a167f0fcbb3", "sighting_of_ref": "indicator--bdf33235-444b-4ab2-959e-71988b724347", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7228679-2c71-4bed-8746-500c0e4d900e", "sighting_of_ref": "indicator--f973aa8b-1043-47cb-9d22-a747b32a3b6b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c91fbca2-31e3-49d2-bd34-10e5a6598345", "sighting_of_ref": "indicator--d4a44867-417e-4758-8fb8-ec84f65d1345", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b908dec-6e32-40bc-8244-6ad23203660d", "sighting_of_ref": "indicator--67378246-1ccf-4c01-96b7-8f67530795eb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a5b03ed-ab01-489c-9f17-ba702beed4a9", "sighting_of_ref": "indicator--fa0d9360-d232-4bce-9ce2-e261acb83dfc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a606e9c2-266f-43f2-beb9-105d6ecdc678", "sighting_of_ref": "indicator--59e576a5-8280-41b5-99c6-85bf59b4167f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4c63fe0-ab0e-4f8f-9cfe-ea0eb336ac77", "sighting_of_ref": "indicator--90bbeb2c-0907-42f9-94fa-130e95f7be5e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78356459-db44-42dd-889a-0382d4d21a7b", "sighting_of_ref": "indicator--4911648b-8cc8-4e3a-b486-b81db4acbc46", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f5a7bf2-6afc-4b48-845e-fb4fa7150e8a", "sighting_of_ref": "indicator--54bcd071-7161-457f-b8b2-1ea3c8d44ae3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce7425cd-01b7-4aa2-baad-b60f5e9fb942", "sighting_of_ref": "indicator--2f77215e-c6d4-4021-beeb-f34c088fb6e3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ead317c0-0fcf-4f65-801d-a81daa819d58", "sighting_of_ref": "indicator--8d2012ab-c281-4bf2-8921-7c1b1dff9088", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4601fca5-1529-4de8-a118-750ddca4e748", "sighting_of_ref": "indicator--9f7579e6-2ffc-48e9-8cf8-8fe86e021719", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3459317e-4346-47d7-8474-bb5ae610cff9", "sighting_of_ref": "indicator--b3c153f7-5e31-4193-91e8-ecef5ac4d545", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68870e03-2fed-4a17-ad94-560ef065923a", "sighting_of_ref": "indicator--ec8a304d-c2ad-4a06-888b-407e77f53631", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d9aecf2-2632-47c1-b534-a1e549172d7a", "sighting_of_ref": "indicator--22b156af-036f-4c31-8b9f-b7d351e9d3bf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b98a0e9c-0ea7-4843-ac77-c2e26bac146d", "sighting_of_ref": "indicator--0589ec82-820a-47d9-84ac-dc4bb3ab315e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ccdcc84-000e-4593-ae92-91e017ec92aa", "sighting_of_ref": "indicator--e574a104-f691-47ed-8c3e-8e30079823ce", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b02d7692-89b4-4ef2-8e4c-d2e0e6a6ee52", "sighting_of_ref": "indicator--15085f59-29d5-49d7-9235-26d914109ce4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2abce6ff-2d94-489e-8359-db26b6643e50", "sighting_of_ref": "indicator--d424e56f-1e1d-4f55-acd2-ea126a685b50", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2b7fe1c-3e9c-43f2-9b8f-5176017537f7", "sighting_of_ref": "indicator--d424e56f-1e1d-4f55-acd2-ea126a685b50", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--430e31be-ce8e-47bf-bf78-072d4e36749c", "sighting_of_ref": "indicator--7c49d44f-82b3-49d9-86ef-88c7b22150b9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--113e6400-05d9-4134-a1cb-c76a27c4be49", "sighting_of_ref": "indicator--bae07be3-70bd-467e-ad3e-250b8119c9a7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d358046-f1e6-42d6-898d-93ef01254969", "sighting_of_ref": "indicator--06e8337b-11fb-48d1-ac21-d48d55a02dbb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7eca4a5-2c83-4c09-8aa1-870345df3d3d", "sighting_of_ref": "indicator--ade423f6-e501-455d-bdbc-3d730b6bee1f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19e7405b-6804-4af6-a160-3323730ddcb3", "sighting_of_ref": "indicator--97c7f52c-7911-421d-9607-c68156b11bfc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83d0bd6d-120d-438c-af5f-e09439999250", "sighting_of_ref": "indicator--7a2e3344-641e-4445-82d2-cd60744baf5a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7577108c-79eb-4f49-9355-a40b4ea58617", "sighting_of_ref": "indicator--3ea21867-1f9c-4298-8276-fc7f9bab46da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da12945c-86f2-46df-83e4-8d02aaffeb28", "sighting_of_ref": "indicator--54a46306-59a1-420f-9675-c6465678a6d6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3716865-e6b8-400c-9e70-6fa3946ab33e", "sighting_of_ref": "indicator--544d78d2-1434-4ee0-a81d-83506c27942a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aef30fcf-0ea0-41e5-883d-a4731f1efc2b", "sighting_of_ref": "indicator--6be0593a-b7ce-40a0-9901-270117828953", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bbeb1e0-394d-409e-b0d6-dfc9455d9b84", "sighting_of_ref": "indicator--dce7bd1c-f4ee-47c4-b824-a16bef9ce10a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--133884a1-f460-4e87-ab0a-41669adb1a44", "sighting_of_ref": "indicator--68051773-fcf9-4ecb-be0b-f45e9f6e6c83", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24b27c55-9ca2-4e16-bf70-732dcde09695", "sighting_of_ref": "indicator--793364a3-3672-4d89-9f0d-9b9fb004a3f1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fa0bb84-8525-43d7-9559-10716663a698", "sighting_of_ref": "indicator--9afdef08-e071-4ba7-8799-ffde8a07cf26", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27f18cdf-9922-4843-8cdc-73d3d01104c8", "sighting_of_ref": "indicator--17a65a17-7461-47a9-93fb-3d9fbf0ec096", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--374306c6-2a77-44b3-9f19-d3fa2c6c76b7", "sighting_of_ref": "indicator--76974594-73d8-47ea-be63-f4224d1fad70", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57963139-8260-46d0-afc9-520c4e822002", "sighting_of_ref": "indicator--76974594-73d8-47ea-be63-f4224d1fad70", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a3a2307-07f1-412b-8875-424a6d872079", "sighting_of_ref": "indicator--692e05df-0c5f-46a8-bb8d-1e3e287f1668", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e336cd88-e8b3-4944-9bd4-e93c3824b6a4", "sighting_of_ref": "indicator--8f310ab5-bf8d-49be-86f0-fef1e91c152b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04db552e-961b-44e1-9c8f-93697acad8f5", "sighting_of_ref": "indicator--c2732fb8-2f07-4bff-a030-4184f0f8b8bd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0822bf8f-d4c5-4352-870e-a0266688e130", "sighting_of_ref": "indicator--5b421131-5cac-4945-9889-48fc95d853b4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e693d1ea-3e6b-43de-be05-75d472712036", "sighting_of_ref": "indicator--5b421131-5cac-4945-9889-48fc95d853b4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6baed15-ca27-4488-bace-e5621d774acd", "sighting_of_ref": "indicator--f2b62a77-d216-4db9-852c-b4558b9bebdc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4959c9cc-93a3-40a3-8a1f-ddfcaa49de2d", "sighting_of_ref": "indicator--efacafbd-277e-49b0-bf51-f0362d798903", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e3e0240-457b-42a6-934b-b7802baeba47", "sighting_of_ref": "indicator--8908b58f-6597-46b9-8d1a-5419de2f7436", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5010b13c-8bdd-4404-87e8-0c5032580d34", "sighting_of_ref": "indicator--df20095c-9698-47f3-88cb-063df331d2cc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cecef33-0bfa-42d5-85f5-577465bc8dcd", "sighting_of_ref": "indicator--81435ce9-a49b-455a-b51b-3b43bb8bec71", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18906e10-50d2-4bff-91b7-5cd044d07d9b", "sighting_of_ref": "indicator--f3a24a20-4b79-4a2b-959c-e59e57bc1a70", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07e1a3c7-f431-4e6f-a777-38504c85cf25", "sighting_of_ref": "indicator--d52a932a-3504-4fcb-9ceb-1c29db25b3d6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2ca8ec1-4df3-4cc3-b897-5454d25241a2", "sighting_of_ref": "indicator--7d7823e2-514d-448f-a1b7-d852b5aefc42", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9f69f89-d6f6-49bc-ae8c-92d698cc261c", "sighting_of_ref": "indicator--558506b2-6d1c-434e-819f-8b13740118fc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d66ab8f2-3769-4967-9161-23192a59987f", "sighting_of_ref": "indicator--b7785c95-4592-4b2a-9441-b487acb7c983", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--761662b1-5252-4fc0-a939-a83a7e44e9b2", "sighting_of_ref": "indicator--d685254e-30c4-40d6-b784-b82756d343e0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9a4be81-9ce4-48f7-8eaf-d0714ba8c40c", "sighting_of_ref": "indicator--63904afe-63a0-4ad3-a9b1-2d86a33137ab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02dc7b5e-f556-433d-b094-869399685be2", "sighting_of_ref": "indicator--4c143481-0a61-4183-b4d7-0ed19adf5bb0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18adae09-afb2-44a5-b455-268628c7e47a", "sighting_of_ref": "indicator--c5df7bb7-2113-4503-93b6-a58a5ab20b31", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f822414f-392d-4f79-8aac-896a875191c1", "sighting_of_ref": "indicator--35e11d0e-4ffc-45ae-9966-8d0c6095606b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fc1ecfc-0130-4de2-9c6d-d69009ab6178", "sighting_of_ref": "indicator--ceb27dd1-c3c2-4427-b1fd-5229b07d56b5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--248a47c1-803f-4622-ab24-59b84cc2230a", "sighting_of_ref": "indicator--6ce4f53b-a930-4ee0-88d0-1b690e85b65f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27fd5657-d063-4176-aa29-98ae347b5298", "sighting_of_ref": "indicator--b63e726e-5be5-41e1-9a93-20ee062ee9ec", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef55ef3d-b5c0-4343-8eb3-384085b76aa1", "sighting_of_ref": "indicator--2f769483-49e2-4ffd-ad17-ffb91cb57ec7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00c716b9-4488-4f9b-83ab-b66bf803f207", "sighting_of_ref": "indicator--2f769483-49e2-4ffd-ad17-ffb91cb57ec7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--455f140a-7584-48ec-a906-b8f87046dd2d", "sighting_of_ref": "indicator--372f28c0-9d7e-4968-ac4a-dd93104687a8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b491219f-c09c-4324-93dc-1ccb61927854", "sighting_of_ref": "indicator--51e5086e-0408-4e5f-b9a1-c8a5bd01a5a5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2675e24-863a-4cfb-95a6-c08881e13073", "sighting_of_ref": "indicator--b89f24e8-0c40-4fa3-b464-ed9bea98e0fc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0998436-38f6-4865-b42f-fdfecd25f70f", "sighting_of_ref": "indicator--2a39b63d-92ba-47d9-9396-6d223bdf8b89", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1d12657-50fd-4ba5-9cea-897dd4efccfb", "sighting_of_ref": "indicator--eabafe21-b0d4-4510-9a19-f7f2c653233c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ffe9b87-2205-4d4d-b367-5904766efebd", "sighting_of_ref": "indicator--440e3530-a305-41ff-af4e-daa7a8d46f92", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7df06cb8-3cd9-4924-8a1a-b58262b69df0", "sighting_of_ref": "indicator--999f5025-7804-47dc-a638-229b8b3d11ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea395133-6a6f-4e60-ab4a-fccf4f055646", "sighting_of_ref": "indicator--98acbb63-e288-4a49-885e-fff17d549716", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44e5fc38-3238-4786-ae4c-c672d19bbf22", "sighting_of_ref": "indicator--b591bbac-8364-414c-b15a-19a4546bcd8b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae3e0fd7-53fc-473f-a0bd-a9364a50ab12", "sighting_of_ref": "indicator--c1437612-8e1f-4419-803f-cead15e44f0a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ca82e1e-5980-4465-b370-20de97e947c6", "sighting_of_ref": "indicator--b618e8a6-babc-4602-a375-8abd9e81947c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95153ce0-3b4d-49b8-a650-c34789ffa50c", "sighting_of_ref": "indicator--b14bc9d3-f8ba-4803-bbfd-667823f3321b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8007b916-9c23-47cd-9e7a-3c54b103c4f4", "sighting_of_ref": "indicator--1cefd9ec-5e40-46a5-9674-8a777f022a4d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c73a8845-b74f-4f29-a247-7c02402d8235", "sighting_of_ref": "indicator--405a6d44-4817-46a0-89a5-2516fc095db1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f197765-9d2c-43f7-bcbc-2644c1c319ad", "sighting_of_ref": "indicator--7c004daf-cde9-4085-9999-ac50bd80409f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--250ce0bb-bcb6-4094-97ba-51a8c1dfaf64", "sighting_of_ref": "indicator--08af8f49-2868-45c5-bb99-727c185220d4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7294c95f-16d0-44a8-8547-c1a8393dcdcc", "sighting_of_ref": "indicator--c2f66b13-2924-4516-bfca-30518b61d98f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7442ea78-769a-4daa-9373-fee839f8d05e", "sighting_of_ref": "indicator--0bc119d9-fffc-4336-8a2e-386293682b92", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--193b99dc-5b8e-41cb-8e54-3060d47127b4", "sighting_of_ref": "indicator--23760baa-7e06-4c5a-b319-6c5c52e58f89", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eb263e7-8f86-407e-ac01-c0dc8e027b79", "sighting_of_ref": "indicator--775e07c5-3d4b-4bac-b661-f00fcf734833", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddc76ff4-02da-4549-9c6d-d35d97ea23fe", "sighting_of_ref": "indicator--775e07c5-3d4b-4bac-b661-f00fcf734833", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20f1d489-6f58-4637-a501-75439ba995df", "sighting_of_ref": "indicator--3fdd9631-7535-4e7e-ada8-9d16397336db", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f89c04ad-8ecc-4078-98e1-aebc88a684d2", "sighting_of_ref": "indicator--c96dcbbf-1497-4dbf-8f74-8a76825752d3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45b06cff-37fa-4a5b-82b9-e89a2ddadeda", "sighting_of_ref": "indicator--11443e0f-4e9b-4aa9-99c3-3e5b2cc3732e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54312be1-d871-486e-9bd3-26c4cbacb26e", "sighting_of_ref": "indicator--13f65610-c6b8-44d1-9787-8106a2ec4a81", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8284e2b-ac00-4b04-969a-a73f92edb5e0", "sighting_of_ref": "indicator--5f14e594-d6d4-4b33-813e-9c93c6f5dd9e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5eabdaf7-a9c9-4f65-ba85-203350233f32", "sighting_of_ref": "indicator--f03158dc-05b5-48d0-8722-137924e77efe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--780ad6a2-c813-4fb6-9b83-15d224168d28", "sighting_of_ref": "indicator--47449f2d-1c3c-412a-b50c-5b315e28cd15", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--279fadbe-38fa-4402-bbea-92185542f03f", "sighting_of_ref": "indicator--b3d25297-3ce2-4c5e-9811-79dd14937822", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53e4a4d4-39cc-4953-9f90-56fd5e63983a", "sighting_of_ref": "indicator--05b55604-589b-4eed-8969-46d2fce6340d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--952f30ab-b834-477b-be72-9a00de7f2ce0", "sighting_of_ref": "indicator--dc57cc25-9f2b-4ba0-95be-a044c3bcb737", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28aeb186-0811-4ef4-8342-f4c217ca8aa0", "sighting_of_ref": "indicator--746e2419-2034-4a31-9cfa-a97a02a22f0a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24947585-e46e-4836-a2fb-3641201da7c0", "sighting_of_ref": "indicator--2ff090d0-63a4-4d4f-b1ef-5d48a1cb92c3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--390edd24-3b26-4e34-981e-b757fac8d9ff", "sighting_of_ref": "indicator--ddee31d6-08a6-4cc3-902a-1794df54d743", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b56295d1-ff31-436b-b33d-4b52dd7a41f5", "sighting_of_ref": "indicator--c4b01da3-3725-4af5-ba92-f62a36a98443", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5321e680-9632-4f58-b6a5-901850ef5542", "sighting_of_ref": "indicator--36e5988c-889b-42a4-b807-61aad32d2ff8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5ac9ebc-d9b4-4281-8f40-75f0c623a737", "sighting_of_ref": "indicator--cbcf88b7-da40-4a65-8ae0-7766be100a73", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d940e5c-6604-42e4-b5d2-d65a36b32f32", "sighting_of_ref": "indicator--d6b8ed4b-3462-4cf2-9bed-7f06fbf11f7d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb900903-020f-405e-894d-d5b3c274d01f", "sighting_of_ref": "indicator--d4360140-8a69-45a4-9362-2cce4eee3a38", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33138e13-a2fe-44fc-bddb-45e352053fbd", "sighting_of_ref": "indicator--a50352e1-8209-40c3-aa3b-c2539d2ce5c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56852226-b2af-4860-b688-e5eda89cf314", "sighting_of_ref": "indicator--4b3d1c0c-7aaf-4a15-a5d2-7e74ddb7ac3c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96a4d645-fb41-4834-9b3b-ba7759230ce2", "sighting_of_ref": "indicator--4b3d1c0c-7aaf-4a15-a5d2-7e74ddb7ac3c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b89d2c3-d6b4-49f4-82ab-65f7ecd8653a", "sighting_of_ref": "indicator--9c98dc35-dd0b-457a-80eb-8b036de1fae3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05059c75-49a6-453c-966c-ce58a46c2e86", "sighting_of_ref": "indicator--1d8ba945-0fd3-4adf-870c-525aef3dd5bd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aab8f67d-a0b6-41a6-b8ec-483b362d00f8", "sighting_of_ref": "indicator--9603dfc6-4dd9-46f0-8810-5b960172b237", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbf8a98a-024e-4f54-bb97-6b3e374869d2", "sighting_of_ref": "indicator--2caa1790-e0c3-431d-9add-0596f8a60dbc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69b494e2-8fbc-41f7-866e-e55bcf37c0d4", "sighting_of_ref": "indicator--c2a09342-541b-4e37-bb87-732261017995", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f619de12-ce22-43a6-a159-15e0ceca93db", "sighting_of_ref": "indicator--bce4f091-53c3-44d9-99a8-4e411498bfe1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd7f82e3-babe-4c2f-8e54-2caf93c9ae5a", "sighting_of_ref": "indicator--ddf71db1-a279-435d-9db5-eaa1d867b0d7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71f5dbbc-cb26-4041-80bb-1161e52358ed", "sighting_of_ref": "indicator--e27e5b37-0b47-432a-825a-64583686f47e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ab2a491-950c-4783-9d60-2f13fa08beae", "sighting_of_ref": "indicator--c4012c79-6f49-4254-9467-9a2b3936ab17", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9479e681-0fc4-4818-b38d-87161bcbe1b9", "sighting_of_ref": "indicator--397b3591-d96a-4623-b5ec-f6e60943360b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--716b2a96-e445-4b10-b8d2-6a6be0f44083", "sighting_of_ref": "indicator--7aa331bf-5d6d-4de4-8a6d-a5af35120797", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b57c5c54-f90e-403f-98e8-a81c50253f4e", "sighting_of_ref": "indicator--55a4b11b-ff81-42dc-824e-774568c9a342", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34b3185f-206a-42f1-84ab-5f850d9ecd5c", "sighting_of_ref": "indicator--2debfa96-0691-4992-9d38-e75d22dc138e", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60e35f60-ff55-44dd-89b1-073a0e94c75f", "sighting_of_ref": "indicator--5a3c29da-fe8b-47bf-82c8-8be2a68e0637", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fc314ff-6900-4887-9810-6ac66349dcb6", "sighting_of_ref": "indicator--5a3c29da-fe8b-47bf-82c8-8be2a68e0637", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ade0752-4a04-41f5-abf0-2b4ddadc7f22", "sighting_of_ref": "indicator--9f75bc11-fed5-4871-a950-99240adba3a6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5d8f0b1-2385-4809-9e35-81601082cb1e", "sighting_of_ref": "indicator--081d545a-6d4d-46b6-ba66-d3c30666b7e0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05ca3785-ad39-4f76-8c31-740fd1841752", "sighting_of_ref": "indicator--d7d3c75a-1d67-458d-aacf-fd3693472029", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c058779-1ed4-4c20-8265-abc3a38e6b2c", "sighting_of_ref": "indicator--7de300e7-756b-4b88-8ec0-4aa275492f0f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e64dda3a-34c0-4af8-b4a6-3d954a907c14", "sighting_of_ref": "indicator--6d750180-88f3-40f0-999e-c7f73c9d7e08", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--372d16fc-ce90-407d-b94b-10f8e6c67669", "sighting_of_ref": "indicator--6d750180-88f3-40f0-999e-c7f73c9d7e08", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c093bbc-762d-40aa-b50e-ecbe33152d7f", "sighting_of_ref": "indicator--a2f386c8-445f-4fb2-8a72-46ca6c99f4ea", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0687f0b7-6c23-4ecc-8cda-d8716b3c3c31", "sighting_of_ref": "indicator--cce37c30-1394-49d8-a4ef-ba81514962bf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2d1623c-a477-4276-9021-d2ce0dfd4082", "sighting_of_ref": "indicator--32246fab-826a-466b-9be4-1aed511e2aec", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efb23798-5a7d-481a-aa53-7c7fd5aa47d3", "sighting_of_ref": "indicator--465f4be2-1964-49ed-9fcd-bbdaaa02b5f8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09f00370-4b2c-4faf-ad5f-fc77d08415df", "sighting_of_ref": "indicator--46f1442a-dc12-4670-aaff-927816fbd9e6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a7b4bf1-e0f5-46dc-a306-a62926cdff07", "sighting_of_ref": "indicator--4f776f47-4e06-4b50-9d02-7555cc8351c3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff754435-8af4-445c-9b22-d80238bb7c2c", "sighting_of_ref": "indicator--24877968-a15f-4c66-9837-c4ae87c4fc44", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adecd600-e3b2-4a09-a163-7081c845811b", "sighting_of_ref": "indicator--24877968-a15f-4c66-9837-c4ae87c4fc44", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8923b0a-3962-4213-9bfe-6b78e1464af9", "sighting_of_ref": "indicator--b09d55ce-3682-4dd2-b100-ce6aec72a3b6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9da0011-98f3-48bd-9c7a-360d81fe59a8", "sighting_of_ref": "indicator--1abc629b-7bea-4cfe-89df-92eee63f830f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5971eb9b-46e2-4183-a39a-0898e9c8bfff", "sighting_of_ref": "indicator--06dc2465-1427-4a04-b0d8-89df666e6732", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1494064-c644-4e07-b39f-fc34e67ea9cc", "sighting_of_ref": "indicator--06dc2465-1427-4a04-b0d8-89df666e6732", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--993b5c06-e355-47b8-9067-cba4e1842648", "sighting_of_ref": "indicator--29688534-a129-4d73-ad9b-3932badcef78", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51aa99f4-ae9c-4100-bb61-836913653ad2", "sighting_of_ref": "indicator--7f78a5b8-8f1e-496b-bab2-2a3b2c19c72b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d488467b-43e2-4a6e-aff9-09caa83b70f5", "sighting_of_ref": "indicator--b8d4acb2-eeca-4cb9-b3a8-00e03b36981b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f029421-d4f9-4293-8a18-d4e3b3677ab9", "sighting_of_ref": "indicator--b210dd9d-31ee-42e2-912a-ecd0328958e5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e6e4366-1931-4e97-b3c5-07fc6fd9be8c", "sighting_of_ref": "indicator--adc8be3f-83c7-437a-bd8e-2b1b412c4811", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38a61192-d8dd-47da-8fe5-9e9551287662", "sighting_of_ref": "indicator--adc8be3f-83c7-437a-bd8e-2b1b412c4811", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c752787-d4ca-40a6-9f97-97cb4c42113f", "sighting_of_ref": "indicator--576920c7-6252-4682-a56d-5511f501229c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b38d8727-5018-43fd-bc2b-c8c80eb0c254", "sighting_of_ref": "indicator--576920c7-6252-4682-a56d-5511f501229c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1442660d-7571-4b6a-b103-43abab22f894", "sighting_of_ref": "indicator--25de30d9-456a-4d63-8e5d-24e0fc778a1b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4968610c-092c-473a-b032-f9a2af019494", "sighting_of_ref": "indicator--25de30d9-456a-4d63-8e5d-24e0fc778a1b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85f1b8d1-23cd-4003-bcef-5bf3d9c59248", "sighting_of_ref": "indicator--a110b883-222c-4dc1-8110-d0f751a05aae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--049f2e31-e2e7-42eb-b52f-9a18a35de87c", "sighting_of_ref": "indicator--a110b883-222c-4dc1-8110-d0f751a05aae", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7787b635-ed19-4d03-ba38-2104153629ac", "sighting_of_ref": "indicator--1c2dced5-d7dd-4c83-937c-5579fea18296", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06b392e0-53ef-4aa2-9a78-51440f6080cc", "sighting_of_ref": "indicator--73d4ba46-0296-402e-b109-3db30242a2e0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0b7f0af-57aa-498a-b1dd-7557483e0448", "sighting_of_ref": "indicator--e0e29bfa-1719-4dda-88e5-823d4dc56442", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dd740d8-c026-40d0-9774-def865f9cf64", "sighting_of_ref": "indicator--e0e29bfa-1719-4dda-88e5-823d4dc56442", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d58f1376-48cc-455b-80ba-272e43b4c7f4", "sighting_of_ref": "indicator--801a10e3-903c-453c-9ac7-ce6c77382605", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5422b939-04c6-453c-9bdd-eb9caeace4a1", "sighting_of_ref": "indicator--2051537a-c294-46a4-a7c3-04f385df275e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82795fcf-5f73-40bd-9a8d-4edd62b45e02", "sighting_of_ref": "indicator--24877fd2-4a8a-46eb-b0b2-85afab06510d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8325a26-aed4-4816-a5cf-2019702410b6", "sighting_of_ref": "indicator--d2f1e272-eeb2-4bc3-8e3c-d5676e6ed731", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c6e160d-e8a5-45cb-9156-4140deb95b9c", "sighting_of_ref": "indicator--f6bac1c1-d4aa-440b-b2f1-eb7fdd88b87b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--383c2004-b891-4a88-bfac-f7f0116f13af", "sighting_of_ref": "indicator--f6bac1c1-d4aa-440b-b2f1-eb7fdd88b87b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46e95a7f-87af-4ebe-87fa-72cd98055c33", "sighting_of_ref": "indicator--7625b8d5-70ab-40fa-a3c5-a4ba6a569e51", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33337aa0-d6af-4a58-8617-ef371518f0eb", "sighting_of_ref": "indicator--704ff870-30a9-43f3-a32d-ddbe57497f83", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19694aab-bc1e-4d1e-b201-f18d8ad52cd6", "sighting_of_ref": "indicator--d82f4f50-1618-4295-8c8a-05f590732d1a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ba5a31e-3185-4464-8d0d-6764d489443d", "sighting_of_ref": "indicator--8cffadf4-6151-4d0c-8b72-49f872530c83", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76343753-b766-4974-8882-6c9e2c11ad18", "sighting_of_ref": "indicator--04128e2a-67aa-480e-8f44-f124179de3cf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eec509a-3c8a-4972-af17-b16b629c7098", "sighting_of_ref": "indicator--e645a8bc-eedb-49fc-aa10-1b4263720867", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f467a45e-688a-4441-8a5b-94f13d347b64", "sighting_of_ref": "indicator--5b1e24b4-bf1f-4592-8b18-65cc0b2ad30c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdec7b2e-b49f-4bfa-8470-50473c26eb9d", "sighting_of_ref": "indicator--dd835990-80ae-4114-b68c-a144a59517a2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5e5ffdb-282d-4364-a999-af7f6b36364b", "sighting_of_ref": "indicator--065f5a81-6e43-41ae-83b3-353291d0746f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41e85609-2490-425e-97a6-e2e260f63a6f", "sighting_of_ref": "indicator--065f5a81-6e43-41ae-83b3-353291d0746f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21e66145-c568-4e5f-8a2a-9c9a2d5fb949", "sighting_of_ref": "indicator--fe01266f-5495-485b-abaa-634a558dd4e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9de9b9c-4dc9-497a-ad9d-b94c57696ad6", "sighting_of_ref": "indicator--b126b9c6-1682-4e08-9837-04f555cdda24", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3683d7c-4f51-4236-8332-0f3465a01fc9", "sighting_of_ref": "indicator--c847cbc5-815c-40bc-8088-9a7ca09fe06c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2161a00-43d6-4891-8206-40fab2689547", "sighting_of_ref": "indicator--ffcaf8c8-2546-46e3-a0d4-bb0c911ed3e5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94d98fcd-c361-4906-9b66-19bbbc4bd8ad", "sighting_of_ref": "indicator--4d20830b-45b5-4f7b-8e7c-609c25ee6da1", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1959dcb-24c4-46ab-8b02-bb10fb6af89a", "sighting_of_ref": "indicator--9fb53265-7104-411b-a8c7-4d18870cd358", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75ea1ffa-27e6-4d9e-939f-ddcbc57a47cd", "sighting_of_ref": "indicator--8c4a01fb-6756-4e86-8f77-5d2b54f66113", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee46af88-c475-4a0f-9ae2-a1df7c288c8f", "sighting_of_ref": "indicator--1b25275a-a6d9-4f54-8efa-b97e8bd19629", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d26af80-b30e-4f42-b8e3-4b1d5765efec", "sighting_of_ref": "indicator--89d1bcc8-e61c-41d1-af4a-ec3c68f13b85", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--655588e5-023e-489a-a7ba-ec4d2872b777", "sighting_of_ref": "indicator--5c50ea45-5e80-492f-b927-d8600f2a98a4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2c97847-6546-40bf-aeb7-d74bfd14cfc7", "sighting_of_ref": "indicator--3c5ddfbd-584b-4c55-b92f-23ea00f43f0d", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52dc8e1d-2a67-4aab-ae2e-8703d6e1ad4c", "sighting_of_ref": "indicator--f2575432-d01e-4aee-a3c9-13de02271800", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f36a395-5b05-415c-9ca7-9d2a1662bfc1", "sighting_of_ref": "indicator--486960c9-774a-459d-9e28-7dbc5a867bc9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--110cdec6-36d5-4f3e-9a27-b904b4333d85", "sighting_of_ref": "indicator--e74694cc-bb63-42b5-94bb-6d604e7e13ea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a540bd2-8cba-4159-bd62-54c911eac5e4", "sighting_of_ref": "indicator--bfaf0710-11ba-4a84-968c-19989d2648f9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8779a7b3-a61e-4b47-9858-45cdbadf0c22", "sighting_of_ref": "indicator--76b97f9f-191d-43cd-a454-94e310e2f49b", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70920510-fca9-4654-8fd6-faeecef4253f", "sighting_of_ref": "indicator--96b2334a-16fb-4153-a523-f1760e366a6b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--551b1ee4-ed81-4c74-9b07-945c95db0576", "sighting_of_ref": "indicator--a763104f-57c0-4982-97f5-e1e4924513d0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a1c5c4c-ca9a-45e8-bf31-e54580370aaf", "sighting_of_ref": "indicator--000e5e00-e7ea-4b87-a598-48c564b7b1fe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06a3e180-ab4e-4314-b9b0-6db5aabe1634", "sighting_of_ref": "indicator--74730d7f-7922-405a-bb3a-e7fce2cfbed1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13f861da-0111-4c1f-8f96-04aebdd41ce8", "sighting_of_ref": "indicator--255025d2-a832-45bc-86a3-d3bd7ab8c520", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a30d5265-7e1c-46ce-a2de-232c7b7efe2c", "sighting_of_ref": "indicator--22f0ff29-ac59-4ca1-b7cb-a623383e7952", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa907717-bcf7-46e3-9db9-68bcd9cf9fd3", "sighting_of_ref": "indicator--22f0ff29-ac59-4ca1-b7cb-a623383e7952", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dea097b3-c6c1-4f47-9f00-fe9df788493a", "sighting_of_ref": "indicator--a6b3aa38-9d7d-4b0d-bfb8-2d23e173abbf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a367e34e-b53f-4283-a679-d21988d74995", "sighting_of_ref": "indicator--e1b714e8-63c5-4d6f-960a-06e435866a26", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--facaeaa2-6049-4477-bed3-ce3ca169f498", "sighting_of_ref": "indicator--8796ecfa-7f58-4ead-96fc-3e6f749685d3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--650ce058-12ff-47e0-a5f8-ec34e6b92b9b", "sighting_of_ref": "indicator--af552da3-e61a-42b1-a9f7-d20febc93664", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c84f88cc-91fd-4118-b2aa-ace977413404", "sighting_of_ref": "indicator--3e6b2b5b-11b6-4225-ad85-d0e0376b4f41", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f482c068-ccec-4432-85b3-2fdeea753916", "sighting_of_ref": "indicator--6458ac20-5f2b-4d94-b6c7-e6286bf36f21", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3ddab4f-3da0-43c4-9652-1cb5f1c679ce", "sighting_of_ref": "indicator--6458ac20-5f2b-4d94-b6c7-e6286bf36f21", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d13a09b3-6cd2-4cca-849c-b082c785bae0", "sighting_of_ref": "indicator--51017cb6-e53a-4364-aa29-e97528b7ac80", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2605244-afc2-4932-9bfb-9ca51493f6a8", "sighting_of_ref": "indicator--ed083369-17d3-48d5-aa46-635ee12f0739", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9935a8f0-7b35-4631-ba60-5498d4471259", "sighting_of_ref": "indicator--1c9f1881-86ef-4563-9276-877717d63d12", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c59e24ec-2eda-4ed6-a564-6f1fa5b82d0c", "sighting_of_ref": "indicator--45f24956-7b73-4e5b-be4a-6920bb1b595c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f112a2b-641b-4727-ad0f-69f0206f2a3d", "sighting_of_ref": "indicator--ad8fdc02-8b7b-4e67-b8ef-0c0e8240c489", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f93de79-b097-47f3-b36a-727371a98fdb", "sighting_of_ref": "indicator--16ac1ea5-47e9-44d1-9c1f-db441480cfae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--315ec4e6-c20c-4772-b6db-509fef60d852", "sighting_of_ref": "indicator--16ac1ea5-47e9-44d1-9c1f-db441480cfae", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9a11f7c-f2b4-4d94-9065-00bbf7704c8d", "sighting_of_ref": "indicator--cfd50163-5c5b-4078-83a7-b90b10d90894", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1aedeaf-ef02-495c-8b62-4577b219b3ad", "sighting_of_ref": "indicator--cfd50163-5c5b-4078-83a7-b90b10d90894", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd47254d-1f83-46f7-b21a-29c055f71a63", "sighting_of_ref": "indicator--a0b04255-aab4-4925-9480-8744356faec5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac1652a6-f229-4739-8470-59b22a38fc66", "sighting_of_ref": "indicator--664cf8da-05d8-42ea-8011-e9f90d0c01c5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e85670b-44c5-4e56-b655-7920b0919597", "sighting_of_ref": "indicator--aecc41f2-3a34-4d3e-ab1a-123ec4ec7b59", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a86bb58f-981e-42bf-b465-5de364bb922b", "sighting_of_ref": "indicator--cfdd9d80-f801-4c66-9c6e-2e9c1c0e0a90", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e92442b9-9385-4793-b164-7185e5670077", "sighting_of_ref": "indicator--cd1b3e49-9368-4975-98da-a4ad87b4ff8b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a5fd7a5-4266-43a4-99a8-6910ec17e2e7", "sighting_of_ref": "indicator--b7b05610-121d-4b38-b3ce-09cc89d2accd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--facf81e8-019b-4e5d-938c-436023c97f2e", "sighting_of_ref": "indicator--36f810f1-c82e-4f10-b6ca-cbc846c2460d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93e325e2-10b0-4b5b-81bd-64eecbd099e0", "sighting_of_ref": "indicator--2972cdd1-93c4-435e-8aa9-79e8bfaf55f4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--997979b2-4dd7-4608-bb0c-6cfa9de532ab", "sighting_of_ref": "indicator--07f6d7d1-98ce-475a-ae32-e811062c8748", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcdd7c68-7f83-49b4-ac6e-fdd9714570a2", "sighting_of_ref": "indicator--21982545-0d51-429e-8298-9188be14dca7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6bc4e97-2f93-4aee-8fe0-76c0019049d1", "sighting_of_ref": "indicator--3369f05d-b5de-4062-a4b3-e95ae3928d72", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c4320af-e94d-4555-b742-5d5cd78d8e5b", "sighting_of_ref": "indicator--3369f05d-b5de-4062-a4b3-e95ae3928d72", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f54cb3f-b50a-4898-8fcc-b3b882583870", "sighting_of_ref": "indicator--092c52aa-4879-4cf3-bb63-085394b28bd8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5c847a9-2dcc-4bcd-aba4-26173133f2da", "sighting_of_ref": "indicator--8dcd2198-c888-43ea-98df-0aed5a53a052", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c6a6621-acd3-4d2b-a1e5-1d80d5979619", "sighting_of_ref": "indicator--e2036cb3-be4f-469b-9c09-b84f6e130bb4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81baec05-a957-4a2c-ab7d-0736b2539094", "sighting_of_ref": "indicator--8cc03870-4db3-46d3-b18c-f310b2fa3e94", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d494f9d-04eb-4aac-8c1f-7cf7b66b8c89", "sighting_of_ref": "indicator--9db38292-1233-4fca-849d-c67986c1da5a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ced2474c-e338-4cec-b45d-acb6f6924c6b", "sighting_of_ref": "indicator--29f6d891-c036-4fe3-94b8-f07b033191cd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85587755-0be3-492d-8dde-9f3548c16a2d", "sighting_of_ref": "indicator--29f6d891-c036-4fe3-94b8-f07b033191cd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87f40b8f-0dab-4d84-b431-01a960f40d09", "sighting_of_ref": "indicator--114f813c-39f5-4c1c-990a-b19d52fa09d8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09d1d55b-050a-4bf8-b302-c1d797f7b66d", "sighting_of_ref": "indicator--2e32f67a-28d8-45b2-8fa1-f80775584ed7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c56a2022-580b-47ff-8239-664b853b5114", "sighting_of_ref": "indicator--9367407e-8bd0-4ee2-a228-bf9690a0d25e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ddba798-8a7d-426b-b49c-2b6b1d9d20e7", "sighting_of_ref": "indicator--f0e5b916-d260-4bb9-bfff-5c6a32e75562", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efcd7a6f-a9f4-4c75-bf09-ea50d71e4cd3", "sighting_of_ref": "indicator--747472d8-d6aa-4193-b8c2-a6254619bf51", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--325cb74c-22b2-4062-a7b4-b6c48ba3f60f", "sighting_of_ref": "indicator--ab219960-50ec-4d11-b597-775e2db06361", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ff0e950-7f84-4ef9-b62b-ed040e79ac5a", "sighting_of_ref": "indicator--baf43600-cb0c-43a0-ab5f-c8681eb9e326", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9922a48-3c1f-4617-8bfc-742d36e553b2", "sighting_of_ref": "indicator--c192a15c-1f2f-41d7-a37b-ab4647a87050", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9856dc3a-cf88-4971-ab56-c856ca8be77c", "sighting_of_ref": "indicator--a5dd6c1c-7be4-4d97-87c5-d2af11e34116", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45413a59-be33-486d-b7af-0988ffd4786a", "sighting_of_ref": "indicator--18107071-72df-47d8-a032-d7c13eb55468", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9bcbcdf-5518-49a0-a684-33da5c299749", "sighting_of_ref": "indicator--18107071-72df-47d8-a032-d7c13eb55468", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c581d6c-55a4-4b07-bbfb-f95aa305735c", "sighting_of_ref": "indicator--141b17e3-de91-46c8-8743-3f2a5b53fb87", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82fd8fb3-ed3f-48da-9f13-e35b9cbf246e", "sighting_of_ref": "indicator--141b17e3-de91-46c8-8743-3f2a5b53fb87", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da53ef0f-2e7f-4da3-a1df-5bbf8db6d0dd", "sighting_of_ref": "indicator--929e274f-663f-4dca-bac3-8313f0a0bc3d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c918e603-af95-4d4d-9b79-4b07f0de551c", "sighting_of_ref": "indicator--929e274f-663f-4dca-bac3-8313f0a0bc3d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a77b922-635f-4399-b752-6acee598d875", "sighting_of_ref": "indicator--931cbc84-22ff-4744-926f-90cf2a53da3a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cf6a91a-7138-4161-9e2a-562e1ff9d344", "sighting_of_ref": "indicator--931cbc84-22ff-4744-926f-90cf2a53da3a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04005d9e-02cf-4d81-a2ab-9b787461b19d", "sighting_of_ref": "indicator--0cc832bb-9573-4c6e-b7a0-a4dec111a40d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c688d941-fe59-4b14-bb6c-b615aeddd312", "sighting_of_ref": "indicator--0cc832bb-9573-4c6e-b7a0-a4dec111a40d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac39900c-c7c3-4d78-b87d-0babae804212", "sighting_of_ref": "indicator--a943c5ba-afe4-4f32-a2af-0cbbdf0cd10b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dca6f2c-5081-461c-9f77-006fcc3286e9", "sighting_of_ref": "indicator--a943c5ba-afe4-4f32-a2af-0cbbdf0cd10b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64364f15-f67e-4e06-b650-f154fc0d4dd2", "sighting_of_ref": "indicator--643b8240-7a9a-47c9-9633-71de59d8da51", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8414a6d4-7fef-4aee-992e-41640ff17f82", "sighting_of_ref": "indicator--643b8240-7a9a-47c9-9633-71de59d8da51", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--099761b4-7cef-447c-a7e5-e3bf49fa0300", "sighting_of_ref": "indicator--5f9d3587-519b-4129-8155-bf5ecea6cb60", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--966412d1-d846-439e-9ffa-c30e71461528", "sighting_of_ref": "indicator--5f9d3587-519b-4129-8155-bf5ecea6cb60", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28058935-3d0a-4035-85fa-99f9ae0127fe", "sighting_of_ref": "indicator--5fc87ab8-bd37-4f8f-a7aa-bf54253387a9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5b3e71c-80d8-47e0-a24d-61e9c608ccd6", "sighting_of_ref": "indicator--5fc87ab8-bd37-4f8f-a7aa-bf54253387a9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fbed1d1-1be9-4f4c-9fa7-be00d88e60f1", "sighting_of_ref": "indicator--eb033c1d-ff51-4ae3-9d1f-c7584af1b786", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75d27896-8beb-43af-982c-c2d89694c2c3", "sighting_of_ref": "indicator--eb033c1d-ff51-4ae3-9d1f-c7584af1b786", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--309a2698-a9fd-476a-8209-c880623c0112", "sighting_of_ref": "indicator--41abf338-c41b-4f4a-8b76-9e7163659007", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8cb07f6-99e2-48af-ae96-3d5580e63e06", "sighting_of_ref": "indicator--41abf338-c41b-4f4a-8b76-9e7163659007", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b10df068-0a70-4427-92ee-116562e03d63", "sighting_of_ref": "indicator--b69c84cd-caaa-4a12-8518-c86b4692dba8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93b88136-6490-4402-b1c9-dc2beef093a5", "sighting_of_ref": "indicator--b69c84cd-caaa-4a12-8518-c86b4692dba8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66715949-48af-49ab-84e6-210e701126e0", "sighting_of_ref": "indicator--1103c2bf-9a56-42c9-801e-fd77b29bd57d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08a1113c-9b78-490b-9e60-721106bec104", "sighting_of_ref": "indicator--1103c2bf-9a56-42c9-801e-fd77b29bd57d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c188bc1f-26df-416f-a62e-f653832533f0", "sighting_of_ref": "indicator--810b12f1-113f-493f-a11e-a40dec63d5d0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2ec1024-78d9-49f1-ad0d-fd5130ce8f43", "sighting_of_ref": "indicator--810b12f1-113f-493f-a11e-a40dec63d5d0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5051a199-b302-41ab-858f-262bdc10998a", "sighting_of_ref": "indicator--ebacafee-1c8d-45d2-accb-6516b325314e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7f4fac7-c35e-4c39-9e8e-d18608c4a008", "sighting_of_ref": "indicator--ebacafee-1c8d-45d2-accb-6516b325314e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--464b3d21-46e5-4b3d-a7f0-dc2e590950c6", "sighting_of_ref": "indicator--60363bd5-591f-4b82-b6a3-bc0fcb9014f3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--659e2f0b-c9bb-4cb5-b956-c47944c92c99", "sighting_of_ref": "indicator--60363bd5-591f-4b82-b6a3-bc0fcb9014f3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d2135c8-81e7-4be4-bcd3-4335390768f6", "sighting_of_ref": "indicator--4061d15d-191a-4c1b-929a-1cfc16b2e43a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--740f004e-89c3-49b3-afd6-faa2f5ccec77", "sighting_of_ref": "indicator--4061d15d-191a-4c1b-929a-1cfc16b2e43a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44373c00-0d6d-47df-9d5b-961bf63ffff9", "sighting_of_ref": "indicator--9d6c79a1-f9b8-4cab-8803-a6ac2537d578", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1741268f-4bdb-4fb6-8809-d819ea6a6d4c", "sighting_of_ref": "indicator--9d6c79a1-f9b8-4cab-8803-a6ac2537d578", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3e6d412-7670-4b87-875c-bd3e540d3eeb", "sighting_of_ref": "indicator--3fd54603-ad10-44c5-afdb-2c23ecae4e06", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c6aec40-e637-42bb-ba67-7ac6822f8e87", "sighting_of_ref": "indicator--3fd54603-ad10-44c5-afdb-2c23ecae4e06", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b4dd805-316b-4530-bc98-a32980d8d7d7", "sighting_of_ref": "indicator--06638dae-c62f-4d6c-ba5f-26c23175921d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2a41f8f-9b7b-426c-8773-6198a6cf0d16", "sighting_of_ref": "indicator--06638dae-c62f-4d6c-ba5f-26c23175921d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dec9dad-c6f8-44d0-9957-a8300075e081", "sighting_of_ref": "indicator--6683218e-55da-4a9b-b369-43936f14f4e3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0e4bd62-d6e5-4d3b-b262-39e40f2dad09", "sighting_of_ref": "indicator--6683218e-55da-4a9b-b369-43936f14f4e3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--364ca22e-ecef-4607-b1c5-c72d4e333f7f", "sighting_of_ref": "indicator--c806a036-c0e4-4dd4-a12e-813116b5cfac", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96124e15-4227-43dc-a240-46f560e45c36", "sighting_of_ref": "indicator--7f7f9bf9-dca2-4dd7-a063-87e4915f672d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--063e5d20-9e1d-4ad8-9c2c-5042eccc8246", "sighting_of_ref": "indicator--6956b073-71d9-436d-9cb3-ca90fa74493a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02824954-5072-4caf-9872-8da6f55f6f94", "sighting_of_ref": "indicator--49c53f1f-6979-4277-9c2a-62aa61a5451f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99e6fd5b-1ad3-496c-8ede-32a38a20dc47", "sighting_of_ref": "indicator--46f76ca9-37bb-434f-900f-487efb574a21", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9370a6b9-ca9b-45a1-b975-8cb6d0cf29a3", "sighting_of_ref": "indicator--b7c69008-9ff1-4931-b9df-4ee28eb16535", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61b7a5dd-5914-4797-8c69-843023a7e7a3", "sighting_of_ref": "indicator--b7c69008-9ff1-4931-b9df-4ee28eb16535", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16b9880c-bd3e-48e7-bfa9-097d4ccc17a5", "sighting_of_ref": "indicator--453e794d-7f36-4f27-89f3-af9dbbf0e388", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa34da13-66a4-4fb1-b221-f39702927366", "sighting_of_ref": "indicator--7f3a8a87-1a40-42cc-9576-d5fca263e709", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--311a2cfd-65bf-4819-a3ee-15dd56154464", "sighting_of_ref": "indicator--7597ffe2-71b8-4a4f-b4f7-e2584c44bac9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95632ee3-c3f6-440e-8a68-043ce7e4c8db", "sighting_of_ref": "indicator--7597ffe2-71b8-4a4f-b4f7-e2584c44bac9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50058a53-4a63-48fe-878e-3f217aff9817", "sighting_of_ref": "indicator--af929497-2fe8-41ab-9eeb-5e6f3f38a95b", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b277328e-e4f4-4cb9-80db-0b66a1e37b42", "sighting_of_ref": "indicator--48f4b35a-d0b5-4d46-944b-15200a943270", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bf44f2b-6611-40bc-9e4e-7f2b762b353d", "sighting_of_ref": "indicator--3156d35b-2ff2-48a8-9573-f92856e21d6b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59dd1c56-2782-4e79-8843-dc9ed78f93df", "sighting_of_ref": "indicator--dc036559-da3d-4ed3-acda-efb41e54ee7f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30951bc7-eff2-40e5-b4a1-8aa3a656ad68", "sighting_of_ref": "indicator--69957276-ecc2-405e-9a02-c775b7f203eb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7aaadd92-3538-4b80-8eb7-afe58e261ebc", "sighting_of_ref": "indicator--4cbcd018-50ae-4aba-abd9-e62c043d917c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b9396bd-f0d2-46b2-a1b3-587936662450", "sighting_of_ref": "indicator--80168ede-bdb9-4805-8915-587de8f07813", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62f68292-3b04-4545-a64d-c2fe055d8cf3", "sighting_of_ref": "indicator--5212c564-ed02-47c2-ad1c-6baf65ab4173", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--963517e9-d450-4b23-9778-c4664af3fc33", "sighting_of_ref": "indicator--ee1b372e-e4d1-484b-8286-b6d81fcc8d36", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ff99296-35a9-4f0a-8d19-91a5874bab43", "sighting_of_ref": "indicator--6484ed0a-31cc-4cfc-b562-1bc326ec0f2a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64bf339b-ffa4-4658-9aab-165631d7eeaa", "sighting_of_ref": "indicator--fb320818-8260-4df7-85b5-970be3185976", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cb87279-48c8-45ac-af27-3432a4cb4485", "sighting_of_ref": "indicator--7f7e2e27-f008-4297-b3b2-acac94072cd4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1344ceb-52bf-41fe-835b-e09e8eb30142", "sighting_of_ref": "indicator--25db8d84-4966-4838-ae6d-a8c2183a1be3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f07e4a6-4410-4977-9334-1a88bedb43d2", "sighting_of_ref": "indicator--65a806cc-0333-48c4-9692-9719b12df9ba", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33a726b2-3f14-4942-b70a-a219dc32bf0c", "sighting_of_ref": "indicator--3ddac408-4c3d-46db-a70c-3794a6bc5245", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46d760f9-dc4b-42a5-9264-a2515e1e522c", "sighting_of_ref": "indicator--51a165aa-da87-4d96-b6f7-fe1abebf2901", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b661758-1d94-4551-b553-996ed8e7cbd1", "sighting_of_ref": "indicator--be96b11a-3213-4a56-8094-0a120ade4e7b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42f1b37a-43bb-4b75-a832-7bfeaeafada8", "sighting_of_ref": "indicator--0383e71b-242f-4867-8b88-eeefd9e4722c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c42cc3d4-bee5-403e-9f60-007fd45a6f2f", "sighting_of_ref": "indicator--a55fcf96-b1bb-45ee-8289-b168906b62ae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--399651a8-ed6a-477a-aeb4-20840bbc200d", "sighting_of_ref": "indicator--25cc954a-7e94-416d-9c93-6157990a57d3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf4f62a6-e8e7-40ec-9c95-fa7734a01eab", "sighting_of_ref": "indicator--469727d9-5dd1-4d04-9769-007d9873f597", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05004d14-c47d-4cfe-91bd-498584940d78", "sighting_of_ref": "indicator--469727d9-5dd1-4d04-9769-007d9873f597", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a742d8e0-ecde-40b2-be26-cf2eee9543a7", "sighting_of_ref": "indicator--d89d5417-e26f-4c47-942e-57cd63c9dfa7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23c39578-ee01-46f2-bf37-f9c091b77725", "sighting_of_ref": "indicator--03a50ba9-f34c-4847-a0d8-311043faa97b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5446c6d-1511-4f44-bd28-2db3ea5b0cea", "sighting_of_ref": "indicator--eaa20d5e-36d0-4616-bd00-efd450f3ed0b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a75929d-f471-4a96-bdbb-f44060cca583", "sighting_of_ref": "indicator--47489e93-70d3-4ea7-8c77-bfeec8bd8612", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a100ec5b-2855-484d-a723-ac2824216811", "sighting_of_ref": "indicator--002bd7ad-12d1-4995-b81f-50334c8bc58e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b51237f4-be2e-45d6-8713-87308eb3789f", "sighting_of_ref": "indicator--3cac9dd6-8720-420e-966a-88e6bea7bba6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--719ceeb0-8d40-4443-bf99-c7bdff9343fc", "sighting_of_ref": "indicator--3cac9dd6-8720-420e-966a-88e6bea7bba6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4facb733-ca6a-4b52-9fe7-4cf6929b6ad7", "sighting_of_ref": "indicator--4250ee7a-4747-45cb-a441-21fad5db24aa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb54da31-e383-4294-9bcb-a5946e15f854", "sighting_of_ref": "indicator--4250ee7a-4747-45cb-a441-21fad5db24aa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dde4aec7-5e17-4dd2-a604-91e90a58362a", "sighting_of_ref": "indicator--cb608e24-880e-4e59-87ed-e0321e995a38", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cce8ba7a-086a-444f-aa67-618556fc8476", "sighting_of_ref": "indicator--cb608e24-880e-4e59-87ed-e0321e995a38", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad7a7825-509d-402e-8d36-2f792c420dc5", "sighting_of_ref": "indicator--88026522-bef7-4533-8841-d04cd7ce163c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45808de7-edfc-4ccd-b2f9-0909ba0c409b", "sighting_of_ref": "indicator--f35a4e79-dab3-4c53-a99f-05dce4c6f1fc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dc5fe51-df08-4609-9cef-efa451ac9fdd", "sighting_of_ref": "indicator--8884f251-91bb-4cef-a559-1e7f525c36ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52b5681e-0130-48a3-aa70-6adaca76e714", "sighting_of_ref": "indicator--74ab56bb-b0e6-4907-b2ee-a6217a954a49", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaa22995-c411-4a5f-ab2c-c0843304416e", "sighting_of_ref": "indicator--873f9906-78a9-492b-a6be-fd43a56f6a89", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb55aa89-c40b-4150-9289-19233c3f702d", "sighting_of_ref": "indicator--4daa60d7-f479-4fb2-b965-42aa64519ba1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8daf520-19e2-43b6-89e7-5cb6899ceab1", "sighting_of_ref": "indicator--487a52b7-8d57-4f82-973b-2d5ff7e5b0ef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5fef830-5d63-41bd-a6a1-df44683d5f14", "sighting_of_ref": "indicator--1616da10-fba7-4c8e-ad9c-1f5a7712d91b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30639def-d78a-416c-92d5-127ad047fe02", "sighting_of_ref": "indicator--1616da10-fba7-4c8e-ad9c-1f5a7712d91b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd46fd8a-a2d1-4533-8662-522d41ec2455", "sighting_of_ref": "indicator--9c897aab-2ecc-4b64-8266-4aa100048ecf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14a1cdb1-105a-41f8-b704-ccbfb33924dc", "sighting_of_ref": "indicator--2980235a-3eeb-42c2-bc50-849e4db99fa3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ccabfee-d93e-49f0-bbb2-fe667282a235", "sighting_of_ref": "indicator--8b8e501e-bfbf-4e6f-9dd6-b8abd071f17f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--babeaf4c-4f31-437e-93b6-b2ab9601647c", "sighting_of_ref": "indicator--f1abad45-6109-4717-90f2-266d2e568493", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e53ec9a1-c140-4a50-9182-02132d0b8c05", "sighting_of_ref": "indicator--960fff3c-e4e8-4a8c-988b-b348bdbb34a6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bec13a2e-b492-4571-a182-5b72cc83a5db", "sighting_of_ref": "indicator--960fff3c-e4e8-4a8c-988b-b348bdbb34a6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e9b085c-0a0c-42c7-b1a3-0651c4d3ad3d", "sighting_of_ref": "indicator--97a182c4-5ede-49aa-a512-0f6096885be1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fce9e07-13d5-4aeb-9956-8f364efd99ed", "sighting_of_ref": "indicator--97a182c4-5ede-49aa-a512-0f6096885be1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62db856d-0fc8-4823-ae07-2dfae4ef6215", "sighting_of_ref": "indicator--1f0b921f-01a0-47c3-8d3b-a2b3b5142f46", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b39341da-caa6-47d8-b06f-7c9327e4ca7e", "sighting_of_ref": "indicator--368c4428-d0f5-411d-b45c-d30d3058723e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7606ded-dc61-41de-b1d2-1ac616b326a8", "sighting_of_ref": "indicator--0fc6e2bf-8ebe-4341-a8d0-8f46ff03c4ff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--942b7b72-438e-4446-b4b2-04f1d827fdf3", "sighting_of_ref": "indicator--1316a4ce-022c-479c-bec6-cb16b9e90838", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbf6227f-9f29-4574-93bf-46b4bdfe0def", "sighting_of_ref": "indicator--1316a4ce-022c-479c-bec6-cb16b9e90838", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b53dba8-d9ac-4399-a563-cd95c625c02f", "sighting_of_ref": "indicator--d7c820de-5ba3-43e3-90fb-a5c5cc55fb74", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad84583e-1919-4357-97fd-98e6cddca883", "sighting_of_ref": "indicator--d7c820de-5ba3-43e3-90fb-a5c5cc55fb74", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fcba577-0900-4d4e-b117-79a1a5131d66", "sighting_of_ref": "indicator--a360f1aa-5915-40dd-ad77-9d147e46f923", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--756f931e-67da-409a-a987-2d302f6f2046", "sighting_of_ref": "indicator--239536fa-b631-4c87-8f46-bbec9e7b9d57", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92ceeaef-2d35-4222-bc98-d2e08c9a7bda", "sighting_of_ref": "indicator--5bba545a-d960-4df7-9460-822625d101a2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fa8772c-2d85-4081-96f3-eac524e616e9", "sighting_of_ref": "indicator--31ed67fe-e19f-4b7b-b842-afca5492d4b6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c0d7291-ff7b-462f-bbfc-a1ce5e8bfe79", "sighting_of_ref": "indicator--3459f2aa-97ca-4843-a40f-f258dbc87c81", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e3b01c7-058b-41b6-99d2-e97fd4d34320", "sighting_of_ref": "indicator--3459f2aa-97ca-4843-a40f-f258dbc87c81", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc396fdf-b9c2-4ac1-af59-3e9fb4e1b3a1", "sighting_of_ref": "indicator--79bdd1c5-941d-49cf-a970-216ddb375d79", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--081df37d-e7a3-4085-8938-108d16a1613c", "sighting_of_ref": "indicator--794f6836-20f3-4db6-9089-f1c0b2b343db", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afe2f381-56c4-4a61-921a-919f655a3c3a", "sighting_of_ref": "indicator--bbd34f49-ab60-425c-8064-0b5562b19ace", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--421102a2-67c3-45e8-8ee7-718d0b9f7f09", "sighting_of_ref": "indicator--01b9eb06-0330-41cb-a08b-58199a7541e7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fcf748a-a200-4339-a023-a8c70d3bf0fa", "sighting_of_ref": "indicator--01b9eb06-0330-41cb-a08b-58199a7541e7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24f1406f-055e-492d-b605-92190f2cc4c3", "sighting_of_ref": "indicator--d50e710d-2739-4d9f-a5b8-da78ee7e75f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4d60a9a-c92c-46bf-8b51-e91dada84209", "sighting_of_ref": "indicator--d50e710d-2739-4d9f-a5b8-da78ee7e75f0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--419c59ee-e6b0-4711-911e-ead933fceaae", "sighting_of_ref": "indicator--c47f8f46-f3cd-469b-92c0-201609748512", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f89695b0-9ef6-4d0d-842e-04077b04031e", "sighting_of_ref": "indicator--85ae1752-4ad1-41d5-a952-0712812a18da", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7167ff9d-0c67-43d2-94c9-224e745fa492", "sighting_of_ref": "indicator--a33bc4b7-c2a4-48a3-9afc-c8f3a4a23147", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70198952-d94f-4605-ad69-a54abe37d1c0", "sighting_of_ref": "indicator--ec2e2f15-e78f-4f06-b70e-1da273c2d03e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fec4d1b-9bd0-4b28-9aaf-7fd5fae0e5e0", "sighting_of_ref": "indicator--ec2e2f15-e78f-4f06-b70e-1da273c2d03e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--501de000-c1d5-4f21-b674-8c8ea306df8a", "sighting_of_ref": "indicator--04f1ac33-b193-41fc-98ea-3000a1efbf78", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b305c9ad-887f-4315-9a75-ece6e8179958", "sighting_of_ref": "indicator--ef902117-3014-4594-adc7-8ef53530ca69", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fad877a6-5365-49e4-8f9b-ed9c120c8234", "sighting_of_ref": "indicator--abdee47e-127b-4cc7-b7ad-f23153ceacd7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0173adc3-d48c-45fa-8a57-7f8bddc1de97", "sighting_of_ref": "indicator--1d231917-207e-4736-b15a-0868db313bab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2360a661-bf4c-4dd1-9470-564b5442bb09", "sighting_of_ref": "indicator--137fcd2e-ac13-4cdd-9422-460484749903", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b90b4d7-7e78-4bd8-ba28-06a28dd50afd", "sighting_of_ref": "indicator--603acf9e-2e73-4f70-9936-42badb857cd2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd222ebd-b9a8-4f93-b784-5b91eba762c3", "sighting_of_ref": "indicator--82932d85-572b-4b4a-9ffc-bf43f621a646", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ac08cce-7060-4701-b3ab-1b69e011e9be", "sighting_of_ref": "indicator--82932d85-572b-4b4a-9ffc-bf43f621a646", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e1dad5c-4d35-441b-bf5a-67c0c77f4573", "sighting_of_ref": "indicator--084ab3cf-1707-42df-a2b2-7d8a01c732db", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41e7c8d6-110c-447a-8059-7446878e332d", "sighting_of_ref": "indicator--084ab3cf-1707-42df-a2b2-7d8a01c732db", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d3afddd-aed8-4099-b557-bb2d1c70bda2", "sighting_of_ref": "indicator--c14aeca3-01ee-4a32-96e8-17701129f910", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d91ec4e-801e-433f-9250-4708b4707d61", "sighting_of_ref": "indicator--9759b2e5-70b2-420c-88c5-a4c37de1d002", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91a78ccf-d630-4fac-ac97-b8f2fab0586f", "sighting_of_ref": "indicator--9759b2e5-70b2-420c-88c5-a4c37de1d002", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fc9e2d4-00c6-47af-82bc-4f6e94d9ad13", "sighting_of_ref": "indicator--bdcb8ca0-68ea-47a4-906b-b916308e2e95", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--666875d5-bca4-4495-ba54-8c01a0d1f0ca", "sighting_of_ref": "indicator--d4efe8fb-816b-4383-be73-924384a6087d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40d0bd2a-e6f3-4ba3-8537-5f31212bdcf9", "sighting_of_ref": "indicator--e04bf209-27aa-4571-8c55-cbef0af759ba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76f47d58-1c8c-4487-bb91-d2933f9685a1", "sighting_of_ref": "indicator--af4c4eed-90db-42cc-a204-a488d710367d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0d095fb-f518-485c-aec0-0640b00bcd5b", "sighting_of_ref": "indicator--a850b1df-ffe0-4241-b484-3e59004612af", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6df1b90d-0214-4bd1-8bb0-55ed06150cd7", "sighting_of_ref": "indicator--a850b1df-ffe0-4241-b484-3e59004612af", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c71ac4b3-6b28-4810-89d3-62d328b16ec0", "sighting_of_ref": "indicator--e4497b02-41d7-44ef-bfdf-aca184e032bf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2053d258-942f-4478-afaf-f8d5d970e722", "sighting_of_ref": "indicator--e4497b02-41d7-44ef-bfdf-aca184e032bf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af6fae14-60aa-489b-a9ba-cb80d180386b", "sighting_of_ref": "indicator--79d9efcf-0345-4209-857d-d2ac97171f9c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--786be24d-4739-41f1-8831-ca92f22ac61c", "sighting_of_ref": "indicator--200103b1-4440-4251-a432-09c990f51ad9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48e6bf99-4630-4ad6-92c4-6ef0e91e1275", "sighting_of_ref": "indicator--a09b9e48-262e-47e9-96bb-eef27a874ffc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f8c4f2e-0fe3-4d7f-aa6f-0452f3f17773", "sighting_of_ref": "indicator--6ba2d673-abde-45de-9ff5-a407e4fc2ca1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40e99c8e-932d-434b-b1a5-f50576aba7c9", "sighting_of_ref": "indicator--d88166ea-9671-4903-a79b-d6a850fd9072", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a9d278a-aafa-45a3-8bad-daf7fca0f3b5", "sighting_of_ref": "indicator--d88166ea-9671-4903-a79b-d6a850fd9072", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf64696b-c635-4a7d-9e3b-9c8bf6715327", "sighting_of_ref": "indicator--801f1111-0f78-499b-bca9-d223f36d5dd5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4826a4d-40c4-4688-a353-b9ee5c87821e", "sighting_of_ref": "indicator--5dd3dd55-9afc-43bd-a733-cfa8efeef569", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46a252fd-c43d-47dc-90d0-583fc26990c3", "sighting_of_ref": "indicator--5854c7e6-2e9f-4a49-a3b9-3b2207ac2408", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3deb424a-57d9-4317-8e7b-d7fbf712d5d5", "sighting_of_ref": "indicator--5854c7e6-2e9f-4a49-a3b9-3b2207ac2408", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87d21bd7-de89-4e1a-ac31-ef7a84102188", "sighting_of_ref": "indicator--83706095-bdb5-433c-a976-ce39d4b14cdb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50b4725a-5175-43a2-a60f-1e299364eaa9", "sighting_of_ref": "indicator--0199a7bd-e483-4f1c-a308-881bc73a7761", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d471d664-62b8-494d-b3a1-61877c7e63fa", "sighting_of_ref": "indicator--6617cd42-57a2-4424-8ddc-7a8c12ef9aa6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--858463ed-9cf1-4b07-8a9e-5016a1ad0165", "sighting_of_ref": "indicator--ec882a46-3dfb-4084-995d-94b6f6034f16", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0079513c-ddba-4bc4-ba67-7553b312a19f", "sighting_of_ref": "indicator--f1ae4a3a-f686-4152-a75c-8eee4351607a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65a8ca27-8d55-4627-973e-3b0c8127a71d", "sighting_of_ref": "indicator--30bff008-e025-4c7b-b66b-e16d22540a8a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd3fa732-3fb4-4e26-83a0-6f06319eacad", "sighting_of_ref": "indicator--117eb48c-40f1-4707-8940-fa3694281540", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--859322d7-b03e-42bf-945c-1cc9e8dd6845", "sighting_of_ref": "indicator--ae6ab838-ece2-4029-b1fe-fc556abcee25", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1885e607-1f31-4168-a899-25c85fe37685", "sighting_of_ref": "indicator--ae6ab838-ece2-4029-b1fe-fc556abcee25", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fdedbcf-d439-4a91-8f29-828edc610f5b", "sighting_of_ref": "indicator--3a1a6b62-1f4a-4e2c-98c6-4a924f017b01", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e0b009d-2f91-4501-b21a-22e59227e5f4", "sighting_of_ref": "indicator--4b8411ed-b3c7-4fe2-92ac-0740ce5c2dfa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bf204d2-49d4-425d-848a-dfd1fc984c7e", "sighting_of_ref": "indicator--626553f4-f957-4283-9c64-8c39b2bfa9cf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d44583c-e204-456a-9092-c91f1d7451bf", "sighting_of_ref": "indicator--b2b95a8f-e788-468d-8c05-8a0e5d0deca8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80153344-0ca1-41ef-ba2b-5952c7e304b1", "sighting_of_ref": "indicator--7e208d25-08fd-4dfc-8ce2-3b6f1be0a5b6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fee25e89-073b-4bd0-b722-ca8f181ab702", "sighting_of_ref": "indicator--f5d7853a-d6ce-4235-af43-950bf84a0c8c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc01af8d-9f25-4ced-b163-9caa2be4da10", "sighting_of_ref": "indicator--9c8cc9aa-5f38-4671-8551-5c7498954b61", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd76a617-1e38-467c-85b5-ee10171916fc", "sighting_of_ref": "indicator--e2d0a2a8-92a2-4af4-9d7f-a9217686c4bf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3740591-6209-4c75-964d-265e31f3110a", "sighting_of_ref": "indicator--e76d48d5-9e00-46e6-ac1c-3ae87772b478", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f1746ff-7ba4-48f9-82d2-ee4a428d2506", "sighting_of_ref": "indicator--2445b8ab-acf8-4531-8bd2-64c88a2fed84", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fab65a6a-7a90-49b4-8702-e1d6bbd439bb", "sighting_of_ref": "indicator--c48793ae-535e-4b65-a5fb-d004f1e8409f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3ee3910-b19f-47e9-a046-bb2283a1d232", "sighting_of_ref": "indicator--c48793ae-535e-4b65-a5fb-d004f1e8409f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4b35b75-73cb-40d5-b14d-21fd9d6e62ed", "sighting_of_ref": "indicator--803498d7-a956-41ee-8b98-053ba32e9e48", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d253a981-74b6-408b-9656-148440ce78cb", "sighting_of_ref": "indicator--f0be57f5-c188-46ee-bb5a-b107cc6f4803", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8da2fb98-4720-46a6-93b0-749afa1d6789", "sighting_of_ref": "indicator--f16c4114-542e-4654-8ee2-35c1397df6b1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5592951-3cc2-492f-b8f7-70b6925ece5e", "sighting_of_ref": "indicator--194276b6-941b-4bf5-967e-266e2ac92eb0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a20c2dce-1fef-48fc-abed-a90b5b75af4c", "sighting_of_ref": "indicator--5360f612-24de-40cf-a1fb-d68e127a2785", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c27b7743-fd62-4170-8c40-9b2b85baae25", "sighting_of_ref": "indicator--c85cc2e9-eaa6-4c80-b310-09f046466e99", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35d2c12d-58f1-4718-9a62-7bd14607eb6f", "sighting_of_ref": "indicator--546e6c28-0b5f-4c1b-bfaa-4a1c364d1d2c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8bd9039-8091-4e6d-b37f-65d211eca43a", "sighting_of_ref": "indicator--49723266-bd17-422c-ab0b-57315f118945", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c19f5a89-d00b-4a9c-b4d9-f34d2755c0c9", "sighting_of_ref": "indicator--49723266-bd17-422c-ab0b-57315f118945", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af3354c3-278b-458c-a17c-dd6cb2bfa16f", "sighting_of_ref": "indicator--ad022315-e4d4-4596-bf15-3b7af27862b3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--360976e0-9ae9-4514-94b7-d26f481f869b", "sighting_of_ref": "indicator--c56b4342-1f43-4a85-a3da-420f677452f1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b06fc29-10cd-44d9-92d5-34da0ba668e2", "sighting_of_ref": "indicator--c56b4342-1f43-4a85-a3da-420f677452f1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ef8c3f7-9342-480d-a090-2df2852d140b", "sighting_of_ref": "indicator--627c917a-cecd-415e-85b5-93d3001a6539", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68b6cb70-8aad-4fa8-818c-3076b07cd219", "sighting_of_ref": "indicator--627c917a-cecd-415e-85b5-93d3001a6539", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5e61580-64e3-4ce3-9e30-cd592c678db7", "sighting_of_ref": "indicator--321537ee-3626-4c18-ba14-c3800449c5d3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c9a4dd2-5cc5-4dd9-90e6-fd45785e73b0", "sighting_of_ref": "indicator--0bcf8659-4e9c-4792-a8b2-0e185cf2a0b4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9597b5f5-3d8a-41d2-ba04-c6d92a4aef61", "sighting_of_ref": "indicator--b743f72b-142a-451c-b725-96f5b97fc841", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4eb4dab-7e62-4f12-b3d6-615aec2c5eba", "sighting_of_ref": "indicator--24c35ac0-c8da-43dd-b128-420cf7c1326b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--daf3f1a5-673a-4398-b3ba-488becb2c8eb", "sighting_of_ref": "indicator--24c35ac0-c8da-43dd-b128-420cf7c1326b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b04fed05-29d5-4817-a237-1b711d447dc5", "sighting_of_ref": "indicator--09064eef-80d9-41e1-b2c0-c3017371f134", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90d1d6fa-2d62-4a2a-b907-1827907ac94c", "sighting_of_ref": "indicator--46f8037f-cc3d-47c7-a1d2-e7eefe025494", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ace4c3f9-f395-418d-adbe-f07d8869d7c7", "sighting_of_ref": "indicator--17bb65d2-55b0-4715-99d1-08634a475eff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56d1d79e-4779-4d34-a243-0976a7066283", "sighting_of_ref": "indicator--d8a75a68-1f44-4025-9ff7-e2d2a5176388", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8ea3eb0-0a8e-45fc-b722-8f4f10b9ca7f", "sighting_of_ref": "indicator--d8a75a68-1f44-4025-9ff7-e2d2a5176388", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--179b58d2-43c9-4bf1-bc37-4589fb50c0c7", "sighting_of_ref": "indicator--3ddde2af-e820-4d76-9e0b-eda5f5442c2d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60964d00-49b2-4bc8-912f-324d0047906a", "sighting_of_ref": "indicator--335f7703-ac3b-4649-b732-bc9b01802b0b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38d856fe-9635-4fec-948a-2a6fb6d3023a", "sighting_of_ref": "indicator--335f7703-ac3b-4649-b732-bc9b01802b0b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6cd7e8e-9036-4b2d-92d4-491f87458a4d", "sighting_of_ref": "indicator--1e6d75a3-2eba-4204-ac12-bbfc30c81643", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6beece3c-e8da-4de5-a45d-0285953c6ff8", "sighting_of_ref": "indicator--420ca600-87ff-4b02-a353-f54f5fa16b0b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cba5a77-7a35-4620-b022-7b2736d24575", "sighting_of_ref": "indicator--05d46561-1bf1-4912-9f7d-6c62e6ba05fd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d9237dc-0625-40bb-88a6-d06495629f19", "sighting_of_ref": "indicator--05d46561-1bf1-4912-9f7d-6c62e6ba05fd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--617ab363-a0c1-434c-9562-cd408e139d63", "sighting_of_ref": "indicator--7d6ad229-f5a4-42de-a71e-97cf5125f597", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0817c735-aa6d-4855-b101-b99a314e5440", "sighting_of_ref": "indicator--6309293e-cfb3-46ff-8ef7-cad5f162930f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab47457f-6920-4e47-93ec-4bb0a77bd232", "sighting_of_ref": "indicator--7dfc869f-6dc7-43de-9012-d6a7834e4319", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4d3384d-2aca-4b57-a33d-464382c08cba", "sighting_of_ref": "indicator--fa5f555a-2502-491b-8fdf-82091ea5aace", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--682a1a25-93e5-4f4a-937d-49eede8e3ec5", "sighting_of_ref": "indicator--fa5f555a-2502-491b-8fdf-82091ea5aace", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e86cc178-7010-451e-ab4f-e93a19dbb331", "sighting_of_ref": "indicator--0dcf3098-b315-4506-94da-ef869b76cd7f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90ba6566-121c-4654-a51c-c4ffc6340665", "sighting_of_ref": "indicator--e473427c-6e91-4c97-bfdb-f5b712c8bde2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41ec217e-514b-47cb-8791-962a59ea2896", "sighting_of_ref": "indicator--d774c778-d13d-462e-baf8-da189651848e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6241817-0a5c-4d0a-84a8-1ebe2cf4ed8c", "sighting_of_ref": "indicator--6073698f-b777-457d-b178-2dc57f82d00c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9d73ff2-0bf5-48f1-adc2-191641b8e7c4", "sighting_of_ref": "indicator--6073698f-b777-457d-b178-2dc57f82d00c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a04511af-0647-42db-baaa-3a07240358d2", "sighting_of_ref": "indicator--e2835e94-436f-4e15-a10c-3101323dcec3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebb45ab7-de2e-4e03-85be-dfbea5321ccb", "sighting_of_ref": "indicator--0235d4c6-7525-4aa5-b439-fd609a77d032", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e257bc0-613a-4635-aed6-ab2395df07b9", "sighting_of_ref": "indicator--0235d4c6-7525-4aa5-b439-fd609a77d032", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69d7ea4d-e1e6-4eba-ba53-dd3617a41d2c", "sighting_of_ref": "indicator--0921c82b-7968-4bcd-baf4-e61daae4dd4e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b435e53-2b06-4f80-a04e-26d6398256cf", "sighting_of_ref": "indicator--cd07dfe0-d60b-4f26-a73a-98c9c7c81a29", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc47516a-3806-42e8-b74b-c03e6e3ef6d3", "sighting_of_ref": "indicator--ff48fe7d-eaa0-45ef-878f-62c8cc8bdbe1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2868eabb-874a-40fb-ba75-2026aab9e60e", "sighting_of_ref": "indicator--ff48fe7d-eaa0-45ef-878f-62c8cc8bdbe1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67ecad05-af16-4b4f-b95c-b07e87bbd4b4", "sighting_of_ref": "indicator--7dab5c5c-cf0b-4c38-82f0-0790a5b6d90b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cd5606e-c920-42a1-8ee3-72dda39172ef", "sighting_of_ref": "indicator--7dab5c5c-cf0b-4c38-82f0-0790a5b6d90b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e45bd455-1625-458a-9814-61a2b4d12db7", "sighting_of_ref": "indicator--cd4252f3-3ae3-49f3-985b-a1a5f954a285", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c6711e1-95c5-4ea4-9e12-54b64357bff0", "sighting_of_ref": "indicator--1983c679-31d8-441e-9f0b-1f56fd6c279d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cce43931-3e71-4438-a3e9-2f60c5757552", "sighting_of_ref": "indicator--e2d12b13-7c58-410e-ae4a-3b1de564bb6e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bcb6391-8b21-4116-8e0a-431bc876f276", "sighting_of_ref": "indicator--e2d12b13-7c58-410e-ae4a-3b1de564bb6e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7d655c4-3726-462c-9209-7ec8f7d55972", "sighting_of_ref": "indicator--8a971af3-34cf-463a-9354-29fc15768094", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--010d6fa4-b831-4042-9dca-efec6df0a7a0", "sighting_of_ref": "indicator--79c1430b-a07e-410e-a562-6043f2604c89", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--611adefe-11a3-4cd2-a898-17baace92ce7", "sighting_of_ref": "indicator--1c16d3b5-fcb9-4e86-9575-dadfa4f98695", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c80e491d-fcd2-421f-9d73-a5031d56217a", "sighting_of_ref": "indicator--1c16d3b5-fcb9-4e86-9575-dadfa4f98695", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c26dc96-36e1-4183-9ce4-0ad66517d5f7", "sighting_of_ref": "indicator--eee05416-5026-4107-9b98-fb648ae52f20", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe0bd1cb-e199-4b0f-8680-23621fd441a9", "sighting_of_ref": "indicator--eee05416-5026-4107-9b98-fb648ae52f20", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c5ecf92-31f4-4dd0-9afc-955af35fc69d", "sighting_of_ref": "indicator--1ce87dc6-8f89-43a1-b2be-d15dce27de69", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a0d1503-23c5-4357-8086-9b1524eb289b", "sighting_of_ref": "indicator--dc656ef8-eb48-44b6-a5bd-4302867e1c54", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0845bddb-d046-4c01-b215-630a91299872", "sighting_of_ref": "indicator--dc656ef8-eb48-44b6-a5bd-4302867e1c54", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0582da98-9a4e-4906-80a6-582d1b405689", "sighting_of_ref": "indicator--1d01ad5b-578c-4672-b892-fe024303a7aa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90192fd8-0c95-4bdb-850a-7b822d45eea7", "sighting_of_ref": "indicator--ddec8c48-aca2-4f98-bcb2-c18b3fbaa331", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a67fa84b-f5d2-40bd-94eb-144e5178b8ad", "sighting_of_ref": "indicator--145f3a54-b00c-4963-8387-d930d992d6eb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07d961e7-1bef-44db-acb4-fc65e90257a3", "sighting_of_ref": "indicator--7621a54d-5f29-4c97-9666-9f76dbea91a7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62101689-0f8a-48f6-ae7f-f0bd2915aa18", "sighting_of_ref": "indicator--d3b52681-af83-4b18-81a3-5c3629639a13", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bfc8357-a583-4db1-82d6-ff79a37e944f", "sighting_of_ref": "indicator--d3b52681-af83-4b18-81a3-5c3629639a13", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50388099-1cc2-4e6a-9b1a-07fe690f21b0", "sighting_of_ref": "indicator--66f65444-54cb-4a70-899d-0aa4b69e2a6c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2b7ffe9-e60a-4178-9b44-1ab4bdb5f506", "sighting_of_ref": "indicator--39441429-ec10-42c2-96f0-2b6d47d95393", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d210bbd-44f8-49c4-9c9e-bee2ec81373d", "sighting_of_ref": "indicator--bee9d18f-357d-4d18-9138-ae4963217b6e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--339c3cef-cfa1-417f-a2d2-46a0fb8b2746", "sighting_of_ref": "indicator--36a779b8-7ed3-4e5c-bd34-7317b4b908fc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44bb5630-5671-42d1-9f05-ad19d50aae15", "sighting_of_ref": "indicator--36a779b8-7ed3-4e5c-bd34-7317b4b908fc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b16c402-a289-4363-8110-94f93b0c10c9", "sighting_of_ref": "indicator--1c7a6bc8-b643-46bc-a368-cd34ae72676b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9477368c-eb71-4528-b299-5ed2236c7fb0", "sighting_of_ref": "indicator--1c7a6bc8-b643-46bc-a368-cd34ae72676b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--546efb2d-4f06-40ea-9f2e-95c6b6874e66", "sighting_of_ref": "indicator--5f7e8c27-0321-4c5f-8053-dce5db080ded", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e22700b9-386e-41c7-bcea-98c232cccd8d", "sighting_of_ref": "indicator--601e35a1-1470-4124-a176-3862a8a57e9d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4729bc40-06f9-413e-a3d1-630411e89f49", "sighting_of_ref": "indicator--601e35a1-1470-4124-a176-3862a8a57e9d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57765178-ec6d-48d4-9ddc-1a732ad80be3", "sighting_of_ref": "indicator--9aa767c5-e3f5-47da-9ea0-a799fee19968", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af8521a5-f943-4598-8b39-beca1d00c52c", "sighting_of_ref": "indicator--9aa767c5-e3f5-47da-9ea0-a799fee19968", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de4134d2-81d5-46d0-b141-27b00ba80064", "sighting_of_ref": "indicator--0f557240-59a7-477b-bb94-482a9b8d5038", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b8e5341-b9b2-4424-9060-2837908dd491", "sighting_of_ref": "indicator--0f557240-59a7-477b-bb94-482a9b8d5038", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f87ee423-2f6e-46f8-9735-e62309f00355", "sighting_of_ref": "indicator--7a675dab-208d-4bd3-a3b9-8fa296794302", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ca30fef-e9dd-4998-a7ec-c30f4dde48a4", "sighting_of_ref": "indicator--7a675dab-208d-4bd3-a3b9-8fa296794302", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dbd7626-20dc-420d-a0c6-7fc223634402", "sighting_of_ref": "indicator--d84d65b9-4f20-45d5-9975-f8a478d637be", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82d3f3ac-3f44-441b-bb58-667c6cbe0194", "sighting_of_ref": "indicator--60dc31c7-5bab-4006-90fc-dc7d7232baae", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--668db25b-1365-4ebc-a1ed-ce3cfbb342fe", "sighting_of_ref": "indicator--78e469ea-02d4-4ace-b493-b0a27d8b7b36", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a01f365-3242-4d07-966c-0145b33a7582", "sighting_of_ref": "indicator--a150c832-2580-47e2-81fd-4e202762ca16", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--405943f3-73a8-4527-b374-fafaa2c58610", "sighting_of_ref": "indicator--748e82d6-ef1a-419d-92cf-2097688a911f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24bd25ec-242b-40bc-9e36-209af5984903", "sighting_of_ref": "indicator--420445db-17da-4277-b4cf-cfeace3e9245", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4523de9b-bc55-451f-8ac6-ef50e64d2536", "sighting_of_ref": "indicator--420445db-17da-4277-b4cf-cfeace3e9245", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a37b3daf-e7ed-47fc-97a8-7d627358b422", "sighting_of_ref": "indicator--2169f309-bc3f-488c-a71c-7f07549ed9e0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--481dfdeb-dae8-4804-90ea-c888fb83bf17", "sighting_of_ref": "indicator--0637cc92-6804-4d1e-ad92-2c12f485e590", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1652203e-2f6d-48e6-a97e-87b0489358a3", "sighting_of_ref": "indicator--986bb811-6695-457e-a44d-b433652ad9c9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cabd6b2-d817-434f-a9bf-512e2601f1bd", "sighting_of_ref": "indicator--501cb32f-fee1-41ce-9273-83798bfa8bc7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d694073b-f094-4482-a9cd-a2f25a2e17b1", "sighting_of_ref": "indicator--e5cb9df7-3f5a-4dea-956b-9c0738849f2e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84dc69a1-95c4-4917-9539-96a7388a421f", "sighting_of_ref": "indicator--e488f700-8c95-4bd0-9675-3c09a94a7494", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5135f80-a137-4a13-acec-bfda92998f8c", "sighting_of_ref": "indicator--e488f700-8c95-4bd0-9675-3c09a94a7494", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41222cc1-7e60-4f43-a6c7-690e7c2593a6", "sighting_of_ref": "indicator--270c72e9-5f0f-47ec-a4a2-200576e138c4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64a0f718-8f6d-422a-8ac4-7afc67bc93a0", "sighting_of_ref": "indicator--56add024-a045-44e8-8ef9-5fdfe820e911", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94770853-36e4-48f4-aa9e-a84caa85f05b", "sighting_of_ref": "indicator--aa7f9d4a-9c94-49e2-8ba8-64d66338ee58", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32ddf980-1016-46a9-9399-47468dd14f95", "sighting_of_ref": "indicator--aa7f9d4a-9c94-49e2-8ba8-64d66338ee58", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7e179a3-122c-419b-9729-209a63b5c0e5", "sighting_of_ref": "indicator--c3f21b19-6072-47ea-ab7d-12a2df3fce7e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07253488-5492-4b0b-924c-0425f1f68a6e", "sighting_of_ref": "indicator--c3f21b19-6072-47ea-ab7d-12a2df3fce7e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd5078b0-d3d1-4d40-9951-a4649508454e", "sighting_of_ref": "indicator--878a749c-34ab-44a5-b975-5a41277fd097", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6543c54-d30b-46c5-a7d1-da46fc192464", "sighting_of_ref": "indicator--878a749c-34ab-44a5-b975-5a41277fd097", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6624700a-18fb-476f-a7ca-1d757f990490", "sighting_of_ref": "indicator--449a41ce-f6b9-47c7-b485-122bf560fa95", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cd5efa7-6759-4a78-b309-05f46170c741", "sighting_of_ref": "indicator--449a41ce-f6b9-47c7-b485-122bf560fa95", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58a8888f-a71d-4c4e-9c4a-52729b796f07", "sighting_of_ref": "indicator--be1f65cb-0480-48e3-a39d-39ec86339e8d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10072f5b-6e46-46ca-8e4a-194e52346023", "sighting_of_ref": "indicator--98bb4c03-9588-46d5-b8fe-f58614f838e8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4afe4fa1-31a4-4c5f-bc22-122bbd7048e7", "sighting_of_ref": "indicator--469127ff-f60f-4173-a3c3-6bc628f8e880", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3c66a1d-f693-480d-bb2b-c373d0fdb915", "sighting_of_ref": "indicator--eabc9d31-7615-4253-80eb-7766dcf21d16", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2158c85a-6dd3-4e35-aafd-a78947672d21", "sighting_of_ref": "indicator--5c257884-97b2-4510-9b76-9438b1a448f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--385186a4-2388-4d65-878c-759892b5297e", "sighting_of_ref": "indicator--49dff621-4ad7-410d-845a-8d681f3c9c4e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39789cab-4542-4d51-97cd-192b61880194", "sighting_of_ref": "indicator--04bf83fd-29e4-445f-9962-927867976dcf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a38b50e-5d57-45ae-a856-3f0bea82af18", "sighting_of_ref": "indicator--04bf83fd-29e4-445f-9962-927867976dcf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e742be7e-ddfa-449f-9fdd-799b61e9fbec", "sighting_of_ref": "indicator--d589a1dd-c66d-4763-890d-b0257b334be6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dda9298-7205-470f-8825-65ee065d2c8a", "sighting_of_ref": "indicator--d589a1dd-c66d-4763-890d-b0257b334be6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b75785c1-1e0f-466d-a132-ca31e1e4722b", "sighting_of_ref": "indicator--31583631-cca3-4346-a81e-20ea9b24d4f2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--894fee26-91b7-45e4-b766-a156f59a8560", "sighting_of_ref": "indicator--f20521ec-a149-4486-952f-362a4143d354", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--362f5788-7b2d-42ef-9eaf-f6243936252a", "sighting_of_ref": "indicator--c36ba4b9-ad71-4519-93b9-b9bfc7ae4ed1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae31b791-8402-4837-92df-37d2790b6e94", "sighting_of_ref": "indicator--c36ba4b9-ad71-4519-93b9-b9bfc7ae4ed1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--805a4fa4-bee6-4869-936e-69dbe0ea6cfd", "sighting_of_ref": "indicator--abb1db1a-3cf9-4eee-8b2d-5117aeee9739", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f07c334e-cab8-4b45-9bd2-a26faa96a816", "sighting_of_ref": "indicator--abb1db1a-3cf9-4eee-8b2d-5117aeee9739", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82279d11-b957-4128-bac7-05504ec9d36a", "sighting_of_ref": "indicator--489a83d3-d34e-4d48-bcdb-a934266b8edc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a8ad76e-a364-401f-abf5-a89747fefaf8", "sighting_of_ref": "indicator--91f3c1cb-4dbf-4f91-99e0-348abd73c07e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4b64733-26a6-458a-91b3-a1b59f8eff33", "sighting_of_ref": "indicator--2976c4c5-21b4-4f5d-b03e-b8fce7db046b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50608add-1669-43bb-850b-58ed53b5013d", "sighting_of_ref": "indicator--498d46ef-a921-4136-b5ae-63f24d802b89", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--300480e8-f100-407a-88c3-dc00bab395c5", "sighting_of_ref": "indicator--498d46ef-a921-4136-b5ae-63f24d802b89", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aaadc6a7-9eb6-4a2c-880a-99ac5dd4267d", "sighting_of_ref": "indicator--6a723b21-4346-4d9a-bf6f-85a2b695a41c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba897b10-4fe8-49ce-bbbe-0edaba798f0e", "sighting_of_ref": "indicator--164c9b55-0310-4dd0-8d12-571e8c5fd200", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3faee612-e38b-4d1e-ba47-7a08592ca626", "sighting_of_ref": "indicator--848883d1-638f-4bb2-947b-d368b5cafb9e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbb8a8e5-afcc-443c-ad32-fcf93495b19f", "sighting_of_ref": "indicator--848883d1-638f-4bb2-947b-d368b5cafb9e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9b3d8df-02c8-4fe3-9090-22bddb8f9bb2", "sighting_of_ref": "indicator--1b9f2dfa-33eb-4041-9b97-9ef489e551ee", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a6999c6-b94f-48d8-9d4c-73c9170611f7", "sighting_of_ref": "indicator--1b9f2dfa-33eb-4041-9b97-9ef489e551ee", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6216f7a-feda-4109-8d1f-9d669cb1928b", "sighting_of_ref": "indicator--d3d33644-52bd-4516-9835-4e233ea3ec90", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e6231a5-7cbf-4181-a1be-deeed9c9bb94", "sighting_of_ref": "indicator--d61951c3-dd91-49bf-b6c9-e8756236d459", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba36c052-df34-4d4e-918b-c01cda270f56", "sighting_of_ref": "indicator--0ebebcb7-1e90-413f-84ae-b800adba1eb0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9af9eff7-01d3-4f48-9168-71509ced31f1", "sighting_of_ref": "indicator--0ebebcb7-1e90-413f-84ae-b800adba1eb0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12e7e696-c792-4a45-a96c-f94ffb774ce9", "sighting_of_ref": "indicator--cf01918d-ab56-48c9-9052-1c01a645e6c0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e76d1447-3b33-4123-b8fc-829a336425c4", "sighting_of_ref": "indicator--48544d44-1d16-4c7e-84d1-2f63148e9f29", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1d42df4-f895-4675-bd4d-234c98079e53", "sighting_of_ref": "indicator--398224f4-1169-4fd4-a366-f0329f41d15c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13de153a-898a-47c1-9550-1ca5ccdd427b", "sighting_of_ref": "indicator--191e0426-d7ba-4658-b5d2-777571dfe5d9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dbed864-d4c1-47ac-9baf-3c325e47686c", "sighting_of_ref": "indicator--44b160dd-9b51-4b9d-9531-60d4cb5abc74", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d8c03ba-bc8e-4e4f-a232-5417d4654c2e", "sighting_of_ref": "indicator--a3c91e22-a546-430e-89aa-ac69d02be431", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd2d9444-03a9-4d2e-8cb7-4dc90286f933", "sighting_of_ref": "indicator--3bc44ce8-8b3a-45e1-9f2d-b089a5af981a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e9966a9-49c5-464c-be04-4062d80945ff", "sighting_of_ref": "indicator--8e50de29-b236-4337-83d4-d6ed9901fbe1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b39f8a79-e2cd-4b2d-b120-9ee41a81495f", "sighting_of_ref": "indicator--8e50de29-b236-4337-83d4-d6ed9901fbe1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b4aa1f5-cf88-41bd-a9d1-0cd6ddd236b7", "sighting_of_ref": "indicator--87796538-9b7c-4538-99da-764863342aae", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c549535-b5f0-4889-a239-612526471b4f", "sighting_of_ref": "indicator--81372f9e-cb4c-45a0-87ab-2039a24e6f63", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc64d37a-d8ca-4128-86d7-b28a1ee22dc9", "sighting_of_ref": "indicator--81372f9e-cb4c-45a0-87ab-2039a24e6f63", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f289f161-30c8-4459-bc2e-2bf1a7df3a97", "sighting_of_ref": "indicator--1d70aaa1-80e7-4e31-a07b-b9f27e3f19e4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f6ac378-9cfc-439c-89f2-755e72222280", "sighting_of_ref": "indicator--4542b4f5-5484-4bf5-8a45-2b08774fa52d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f4ac743-e16c-456f-8905-4dc70f87b3c8", "sighting_of_ref": "indicator--29454500-f37e-47c4-88fa-e8923566a39b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f3125ec-fb7a-4ad2-9cd2-fa66b91dd99a", "sighting_of_ref": "indicator--df4fe50f-9c74-4616-9aad-d33dcd2b2fb3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87bd54b8-6e1c-48c3-90af-4aa2ba964ac3", "sighting_of_ref": "indicator--63a45fb6-0919-4de8-b8bb-3f963a177eb8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ba40063-3390-465c-83f9-52d87035a947", "sighting_of_ref": "indicator--ad5e49e8-a40a-46d2-a384-9537b1041bf4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98b3f237-9657-4757-9f84-a70fc1b8dbf5", "sighting_of_ref": "indicator--e0b07896-61e3-4e53-9e38-3a10a7d7b034", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efab816e-794c-4606-b7e7-65ff0b902fcd", "sighting_of_ref": "indicator--22d20bcd-d79b-4b69-a747-de7329c26798", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae2ca8bc-f034-45a3-b8f2-a915f6868cf1", "sighting_of_ref": "indicator--0911f2cc-6e42-43c3-9231-3484b15fb28d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fd20b08-d5dc-4283-b659-1487f34a17f7", "sighting_of_ref": "indicator--0911f2cc-6e42-43c3-9231-3484b15fb28d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd62c546-ad65-4817-b0bf-ab3102577ec9", "sighting_of_ref": "indicator--df67e865-60ed-4223-b47c-387c82a51f1e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--637d4edd-43d5-4395-806d-6de9a41dc093", "sighting_of_ref": "indicator--8c5549c7-4ac1-4717-91c3-cb8aba5d5d90", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f297148-6de7-461a-934c-8bdeb3cf55da", "sighting_of_ref": "indicator--8c5549c7-4ac1-4717-91c3-cb8aba5d5d90", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e397882-5467-47ce-9586-5e2f365a4c7f", "sighting_of_ref": "indicator--1940e92c-e5e1-4567-a73b-cb5d3649b943", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1cc694a-a272-46c5-845a-daca2ce47e6f", "sighting_of_ref": "indicator--784663c6-71ba-4aff-953f-7c3dde97c0f0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d2ce0f8-4596-45da-bc11-93d497933683", "sighting_of_ref": "indicator--343024e2-5c48-4768-9b4d-10e156db4b91", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d8e92a4-a030-49c4-bc0f-5d1d124bc9f3", "sighting_of_ref": "indicator--343024e2-5c48-4768-9b4d-10e156db4b91", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--523d018f-46d8-44f3-a5ec-f1def40ce504", "sighting_of_ref": "indicator--76193116-98ac-4a0d-aeaa-25a449712fc1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f54ef7a7-6c38-46a3-b92b-b00d2f51e7e2", "sighting_of_ref": "indicator--76193116-98ac-4a0d-aeaa-25a449712fc1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02863f46-ba69-4b92-bcfc-7be8c8ed1f1a", "sighting_of_ref": "indicator--5672ea0f-060f-4f6f-af4b-6e3c75d86b28", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab9b6757-b170-45c6-81d1-097ef6735e1a", "sighting_of_ref": "indicator--5dd7bac8-35b5-4d37-9314-c90cffa6bf8d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd900385-d91e-4464-9c79-53ee544e0578", "sighting_of_ref": "indicator--a4b194ae-47d0-477b-8e45-7bb77b33a41e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--425e74ec-afad-45fb-8e61-f854db293286", "sighting_of_ref": "indicator--549b84d9-d9a6-4409-9ae4-d0a4effa6be5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--191a9952-94c4-4f3a-aedd-58eccc8ab691", "sighting_of_ref": "indicator--8cb890e1-7b97-42a6-8352-fe9e22abd6c4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec6c45b5-1977-4b58-8385-e02752177245", "sighting_of_ref": "indicator--8cb890e1-7b97-42a6-8352-fe9e22abd6c4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4337bba9-2a15-4a15-899c-c2e136d4f220", "sighting_of_ref": "indicator--6c0f6e59-0cd5-4e93-9c3c-ccb0be80d055", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ef5d6db-5a35-4806-a88e-1f8c5d57bae5", "sighting_of_ref": "indicator--6c0f6e59-0cd5-4e93-9c3c-ccb0be80d055", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5c4fa49-71ac-47b6-9cc3-208428c95d53", "sighting_of_ref": "indicator--fafdefbd-6ca1-4dc0-836f-aa1603970c18", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aaa0a0b4-1e4a-4507-94c3-e79c6c66c7f4", "sighting_of_ref": "indicator--fafdefbd-6ca1-4dc0-836f-aa1603970c18", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c05572e6-c7f0-40eb-bb25-d9f15f556fd7", "sighting_of_ref": "indicator--419cc008-f865-46db-9716-ea3670447b8c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e66a0c3-7410-4618-a063-ec9958beabd2", "sighting_of_ref": "indicator--419cc008-f865-46db-9716-ea3670447b8c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23216aee-b16e-43eb-b5ae-52fefb332310", "sighting_of_ref": "indicator--d14dbef6-6671-4b74-9434-0142aec5a5de", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9354ba98-0781-43dc-a014-fc21f8f0e736", "sighting_of_ref": "indicator--d14dbef6-6671-4b74-9434-0142aec5a5de", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--509a52f0-853f-4c5e-b424-ffba2f52f4d2", "sighting_of_ref": "indicator--649312eb-aff7-4c76-86d8-38cb5ea990f6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--414f7d18-0471-4a55-9a50-77582f7b8613", "sighting_of_ref": "indicator--c49bd00c-b69f-47f4-b77e-6829b0e60bd4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32d1e75e-09c6-4b3a-b4d6-92b6c086d4ef", "sighting_of_ref": "indicator--5c67cf65-62a9-4df5-a332-75e1ecff981b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e2b2569-b849-4779-96b2-a17e4d2e449c", "sighting_of_ref": "indicator--5c67cf65-62a9-4df5-a332-75e1ecff981b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd418de5-38f4-4426-adb2-3cc0844789b9", "sighting_of_ref": "indicator--487fc478-1a84-4553-aac4-1e45974fb296", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e1317c1-c899-4ed3-9c96-0df55fca6e9c", "sighting_of_ref": "indicator--72293a9c-dfc8-4dc8-94ce-4fab59f621d0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--552b3249-4703-47ca-a4cc-389b3503996c", "sighting_of_ref": "indicator--ed391d1b-161c-4109-aab1-8d0d22ffed40", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b68355a8-400f-4862-9e0d-45ddcee96835", "sighting_of_ref": "indicator--ed391d1b-161c-4109-aab1-8d0d22ffed40", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be001921-aca3-43a3-bc57-699c62d2d680", "sighting_of_ref": "indicator--0b9c44ee-12d0-476c-b748-3675c2b119c7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0757051-62fc-4a46-91d9-606c8bb6e607", "sighting_of_ref": "indicator--55210777-7993-438e-b845-e71c9a3823b7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6eae3db-7d1f-4906-82e5-57dff844c694", "sighting_of_ref": "indicator--55210777-7993-438e-b845-e71c9a3823b7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--927b477e-79c2-4887-a20f-3fb7b79f3724", "sighting_of_ref": "indicator--3666a915-af12-4af3-aac1-e8c3d502d054", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a1254d1-4035-4a9f-8bf1-13ca80dd92a7", "sighting_of_ref": "indicator--55c4fe8f-60ee-4f1f-a1ce-01d448ae72d4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c373157-bc4a-4166-b54b-2099fb4b8888", "sighting_of_ref": "indicator--899e5e98-3793-43f4-9d08-865cc65988ab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--790a30fb-7a4c-4856-a611-2cf3067488d7", "sighting_of_ref": "indicator--5a982817-552c-4141-badc-f61d101ced1d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3aa1dda3-9b38-4c49-9fdd-7176b4c5beb3", "sighting_of_ref": "indicator--a1a453fb-5f3c-4fd1-a93c-4bbb965ad502", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11ffec8f-d01c-4636-b292-8edaeb2b3089", "sighting_of_ref": "indicator--1f9b1374-efbd-46b2-ac1f-0cb5de456b96", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11c54a04-a0d3-4611-a123-d3da5feb432a", "sighting_of_ref": "indicator--8a0f5ef6-b183-467c-8d8a-d2ed28c09291", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--294b8e05-74b0-430b-88da-37ad3f85acd4", "sighting_of_ref": "indicator--90afec86-b3b8-416e-9f68-3781c5c3c8d8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63977dd6-9829-4cd3-95f1-a7193c6bdf5e", "sighting_of_ref": "indicator--f7917ec9-9821-4e11-a60a-495f8998afdc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e038aa0-7a0b-498e-bb99-2d8854937594", "sighting_of_ref": "indicator--f7917ec9-9821-4e11-a60a-495f8998afdc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b94a82e5-2cf9-4e87-a5a6-a5481646ca05", "sighting_of_ref": "indicator--bd5fdbbf-4adc-449b-96a5-4a1260f85ad8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05717cfe-02c8-499a-b0ee-00c89d66fdff", "sighting_of_ref": "indicator--fd83e7c7-b736-4ed2-9c1f-e91851f2b8d8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--391222d6-b7bd-48fa-b249-9ea0f43b6706", "sighting_of_ref": "indicator--97cfb3c3-e138-46bf-bd46-430579d59d7d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae97ea81-bbd3-4e5d-b0ae-ac81be77c077", "sighting_of_ref": "indicator--97cfb3c3-e138-46bf-bd46-430579d59d7d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6bb95ff-4dd7-4ab6-99cd-940f5057ba54", "sighting_of_ref": "indicator--8163b1eb-f23f-41a7-8d38-242cbb4e89a0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d03a85d3-793d-406d-a52f-b16e5a454cd5", "sighting_of_ref": "indicator--d9fef810-23a4-4a21-ba17-a472e674450f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fe554f7-82db-4765-ad3a-8dc601319024", "sighting_of_ref": "indicator--f4efd50b-74e5-4e41-a8d2-2d341490b62d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b899d132-d138-4bf2-ac91-4b7402b9ad29", "sighting_of_ref": "indicator--26cd429e-bf05-4a9b-91a1-e37aba7ed3c4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f08f19cc-7ed9-4eb9-9550-2176fb332736", "sighting_of_ref": "indicator--09664ab7-e062-4060-a688-671b33e3ec26", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32bf3942-4568-4296-9004-13a73597b1dd", "sighting_of_ref": "indicator--7b6a2aba-031c-4e02-ab44-303a39ae6e25", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31976c32-12b9-415a-a745-b7fb05b86889", "sighting_of_ref": "indicator--2d25763e-9c00-4184-96d0-a1380c5ab86a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5639c3a-5b4c-427e-b757-79885e3c99be", "sighting_of_ref": "indicator--8110ad7f-0320-47f9-ba45-15b6980864ce", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74aed4ce-2498-44eb-9998-373e0925faa7", "sighting_of_ref": "indicator--8110ad7f-0320-47f9-ba45-15b6980864ce", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d920273-7096-4637-8120-4a5e0d7da0a0", "sighting_of_ref": "indicator--8098432e-9ebb-49cd-a21f-17d01f0ad877", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eab5fcd7-48bb-4ede-95b1-85644aa72f27", "sighting_of_ref": "indicator--69bed565-5154-48c7-91d2-2d2ed634ca2e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adb8ab8c-68df-450e-8fc7-5231299b1332", "sighting_of_ref": "indicator--fd3aac12-5e5e-4c4a-8a12-7540aeb1eeda", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdf0236e-fd2f-4f6c-a4c5-dad75a1c4dac", "sighting_of_ref": "indicator--fd3aac12-5e5e-4c4a-8a12-7540aeb1eeda", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc47fe24-6828-47a2-8e85-89e46cd570b7", "sighting_of_ref": "indicator--2f8be3bd-90b2-4092-9611-5f6c19307b71", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67ebb23d-14c4-4b1e-90c2-e549c4f8cef4", "sighting_of_ref": "indicator--c5fc14e1-a23d-4a98-82eb-cd22962a0a38", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76c509d6-469a-4945-91d9-51c7d244a18f", "sighting_of_ref": "indicator--1b955c39-1a44-41b4-ad0e-7982c73225c3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c46ef62-d82a-4338-aadf-50170c2309c1", "sighting_of_ref": "indicator--418faa3e-6ddc-4582-8962-cda70de96d3b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85ade6fa-d2e4-4e12-a9c2-b4407f0aa51a", "sighting_of_ref": "indicator--d93dac2c-6c62-479c-99e1-5fcb77505695", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b44b4148-1db3-4879-a1c8-1b6f7574b226", "sighting_of_ref": "indicator--fd4b48a8-ff17-4e4d-bf5f-033b8520dfbb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6cf9b36-0e58-4f1d-9713-ed561a8973f9", "sighting_of_ref": "indicator--d3e2a295-5656-4439-aa42-74eb51f3935d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73ed8bdf-b138-439c-af49-b2b021627cc3", "sighting_of_ref": "indicator--d3e2a295-5656-4439-aa42-74eb51f3935d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01ebaefd-70d5-474b-b597-59734424d0c1", "sighting_of_ref": "indicator--3ab458e5-d755-46e1-9e50-6a92382ba1a9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fff7959a-bafc-4fcc-a78a-b76cc52498b1", "sighting_of_ref": "indicator--3ab458e5-d755-46e1-9e50-6a92382ba1a9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--591aab93-f1d8-47b7-80f8-d611061f6718", "sighting_of_ref": "indicator--d3af9a90-8c9c-46d9-8abe-67d4a5b40a96", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec6b3e4b-e3e9-4682-a233-ea428dabf78b", "sighting_of_ref": "indicator--b5ac2137-e1e1-44dc-9eb4-530e4e4b22e8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--359b5ea2-6ac1-4ac0-9b4a-300b63dfec7d", "sighting_of_ref": "indicator--ec85f6ce-ee65-4127-a015-5a750d21c2eb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0734bd5c-1d02-4687-a408-a01b15e3a725", "sighting_of_ref": "indicator--c14b27f2-2908-4aa1-884b-907967149c1a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8f0c73a-88b8-496f-93bc-0b32649e472d", "sighting_of_ref": "indicator--e9465887-90a1-42e1-8693-48e4e12e3f47", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ee7c09a-1fa6-44c8-a2c4-08719e221830", "sighting_of_ref": "indicator--e9465887-90a1-42e1-8693-48e4e12e3f47", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ce74abb-9ae8-4c80-9239-1a5c13fb5d0e", "sighting_of_ref": "indicator--2b3228fd-4e8d-4d05-ab08-ec669f78303f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80b1d6f0-20ec-49b8-95c0-36cbce7e8c81", "sighting_of_ref": "indicator--2b3228fd-4e8d-4d05-ab08-ec669f78303f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de0337c0-7a85-481e-8b81-63d67bf3d912", "sighting_of_ref": "indicator--70df7367-5035-4931-b22b-6c6ad37880d3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4de8433-70fe-427a-a162-74995108b299", "sighting_of_ref": "indicator--70df7367-5035-4931-b22b-6c6ad37880d3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da76d01f-fbbe-49db-b958-2fd3f8b76946", "sighting_of_ref": "indicator--039d1066-5111-4634-be07-e6fdcc7a11d1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51e81b5d-0b3e-438a-86d8-5d1958ef060f", "sighting_of_ref": "indicator--d26398dc-2982-4a8b-a54a-fca8ff79a0e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f99d98e-ced8-4e84-8901-0e8b294a95db", "sighting_of_ref": "indicator--d26398dc-2982-4a8b-a54a-fca8ff79a0e1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7de85c44-9508-4fc4-ac70-e2ec1b65574e", "sighting_of_ref": "indicator--878e4e1a-e02e-4916-ac0c-d8193b2e3bd0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8803d9cb-88f0-4bd7-879b-9ab1c96c2246", "sighting_of_ref": "indicator--61b2e17e-abd3-4247-b4db-9a81d59503b2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cba23c05-548e-4460-ad84-a17874ed46a9", "sighting_of_ref": "indicator--2f229372-8863-4717-8ea1-c3da456b0c8a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--089fd4fb-2a4b-48d8-a2e0-9c7c88af9c7f", "sighting_of_ref": "indicator--2f229372-8863-4717-8ea1-c3da456b0c8a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5a45c75-3b77-400e-af14-a21fcd13d329", "sighting_of_ref": "indicator--414449d8-a69a-436b-81a5-9c8f4318b530", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b862f549-0a2f-44ee-91ba-38ebcd61c79d", "sighting_of_ref": "indicator--d53e69d5-f88f-47c2-951b-0c23297e6f76", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b52c5e22-0fb4-478b-807a-c46ff2219768", "sighting_of_ref": "indicator--181a8c94-8496-4977-abfa-25c7e4695a64", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8550b858-cac9-4f7c-8b5f-f78ad42286c5", "sighting_of_ref": "indicator--1a6c7876-7b1e-479b-a747-0d56e776dfe5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18d9d929-302e-4aac-a066-4adca2a343f7", "sighting_of_ref": "indicator--2edfeca0-2fe3-4766-b0a4-8d8aab6c560a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--476d923d-1824-4c90-87f3-75aeae6c3a93", "sighting_of_ref": "indicator--5cb633ce-d389-46a5-a774-5e1647fb8642", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d96fc5f2-3f42-44b6-91a7-851449cc55b4", "sighting_of_ref": "indicator--5cb633ce-d389-46a5-a774-5e1647fb8642", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--358a439b-ed9c-4cbb-9c39-2cfc6c8ff733", "sighting_of_ref": "indicator--a2249258-41d2-4c27-9693-ba4e9493c5be", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82056a72-981d-4291-baa3-2ec4e4367f31", "sighting_of_ref": "indicator--5862124b-738a-428a-ba5e-ec104ad942a4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--022c866f-bed3-4704-92d5-e1e01ef425af", "sighting_of_ref": "indicator--d0e502a0-3124-4d23-82d6-0fff43787611", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef5e4a10-0b85-47f1-ab46-4ca9cbb5ebd6", "sighting_of_ref": "indicator--ce610fcf-aaeb-4836-af07-049d4f92952b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15d4c83c-d9ec-4014-b0c5-91219da39d99", "sighting_of_ref": "indicator--b85bc3c6-8d79-42e9-91df-8273431dc2ee", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0de19f51-fe36-4b80-bbba-0857d3e33a1f", "sighting_of_ref": "indicator--b85bc3c6-8d79-42e9-91df-8273431dc2ee", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e3621d9-4f95-4568-85da-7a0d1a0b048b", "sighting_of_ref": "indicator--bb5fa3b7-745c-4b14-a139-fdb5b8accffa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--721c06f7-8334-4b74-868d-eb4686d06661", "sighting_of_ref": "indicator--bb5fa3b7-745c-4b14-a139-fdb5b8accffa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--314ac08f-a59f-4958-92b0-3fa248594aa5", "sighting_of_ref": "indicator--e956e721-6888-4036-b338-d7140efa1668", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6582c51b-6319-47fb-be75-0d1568de8c47", "sighting_of_ref": "indicator--fe70fd37-6b7c-4058-8c7b-b7b274bcc7f8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7f71c66-7567-4589-93bb-11cf32241cb4", "sighting_of_ref": "indicator--fe70fd37-6b7c-4058-8c7b-b7b274bcc7f8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--041accd1-1bd4-40be-850f-5d241d753697", "sighting_of_ref": "indicator--d02c3641-c804-45aa-88e3-7ee23df33ef3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--831b8cbc-a4c8-4f46-81e0-487d847aa63b", "sighting_of_ref": "indicator--d02c3641-c804-45aa-88e3-7ee23df33ef3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34b052ce-65f9-475d-b61f-a76883ea3e40", "sighting_of_ref": "indicator--e143f1db-79b3-4292-bd55-319fee7126bf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--710a2fd4-7b16-46ee-bdf2-af4c7df0a72c", "sighting_of_ref": "indicator--73ed7a97-d665-4bfd-96b1-3983e4415d9a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c46b3ac-2fca-40a7-a784-758cb97d6af9", "sighting_of_ref": "indicator--73ed7a97-d665-4bfd-96b1-3983e4415d9a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43a020b0-9f9b-4d90-9770-69b175bd16fb", "sighting_of_ref": "indicator--a21b4ad9-8f0e-400b-98d2-20a60c25bcb3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d362752e-7337-45eb-9f22-d040cfca0821", "sighting_of_ref": "indicator--20db9d4f-6bff-49a1-85a0-e54719dbe43e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6516517-f59d-4378-81d7-aed7732e53c7", "sighting_of_ref": "indicator--be503dd9-fdbc-4673-bee1-e9ad551d3075", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4901f54c-c8ff-4016-b26d-5393c20c4690", "sighting_of_ref": "indicator--be503dd9-fdbc-4673-bee1-e9ad551d3075", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83acbd3d-6ab8-4a2c-a3c4-580c7d6c2e79", "sighting_of_ref": "indicator--97279753-5715-4473-8527-cf825e17739e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3e49887-6f16-4aae-9717-5703798f5e48", "sighting_of_ref": "indicator--9922bbdd-9ee7-4052-95eb-d160cc810b27", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d2705e0-9a16-46cb-9935-a0749fcbfe24", "sighting_of_ref": "indicator--9922bbdd-9ee7-4052-95eb-d160cc810b27", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20bacd8d-57ef-4630-a5ff-944f8c6c1766", "sighting_of_ref": "indicator--d1f61d6f-edce-4c6c-8a6e-bee845597890", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af2c36d1-d0b0-449b-9fba-c5db1aecdad0", "sighting_of_ref": "indicator--8cf38f36-171b-46ae-909b-7d92c7f0afa6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--184ffb15-8d87-48aa-a22b-22394e51f225", "sighting_of_ref": "indicator--8cf38f36-171b-46ae-909b-7d92c7f0afa6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--040d91f4-4a71-440e-b692-d9c044d2e01b", "sighting_of_ref": "indicator--42019a44-b7fe-4031-a24d-f04981c8d53e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1938ce85-6023-4300-a1eb-e834e654b93e", "sighting_of_ref": "indicator--0ac98f72-a303-473e-9576-773f0e7cb642", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--706fadae-3067-4c1d-8a42-92373cbb562e", "sighting_of_ref": "indicator--d00ee020-09c5-444c-ab95-24d151bb06a0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62549f8f-a1f7-4463-9419-81c21c1b8d3d", "sighting_of_ref": "indicator--d00ee020-09c5-444c-ab95-24d151bb06a0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce725b5e-7ffe-4211-9f24-3d5c62d63ab7", "sighting_of_ref": "indicator--c3c802b4-4fb5-416f-a88d-b2a108332468", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03cb95c4-4a31-44c0-b095-cb7208f656f0", "sighting_of_ref": "indicator--bf720317-d61c-45f5-9718-016a652e05fa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89dd1a63-10bb-45b2-a062-f46647cdfaad", "sighting_of_ref": "indicator--4efc83cf-795c-4dc5-80f7-788e3fa8e2da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e80b989e-6b00-4f29-b3f1-80e522ffd22f", "sighting_of_ref": "indicator--4efc83cf-795c-4dc5-80f7-788e3fa8e2da", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7495edc6-adbf-42e5-9b9f-a446baecc3f0", "sighting_of_ref": "indicator--c11429f0-875d-45c5-ac90-6164f4fd9c5e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7be326f9-e6fc-45d3-a1a2-3a079dfa2702", "sighting_of_ref": "indicator--c11429f0-875d-45c5-ac90-6164f4fd9c5e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14b74e48-fe37-4645-99ef-3bcab5ce95b8", "sighting_of_ref": "indicator--db927cac-5b1d-433d-ad8c-771e9a6ce138", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a69b905c-a033-40f5-bd11-dbf1e3fc4ba9", "sighting_of_ref": "indicator--56dc1633-ae91-4454-8065-b89fb93f0280", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5f33ea8-885a-4f0d-9725-e9cc6eee755e", "sighting_of_ref": "indicator--56dc1633-ae91-4454-8065-b89fb93f0280", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--413a2c0d-6433-4666-9259-763e737a1570", "sighting_of_ref": "indicator--ea5456b7-07fb-4de5-a2ad-d9b89d870bd7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07f966e3-cbcd-4ba8-b70f-ddf697eac0e8", "sighting_of_ref": "indicator--ea5456b7-07fb-4de5-a2ad-d9b89d870bd7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--762b46a8-cb8f-4ab4-9134-0bf0817db8d6", "sighting_of_ref": "indicator--752826f7-c2ab-4776-bc8e-494600c74c02", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f1139e8-b7e2-4399-9775-eb1920c1225f", "sighting_of_ref": "indicator--3f336881-9801-4199-8fc7-a7ff905701fc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1fe3e60-a85c-4e54-a647-ae3ee4fe7428", "sighting_of_ref": "indicator--a35edf25-7523-45ea-8825-1d0e01aee0cb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8584c360-dade-4725-9ecb-99d307902368", "sighting_of_ref": "indicator--e0889847-79bd-47d8-b48a-77a7f2747ebd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31085da6-60c9-4a26-b23b-33dd561730a6", "sighting_of_ref": "indicator--e0889847-79bd-47d8-b48a-77a7f2747ebd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae1ea3e2-3c79-487f-be49-8e4df6f9c6c8", "sighting_of_ref": "indicator--3af73183-7a9e-4a9d-b11c-4860453bd6eb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3d36e84-d91e-4b9b-a3b7-51829e2d7090", "sighting_of_ref": "indicator--3af73183-7a9e-4a9d-b11c-4860453bd6eb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cde0cc4a-77a0-437f-b775-03672c8addc5", "sighting_of_ref": "indicator--890473ba-2d52-4fd9-b3f3-4966405948c4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--862e4e3d-5a31-4374-892a-f71172545c59", "sighting_of_ref": "indicator--890473ba-2d52-4fd9-b3f3-4966405948c4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a93612a-90c2-4dd2-8231-a453ca790ef3", "sighting_of_ref": "indicator--85860f05-6b86-4802-8d59-d0f9de5ed14c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--010ea1bb-d34e-4b46-b91c-91faf78de4c4", "sighting_of_ref": "indicator--b827d66e-d2ae-49fe-9d2b-0433573e3e21", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03db8f1a-0c2d-4491-af28-60835f143d00", "sighting_of_ref": "indicator--b827d66e-d2ae-49fe-9d2b-0433573e3e21", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e8852d8-2e50-4956-a78b-f2eb165c8c85", "sighting_of_ref": "indicator--6332f26a-e270-4c85-bb7e-853896c5a4be", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb30577c-1aaf-401c-a58d-d10f229c57c8", "sighting_of_ref": "indicator--6332f26a-e270-4c85-bb7e-853896c5a4be", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4b84d6a-a644-4da3-9cb4-d0de781efbbc", "sighting_of_ref": "indicator--4736f0ea-94be-409f-b282-9d568e774ab6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17e16b8d-f2a7-4cc8-90c5-76d368cdc75e", "sighting_of_ref": "indicator--2e2ef141-18f1-4b2d-97a4-862adb90dfbd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a9d9f7a-76c2-411e-9ad3-7d911bb6e932", "sighting_of_ref": "indicator--2e2ef141-18f1-4b2d-97a4-862adb90dfbd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b42460e3-81f5-432a-b625-98b5700db06f", "sighting_of_ref": "indicator--f0268541-8caa-4f2d-88ba-ae8800391451", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9e10951-a97b-4f6c-873f-25744a659368", "sighting_of_ref": "indicator--fc1d03de-c592-4480-a02f-8f37d121ba4d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b924413-58fa-41ad-a81b-c5206adff1bc", "sighting_of_ref": "indicator--4380609d-0fc1-4169-a033-dca8ed747747", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01936a75-bf26-4dcd-bb47-4c3661364ef5", "sighting_of_ref": "indicator--b26628ad-6f9a-4a9c-9337-7576c089c428", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec667264-9dab-4d2e-9aad-bbbf6b6c65dd", "sighting_of_ref": "indicator--67a23c07-5cb1-40f8-8cde-d1defd6e2f0c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--affe8ee2-8c3f-40ef-b813-9325b8d616d4", "sighting_of_ref": "indicator--75aa1317-ab2c-4214-a377-1e4a176246dc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86005071-65a6-4b17-b5d6-c388164d0cf3", "sighting_of_ref": "indicator--cfd5bb72-afe0-4563-88b8-997a190d203b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2b03ccd-84be-4eef-8f7e-4e84c357dff9", "sighting_of_ref": "indicator--9b55d45e-2eae-42e1-b1c3-48c7d29618f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad0ded8e-5838-4c33-be2e-4cfd1d2f1e6e", "sighting_of_ref": "indicator--9b55d45e-2eae-42e1-b1c3-48c7d29618f0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62ef534c-2090-49c3-8116-d821fd2592f0", "sighting_of_ref": "indicator--71b64e68-e8a8-4b6b-8ebe-a513c4f17009", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9e73d9c-2597-48d0-b1b2-b850865209ad", "sighting_of_ref": "indicator--ba1ed420-37e9-4759-b677-20a101800d3a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a33d59e2-d57e-47d7-95db-c184d20f78d7", "sighting_of_ref": "indicator--d12c05dc-9719-41f4-b341-e105f37dc240", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfeb8466-fda2-441c-9b41-7fc08ee50ee8", "sighting_of_ref": "indicator--fc5a4fc8-7441-4869-be87-6e601f9a4fd3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aec8b2f1-e76c-4943-a9e6-8b799b0456ec", "sighting_of_ref": "indicator--e3fcc2c9-a835-40c1-8ab6-8daba352846f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebabd5ce-3fd5-4c7b-ba2e-468dee6c2f7a", "sighting_of_ref": "indicator--038f1abc-3186-4b39-ac48-ef714ce093d1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c0c4763-fd63-4ced-b605-5def2bd5f40a", "sighting_of_ref": "indicator--038f1abc-3186-4b39-ac48-ef714ce093d1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20f5fef8-6266-4674-8db5-054bc89c41b8", "sighting_of_ref": "indicator--fb04c034-4fea-4138-927e-bacc03ce1dd0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3463d4df-140d-4e99-a8c6-1b244cf77230", "sighting_of_ref": "indicator--fb04c034-4fea-4138-927e-bacc03ce1dd0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cdaf0c5-1a26-426e-ac9b-110e42a2c0d2", "sighting_of_ref": "indicator--15d18742-e1f7-4b19-917a-50e2d90517fa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b1548a2-1ae9-41dc-b5e1-2c0bf8993b39", "sighting_of_ref": "indicator--fd870f4e-6d18-4dab-8255-37c355c4e844", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7869d72-502f-48f2-ba76-da548deea525", "sighting_of_ref": "indicator--563769c3-56a5-4039-9389-d045fe28cd4b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1373c4da-ce5c-48d7-a6ea-b46386fa7096", "sighting_of_ref": "indicator--2d3f2a3c-69f4-4720-848c-e27642d31f35", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35278d13-7401-4010-82ff-e4bde17161ad", "sighting_of_ref": "indicator--2d3f2a3c-69f4-4720-848c-e27642d31f35", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b715865-c991-450d-b04f-7369f2adbf43", "sighting_of_ref": "indicator--54c0f1e5-0c48-4720-852c-71fb14cf0798", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebf79a60-fd1b-4d5b-bd52-a9014fdf7f98", "sighting_of_ref": "indicator--e8e43f94-dbed-4335-868e-85f8718cf06f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf7cbe57-aba9-4185-85c7-09a672722311", "sighting_of_ref": "indicator--bb693595-03ae-4404-9a99-81d29f73b277", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9677c7e8-9a63-4e72-bbcf-c55700a25f30", "sighting_of_ref": "indicator--bb693595-03ae-4404-9a99-81d29f73b277", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a7e7236-cf4e-4808-ab04-922834d3e54d", "sighting_of_ref": "indicator--4358f74b-fabf-442a-91bc-377437c90dbc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4504b140-7e93-4a66-9167-0a3fa74c53f2", "sighting_of_ref": "indicator--4358f74b-fabf-442a-91bc-377437c90dbc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2053fe5-c56b-42a7-bbcb-ebaecdd92042", "sighting_of_ref": "indicator--6c21ce0f-03b2-4fd1-92c8-0004fb89d5f8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--554a3541-ee43-4464-b8d3-71d61f221133", "sighting_of_ref": "indicator--8a3a9c76-738a-45e0-a0dc-17373f3f00c8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c61015c8-1640-4aaf-9dbb-8a87d64dd73b", "sighting_of_ref": "indicator--8a3a9c76-738a-45e0-a0dc-17373f3f00c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4da47984-a0f7-443f-98c7-30993c3b02ef", "sighting_of_ref": "indicator--85faed5b-8902-48dd-86e1-4ab1117ad1ea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f375701-3066-49c3-80c1-667e64c6a8cc", "sighting_of_ref": "indicator--2e7e28e9-119f-4d90-9306-b6cf949c01b4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fa80249-bc7e-4c81-a4d4-854172cd8228", "sighting_of_ref": "indicator--2e7e28e9-119f-4d90-9306-b6cf949c01b4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa56fc80-03a5-4464-9056-ef3948f909ad", "sighting_of_ref": "indicator--c0f4f482-de2a-4d3a-a17e-ce39cdcc31ef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34534816-cd37-4a04-846d-297f8448c7c6", "sighting_of_ref": "indicator--c0f4f482-de2a-4d3a-a17e-ce39cdcc31ef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97530b1b-6a70-4bfa-9363-db8b677dc6b3", "sighting_of_ref": "indicator--7c95a6e6-e960-4bdf-aea2-0ccea3b4fb7d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--999c84b0-8000-427d-a1c5-19e611b1ab0b", "sighting_of_ref": "indicator--8c3e3524-05d7-466a-a7bb-57f4f40c3bb3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--336fc754-9772-4afb-9965-d9eaaa1715aa", "sighting_of_ref": "indicator--8c3e3524-05d7-466a-a7bb-57f4f40c3bb3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--757927d9-1321-4582-b3b7-5bc742c31504", "sighting_of_ref": "indicator--50e14298-3c10-463c-a637-592c19aaffa3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0608cd22-64b1-47b0-9610-5840c734b622", "sighting_of_ref": "indicator--93c66aa0-9d72-4199-b8de-c3e58279222a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9272c65b-9302-43b8-9e44-0b15545063ad", "sighting_of_ref": "indicator--93c66aa0-9d72-4199-b8de-c3e58279222a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4adb008c-f44e-4672-a6fd-d4acdb4fa495", "sighting_of_ref": "indicator--3148babc-9ba5-48b0-8cc0-b652cfd443b2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e062d81-bcf8-4b0e-a493-deaa0477f2b5", "sighting_of_ref": "indicator--67f355df-7858-4375-8313-f577fd3ec76f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27fc92c5-40ce-473c-b088-2d35229d8d56", "sighting_of_ref": "indicator--e3080dad-129e-45ac-960f-ff0c6cebcedf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7beea65d-2da3-4b4e-a795-1d72b416b669", "sighting_of_ref": "indicator--8bbbf634-04eb-4f94-9532-8232684f0f86", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27a4f1c0-4454-470f-b09e-3a021d7bc6e6", "sighting_of_ref": "indicator--354b80bc-68b3-4519-932e-ad3bd6f79b5a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6736a630-30e0-432e-b520-95f29a994255", "sighting_of_ref": "indicator--17a43ee5-2f73-46cb-a942-b5ce46393aa4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c8bd733-7870-46d1-8456-e5e0f2fe1d21", "sighting_of_ref": "indicator--17a43ee5-2f73-46cb-a942-b5ce46393aa4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db42f105-32f6-44c8-9f30-2d565b706894", "sighting_of_ref": "indicator--682aee18-1e7b-49c9-8be0-f934c675f748", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a57889c3-5e07-45c8-a4a5-593473f51c6c", "sighting_of_ref": "indicator--bfa5fad3-8da7-4d3b-b0e7-770d7465d81d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87f82fca-fb04-46f3-8289-b3810c295bb0", "sighting_of_ref": "indicator--29393a10-3ab4-423c-a5aa-d842fd809df2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f622e02-2686-4b0b-aa5d-3022e6a48ee8", "sighting_of_ref": "indicator--cacc8a2f-8f80-44a0-bae4-04697ce90abb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59a91540-58a0-4a0a-9c07-5a66dfa2b889", "sighting_of_ref": "indicator--18925182-014b-4788-81d7-238f47e9a7fb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b4c84cc-928a-425a-8965-bf386fe3862e", "sighting_of_ref": "indicator--c2a7dfa8-85b1-4ff3-a2eb-219ea71a3a06", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba4a446c-5514-4b85-8612-513674ac058f", "sighting_of_ref": "indicator--9b7a4ebf-8b54-4728-8105-586b229977be", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1220ea9-fd78-425c-9db5-fd48822014ce", "sighting_of_ref": "indicator--9b7a4ebf-8b54-4728-8105-586b229977be", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa0b9674-447d-4e13-bf83-7c5dc4107d3c", "sighting_of_ref": "indicator--8c973f1a-c617-4663-bf3d-1b2ee227ded3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21ffd0af-f577-427c-bdb2-bd74611495e3", "sighting_of_ref": "indicator--b7ad4a75-196b-4b46-80e7-2a4877340159", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--133ebeb4-9c9a-49cc-a6ad-611c157c9f5f", "sighting_of_ref": "indicator--b7ad4a75-196b-4b46-80e7-2a4877340159", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bb82e19-bbdb-449e-a914-0e4b7d567232", "sighting_of_ref": "indicator--64d2ef5e-a115-44be-8d75-a4b01640daa7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34f02156-7ea7-40f2-9fdf-3ce038081cd4", "sighting_of_ref": "indicator--64d2ef5e-a115-44be-8d75-a4b01640daa7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e10c2100-52f9-447c-be43-bba5440410c9", "sighting_of_ref": "indicator--086b5f8c-2c5f-4abd-b654-a6fa8ddeaccb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a48cc957-f296-4bc7-aebf-3263eae1098c", "sighting_of_ref": "indicator--f230bcec-2525-432d-a9b3-ba97d4d8f144", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1d1a170-db6c-467a-812d-45e94fb2a0a7", "sighting_of_ref": "indicator--f230bcec-2525-432d-a9b3-ba97d4d8f144", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbd79e4e-217e-4c39-9604-be6c8cbcac7c", "sighting_of_ref": "indicator--f092b488-c002-43a1-b097-72acd7907bf7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d87366a7-9d02-4733-8e18-55e638797172", "sighting_of_ref": "indicator--06eda3f1-3627-4b84-b82e-e37e71495a19", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f64dadc-688a-4583-b94a-f74f2d450fc3", "sighting_of_ref": "indicator--06eda3f1-3627-4b84-b82e-e37e71495a19", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70c3651d-a59b-4a0c-86af-ca60824d3778", "sighting_of_ref": "indicator--d411c065-5753-405a-8134-636f167637e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6743f5e-f906-4bf2-b537-84d94ab5ce64", "sighting_of_ref": "indicator--3cafdd26-9322-467e-8221-5f824a476be1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76f34c73-f72b-4e27-aa60-5c7f43740af2", "sighting_of_ref": "indicator--3cafdd26-9322-467e-8221-5f824a476be1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea88fe9d-40c6-49c0-b2c0-34d7c6e7818f", "sighting_of_ref": "indicator--3dd67204-f827-47a8-a656-ddc5df2431be", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dd80fe3-c2bc-4d09-8da3-ef0bc769dea1", "sighting_of_ref": "indicator--214cd5ef-815d-4c33-a030-1276b828e12e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edb670c9-4828-49d6-acb8-31759e4d9939", "sighting_of_ref": "indicator--214cd5ef-815d-4c33-a030-1276b828e12e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3504f19e-8e75-4451-ad5b-eaf0fb6d9e01", "sighting_of_ref": "indicator--7858dd70-a217-416a-83bc-2f8399f0d1a1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a353d688-cafb-4e6b-b4d6-b3543a4b54bb", "sighting_of_ref": "indicator--3a820039-f794-4972-b105-17641f612b65", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1699b10-37e9-4572-8bdf-817ead199025", "sighting_of_ref": "indicator--beabdcf3-126a-476a-854c-eade68a7c514", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2536ba8b-fdd1-4343-ac7b-96a96cc5bdee", "sighting_of_ref": "indicator--4279ec2a-fcf5-46ae-bfcc-f1ae7fbcb0f2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7490a77-36ad-476a-a8d8-95f35971e895", "sighting_of_ref": "indicator--bc36b28d-a23e-443b-84f6-6eefbf927ffe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa10e13c-5db2-4710-b379-4836fb8a07e0", "sighting_of_ref": "indicator--77e358ef-abd6-467d-93c4-06b3cff16a56", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1956ef89-fa4f-4b40-bf2a-0bae286d787e", "sighting_of_ref": "indicator--9c9cf4ac-5630-4b0d-8a4e-67600258dacb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--855d72db-9599-48f4-bde8-cb03b267c735", "sighting_of_ref": "indicator--7c67e40c-69ee-464b-ad8a-d6600c0d0094", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41234cfb-a915-44b1-8cbc-fb50b56047d4", "sighting_of_ref": "indicator--3df28a72-32cf-458f-830c-1ceb5e844f00", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db2b2b25-7e13-4d1f-a891-8ccd840b1e4c", "sighting_of_ref": "indicator--d6b93894-9cd3-4d69-9b99-1a8899531549", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a64a21bd-e1a2-4bef-b923-d78a5283b486", "sighting_of_ref": "indicator--d6b93894-9cd3-4d69-9b99-1a8899531549", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bcb2cb1-a232-46eb-ae00-08067c58d793", "sighting_of_ref": "indicator--fa0e621e-ab74-4d70-8de7-478641269f97", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d12adea-eb54-4395-8ea8-b7c0050ca7f5", "sighting_of_ref": "indicator--8e743de4-52cb-4975-b655-f335522e9cb4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddf9db51-ee3b-4646-afc8-36f6c28f51ae", "sighting_of_ref": "indicator--7b6dd904-c684-497e-9675-c3c4cf756afe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ed6b38e-6936-46f1-830d-79085b0b1c97", "sighting_of_ref": "indicator--6a18b69f-a945-4f2d-a177-7218203f4929", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--227da53e-a161-45b6-bb04-c5a6a3ff3a66", "sighting_of_ref": "indicator--6a18b69f-a945-4f2d-a177-7218203f4929", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdbe8604-719a-4a4c-9d10-d5ec52867a06", "sighting_of_ref": "indicator--9d7651c9-ee61-46cd-a956-3a82939e0681", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09c31403-5d95-4c91-b363-5487b9bf90b9", "sighting_of_ref": "indicator--2ea9783c-a36e-401b-bc21-c9b2e01ab021", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b619acc2-bde3-4b4e-a99f-ad3090136d2b", "sighting_of_ref": "indicator--0fda0abb-8384-4b4d-ace0-d45d547668b0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eda1c5c-39f3-4916-abc4-ffe53a449abe", "sighting_of_ref": "indicator--dd7b16a7-400d-4748-af8a-0d62e276ad7b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b605144a-1344-407f-9439-b038665c7e79", "sighting_of_ref": "indicator--e27e0a73-5727-473e-a0f1-ae23e4569e30", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33c45478-d26d-46bf-8b38-6f81f791a09e", "sighting_of_ref": "indicator--5ae3c440-7bd8-48ef-bae8-de9284c15d28", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f0da8cc-6de5-4970-8b60-0903934fb4d5", "sighting_of_ref": "indicator--ffe1949e-053c-4eb8-ac28-eca3061addb2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77f0254e-a64a-4ab6-83ee-7dd87a4f19bd", "sighting_of_ref": "indicator--e2754f26-26e6-4ddb-a322-fcc7ae3f1194", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d1d94f6-89f1-4a3c-b416-0dd0ed7f8c7c", "sighting_of_ref": "indicator--c7c82d3d-67d4-48c5-aa73-c7b1d34f8500", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56951a29-c099-4b60-8407-a998aacd2b06", "sighting_of_ref": "indicator--86448ba0-4c51-45c4-99da-c9b2ca5c2a20", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76b61df6-44a2-48e8-9fcf-06b9a5839198", "sighting_of_ref": "indicator--285e3371-d53a-4dc4-a67d-9423d720788b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99f68575-d212-4eec-b3c6-d8b9647b370c", "sighting_of_ref": "indicator--298e5b02-6015-445b-8b9d-dd093731ad25", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7554586-8d13-4aa8-9c8c-4f2b632752e3", "sighting_of_ref": "indicator--a38c8518-3a97-44db-b903-3ccdfc3a2f81", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d90a8dd4-cf61-42b8-aab5-f290222bc2b3", "sighting_of_ref": "indicator--57ad744a-be12-4ec5-8e9a-aaf57e7b964c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c03416c-abb9-4c6a-93e5-659caa03d12f", "sighting_of_ref": "indicator--6832083a-a930-4489-ad66-251052864571", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d77b39d-b9af-4188-be02-2e694cac3aaf", "sighting_of_ref": "indicator--25d0c35f-f32b-44cb-84e2-ab133fbacc80", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7af9c57a-6883-4c88-bc84-9405437ec6a2", "sighting_of_ref": "indicator--a29e0c45-39b5-4768-9a7c-d99bc8dcaeba", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--768b0c9d-08de-45ee-ae34-983cf1a625dd", "sighting_of_ref": "indicator--a29e0c45-39b5-4768-9a7c-d99bc8dcaeba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4434b0d-7295-493e-a4f3-3a7c4f5f2697", "sighting_of_ref": "indicator--d2edc996-4ae9-4eea-9ea5-c7eba1769d3a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8752d76-3a7e-4036-9435-1f4b2d8b40b2", "sighting_of_ref": "indicator--3eac8c02-2510-43c0-b6a0-9eb14fdaeba2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ee320a1-a858-4da5-a4f3-4007d65e83ed", "sighting_of_ref": "indicator--7edc5803-e401-453d-89f2-6f9f4e268418", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f07c146-7a1f-40e0-9c6f-08f184700457", "sighting_of_ref": "indicator--ec4a358f-45e6-4606-a46e-1a29ed2bc8c6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67ff293c-ebd0-4809-8e25-994c1610c4d7", "sighting_of_ref": "indicator--787d4ddc-23f8-42ad-9c72-3431610f4d75", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--962a4502-1291-4be6-a358-d8a2faa94709", "sighting_of_ref": "indicator--787d4ddc-23f8-42ad-9c72-3431610f4d75", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ff22330-f8ec-4482-9528-7700051c085a", "sighting_of_ref": "indicator--8a3af7ec-cd77-40b4-a37c-8084f232879e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dae64a7-5685-4c84-a5b9-5094bd990b50", "sighting_of_ref": "indicator--0ec41b74-f30e-4cc2-b73f-6dcb58496b3c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09278363-4189-438e-b9e1-9185619792e9", "sighting_of_ref": "indicator--1559635a-dc25-46d6-aed5-56171419934d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97548bd5-06af-4bfe-ae59-b2f064f7def4", "sighting_of_ref": "indicator--1559635a-dc25-46d6-aed5-56171419934d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b94a492-f987-4424-8cd8-fb3c5ba73541", "sighting_of_ref": "indicator--8d6fac90-ff42-4bef-b34a-cc9c7a564f48", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--009a7c22-0b19-4579-8292-68222eb88de5", "sighting_of_ref": "indicator--71c13762-f825-4731-8c74-338e13a0b98b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e32fc763-5480-4b3e-8db7-8d075b0ca096", "sighting_of_ref": "indicator--d338db42-0d20-421f-8abf-cbe82578c7d2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--847b6ada-927a-43a1-937e-e6091a203a3f", "sighting_of_ref": "indicator--8b5fbc84-4fca-46f3-a312-e59e7759892a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e299f021-a98e-40c4-93b9-d20da22e8c27", "sighting_of_ref": "indicator--0b936878-5223-41e0-be9f-d2adcde0d149", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25016b2a-e5dc-4e4c-b4ce-1252023b4577", "sighting_of_ref": "indicator--dc462890-eef5-414a-a0d7-bfe7dba96a67", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5cf1e93-ea98-4226-b154-6bf541a1db1c", "sighting_of_ref": "indicator--06dabe4c-63ed-4d64-9614-d872ee84b946", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd7538e5-78eb-4428-bb90-638fe21a0d0a", "sighting_of_ref": "indicator--6cc2917d-1a32-4286-a02a-55aa80256e66", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--337ffd7a-3832-4561-84c6-fa2d034e7c0c", "sighting_of_ref": "indicator--6cc2917d-1a32-4286-a02a-55aa80256e66", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc8b7098-9f0e-4462-9099-420371e702c6", "sighting_of_ref": "indicator--3bb79dae-8231-4aec-98b8-bebc99d45a2d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb80607b-0942-4432-9a40-e86b6664f25a", "sighting_of_ref": "indicator--eabc186c-31f6-4bca-a572-453e5ea75c0c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fd4c922-e7b5-4460-a6d2-40364d1a62e5", "sighting_of_ref": "indicator--f6772085-108d-49ce-a0ad-736253c4a2ba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--749bd88e-e47b-4a2d-aedb-ae576d33d8b8", "sighting_of_ref": "indicator--81d4cc39-ef42-4262-ba35-e7cc296fe51f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--917a8306-5947-4ea0-a143-cfc860fbfdf2", "sighting_of_ref": "indicator--81d4cc39-ef42-4262-ba35-e7cc296fe51f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d64b11c1-f38d-4262-8c4e-c06c4d8f76d8", "sighting_of_ref": "indicator--fbb0ece8-5c6b-463d-9c84-0f41677c5fd0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1ae2710-3155-4b7a-8a50-32a90791f99e", "sighting_of_ref": "indicator--550b3d11-be12-40a5-8474-927938964c51", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4f73aa8-9dd0-417b-befd-9113f879f885", "sighting_of_ref": "indicator--aa2015b5-13f5-4e84-8264-e83285ac3c0b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a285ef83-5a54-43af-aa96-138cfa908501", "sighting_of_ref": "indicator--0a39db4d-d29e-4494-8145-2e2497c038a9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5a8a780-b75c-40f8-ae34-a110f47386a8", "sighting_of_ref": "indicator--221ce64e-fba0-473d-b701-d1aa56d30e33", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--644818af-86ab-41dd-b0d9-aaf8100b3ba7", "sighting_of_ref": "indicator--31f3797f-ebc9-49b9-86f3-37b57416ccb7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a044f9ab-2ea8-4819-986c-6c87ead82135", "sighting_of_ref": "indicator--68948618-b40f-42ca-9444-c5e4160a7f4d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eb7443a-8d77-4b64-a09f-a9ec622f1575", "sighting_of_ref": "indicator--562df0ef-4404-437d-9ab9-87c933db3ac6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9726e7d-7945-4f96-a0f5-9b298747c4a0", "sighting_of_ref": "indicator--562df0ef-4404-437d-9ab9-87c933db3ac6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd9ad681-7815-4950-aa59-8385c8433a33", "sighting_of_ref": "indicator--7d961c1e-e155-439e-b72f-3c61ddea85a0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0920df27-24a1-43ed-b99a-affd828dfe13", "sighting_of_ref": "indicator--44f56b19-1b5a-40b6-84da-b19718e3188d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31db65a0-3f80-4dc2-b189-62234c2bc4a8", "sighting_of_ref": "indicator--f1f6c69d-78cc-455f-8e48-acaa077bb9b7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ca7713c-6de0-4810-b1bc-64b1bc24880f", "sighting_of_ref": "indicator--4da261d2-16e5-482e-be53-04181d11c75b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d69893e-b1a7-4c5a-b95c-6fed593a9469", "sighting_of_ref": "indicator--43d09c39-8635-4105-9112-28407ba4eb05", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--362fde7c-af3e-4030-9fc6-fd0ca9429177", "sighting_of_ref": "indicator--a3bf9211-69c6-43b6-854c-4cc2fda7fc68", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dc5dbe9-d2a7-4cb3-9c74-7dff76abb150", "sighting_of_ref": "indicator--4f645593-d22c-46c3-a34a-e8d280a0e52c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41f59916-017f-4f2f-a716-a46f0ded92b7", "sighting_of_ref": "indicator--216d08ee-eb21-4756-be4e-53bcf33d5f44", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85b046e1-37d9-471a-99dc-deb4a3ea09ff", "sighting_of_ref": "indicator--9c3f9799-7571-4a45-9935-d398b42c870d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f693eec-df77-4da8-bdcd-624afa18ca31", "sighting_of_ref": "indicator--f5efb850-de5f-4b8b-ba2b-1d234e483c70", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--351186be-af29-4e6d-915c-38765cd8dac8", "sighting_of_ref": "indicator--e6f6a402-861b-4844-bf74-5883d94b917e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a877fc18-c29a-4e10-93d0-abceec0e7600", "sighting_of_ref": "indicator--1be5c0a6-782f-49cc-86b2-a054ee6e79fa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38b938bc-283e-4544-be5b-ded855b93182", "sighting_of_ref": "indicator--9f246846-5e13-46b1-af7f-120eb9fd36f6", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad7ba7fb-2f7a-4ca0-8d15-e5f9c40e0685", "sighting_of_ref": "indicator--5c83f320-f352-409a-9f68-cf7edad06ad0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bdd98d8-ce5d-4b28-9024-1241bec272e7", "sighting_of_ref": "indicator--e45d37a7-af00-4c1b-b310-80bcfdab30ef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--facb6ae3-ec6f-44d0-9f88-721a2fedcbec", "sighting_of_ref": "indicator--e45d37a7-af00-4c1b-b310-80bcfdab30ef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf627001-b313-4ff6-a3b1-b31a6905e644", "sighting_of_ref": "indicator--b0b3fc72-17a8-4ebe-8fa2-3f5912912f8f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99c93208-e7ee-4546-873f-164dd692e67c", "sighting_of_ref": "indicator--b0b3fc72-17a8-4ebe-8fa2-3f5912912f8f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe008b4e-1caa-43fd-b59e-e6c0cbb18a42", "sighting_of_ref": "indicator--9578d3d8-1713-45ab-a916-150ab03b018f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92abd821-b38e-46b4-a148-f25bdaaad38f", "sighting_of_ref": "indicator--9578d3d8-1713-45ab-a916-150ab03b018f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2825c317-0135-4d90-af59-045d89d90f33", "sighting_of_ref": "indicator--98067a88-dee6-4d5c-b33e-6c2edf477c5c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9324b51b-61c8-4081-a14c-c384005952a1", "sighting_of_ref": "indicator--6edc138a-6d9d-4f76-8446-e0b94ce23653", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7aed0c58-fb92-43b4-b557-8914931a962d", "sighting_of_ref": "indicator--843724b3-4495-48ed-a032-85264ed36f1d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28ea1fae-d35b-46ac-9415-9a873cb117f5", "sighting_of_ref": "indicator--aeee4d98-f364-4533-bd9d-2a18cf4f6afe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--200957b6-3610-4f22-a848-e37c6d10d368", "sighting_of_ref": "indicator--87509892-34c1-4ffb-a439-a1a3a4189273", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61ccca3f-9583-4d69-80b9-311c00ca99ef", "sighting_of_ref": "indicator--599014d4-3bf2-4955-abbe-c1ecdc42a78d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8898fda7-3504-4810-982d-16d419a65af2", "sighting_of_ref": "indicator--599014d4-3bf2-4955-abbe-c1ecdc42a78d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e933ac8a-4148-45ad-8b13-c82c1379d398", "sighting_of_ref": "indicator--0c79cf81-a3e7-4600-99c5-8df3ae3829a4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1029d4a-6889-48d0-bb8f-8d83a4436ebf", "sighting_of_ref": "indicator--1bbe2416-348d-4f55-b494-17c4bae991ff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a1dae5c-2de7-466e-9639-f547f48955c3", "sighting_of_ref": "indicator--1bbe2416-348d-4f55-b494-17c4bae991ff", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be0901f0-f211-4101-b7c1-c410f6813e1a", "sighting_of_ref": "indicator--9608e6ca-99ee-4e26-bc0f-0514d1977a66", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e32d2d65-9a6d-46f7-9511-5fe4bf6ec4bc", "sighting_of_ref": "indicator--9608e6ca-99ee-4e26-bc0f-0514d1977a66", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b758972b-1eb5-4ac6-8e9d-2ae12244daaa", "sighting_of_ref": "indicator--133a4732-6382-4c52-8eec-daeb85214f18", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00ad3b15-acc9-4193-b993-8367c11e964f", "sighting_of_ref": "indicator--133a4732-6382-4c52-8eec-daeb85214f18", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a89b85e2-41e8-4962-a250-fb6171cc7669", "sighting_of_ref": "indicator--4dcd6c52-3661-423e-a89c-14400b48e98f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2ae3eab-db28-4de5-a195-2399a7845c75", "sighting_of_ref": "indicator--0a276c58-cb93-49cb-a2fb-d0517d8fc268", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccf12b13-5730-46c8-8843-8e5e50fcfaa5", "sighting_of_ref": "indicator--751a9ec5-b8a6-4cf1-9117-94050dc8426e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b2bc690-bf1e-4266-926f-f3c980da19d5", "sighting_of_ref": "indicator--eb327247-f249-49a4-be24-fa1f87af2e72", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47af1c15-7a39-48ae-840d-ca74937b9607", "sighting_of_ref": "indicator--eb327247-f249-49a4-be24-fa1f87af2e72", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56e5df93-68ab-4f1f-9394-8abc6ff8a934", "sighting_of_ref": "indicator--77d4d017-cb9b-4b0c-b109-11e278ad1746", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac0665d6-bd8e-42e0-a18d-871b36fed504", "sighting_of_ref": "indicator--3fcb257a-e7e1-42ea-97d4-ea9c017f87bc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f83404b1-c7e9-4ff3-b883-e6ae6781491f", "sighting_of_ref": "indicator--3fcb257a-e7e1-42ea-97d4-ea9c017f87bc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e441a293-e96f-40d0-934b-f425cb36983d", "sighting_of_ref": "indicator--60743b1c-2daf-42c6-960a-fad218b61374", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b96f797-6ba4-4fa5-b5d0-493c9c40a33c", "sighting_of_ref": "indicator--60743b1c-2daf-42c6-960a-fad218b61374", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7118dcdc-79d8-4bb0-ba81-94bde1e29469", "sighting_of_ref": "indicator--2d4b3343-a8a9-460d-aa31-e2877305c039", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19d76a15-4743-4b7c-9b4a-eb055033bfc9", "sighting_of_ref": "indicator--d23b001a-de18-4849-99f6-1cb179ea2b05", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95628b9e-7bd0-4c14-9e16-d0ab555c589c", "sighting_of_ref": "indicator--1baa4622-e27a-4967-8bcc-dc491f0846ad", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--130e77ab-e51c-46a3-b83c-8d7906582b60", "sighting_of_ref": "indicator--9fff9f05-f788-461a-8479-c4bad7dba49f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e184abdf-b88a-4f9c-84bd-9c8a7ca2ea21", "sighting_of_ref": "indicator--41a6aed0-e5e9-413c-a0ec-3c725e246257", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c0c1134-4b94-48a9-b3a9-771ea7105789", "sighting_of_ref": "indicator--53af09eb-f358-4094-a358-3d3518ad7e45", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33f55972-2012-4c1a-b090-0126fe168eaf", "sighting_of_ref": "indicator--53af09eb-f358-4094-a358-3d3518ad7e45", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61e5a224-d269-4b46-9442-1c3c74e2cc17", "sighting_of_ref": "indicator--cd7bc2e8-012f-4f11-bc03-228088afe857", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46ec5497-8f59-4998-84bc-ce586d554510", "sighting_of_ref": "indicator--3219143b-f1a7-42e7-8593-d3c36e582c64", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5b719c0-f0ff-4ce6-83fa-78c98a9aa0c9", "sighting_of_ref": "indicator--03804aaa-ced7-4b7f-bf91-0b0242eac4f5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b8f1427-1540-43c1-bb7b-ba26a4610937", "sighting_of_ref": "indicator--bfbcf3bf-d7b8-49bc-af2f-2dcec66125f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cf35ed3-ea88-4279-8693-78ca175c3d28", "sighting_of_ref": "indicator--24861f7e-1064-4e8f-9b30-b205b5d487b5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88b6c4e2-2f52-4f76-abd3-5536fd7d1cd0", "sighting_of_ref": "indicator--24861f7e-1064-4e8f-9b30-b205b5d487b5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a51dd43d-3491-4bef-bcf2-6dcda2dfe090", "sighting_of_ref": "indicator--f23138d0-14d5-43f1-91b8-62db7e40c8ff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cc47065-d311-4ef7-a212-eb8b92505a61", "sighting_of_ref": "indicator--f23138d0-14d5-43f1-91b8-62db7e40c8ff", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--425a2d8b-89b1-4083-94bd-ec71de83365e", "sighting_of_ref": "indicator--02e1afe3-b314-4eea-99d5-2498f25c1e6e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e30c5784-f3b3-48fa-bc4c-c72bd3f1db37", "sighting_of_ref": "indicator--d999080b-9faa-4466-8bc5-315dee3855bc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d134ae5a-674f-4bfc-ab40-75844a80a73a", "sighting_of_ref": "indicator--b1cd438a-7921-4127-8a1e-8e0d7f1ea9d1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--485e307a-ba22-4ebe-adcf-9771529bb452", "sighting_of_ref": "indicator--b1cd438a-7921-4127-8a1e-8e0d7f1ea9d1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad2d8ce1-98f6-43e1-a4f1-d0053dbacc4d", "sighting_of_ref": "indicator--0e4d45ab-6a3e-4016-9f89-b47713712978", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--174a5a45-3021-44b1-adfc-59d2f2b4adda", "sighting_of_ref": "indicator--513dbedc-b6e1-4845-9e6f-7a4a87fdbb06", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be5bef26-8dd8-4409-a141-ac9781ecf8f9", "sighting_of_ref": "indicator--3c8bc7e0-0f35-45fb-b280-0f5f46c63ff1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be31b063-5a7b-4083-a059-87a3444bb1d1", "sighting_of_ref": "indicator--54d03eed-b264-47f4-9aac-28ef18b4ddf0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d2d084f-6197-44c5-8cda-78ccf0c2fd40", "sighting_of_ref": "indicator--9b96617f-586f-4fc4-9bb1-3afb569f87a3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c913a41-110f-4b69-9bc9-1b5b17070b65", "sighting_of_ref": "indicator--50ce88c1-7ad1-474b-b979-628e3fd2fee0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ca5ef3e-70c0-4bd9-ae83-00ddd3ae43dc", "sighting_of_ref": "indicator--523e80ae-f55e-4e41-b47b-8035ec2779e9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be3aa786-a58f-40c5-8580-d47bc672a1aa", "sighting_of_ref": "indicator--e89e8dd9-6c10-4834-8026-52460fdc3648", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43946395-1795-49ce-9afd-96d59828fe01", "sighting_of_ref": "indicator--cf9c9e15-a5b4-4ea4-8bad-2aeb0d8848fe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d67266aa-9c5e-47af-9f63-090358227ac5", "sighting_of_ref": "indicator--d896ee8a-459b-4d32-9d9d-544af824ad61", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46e0addf-049f-472a-b058-5e00d879c35d", "sighting_of_ref": "indicator--70ac8a77-ec9e-4222-b578-757a8da7f27e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a78ec8d-e31f-4689-923d-c5626b2cf9d5", "sighting_of_ref": "indicator--ab84d0fb-74dc-4a2b-b4a5-fa326bbbf872", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c12d2b0-ed63-4a42-bae4-67413a2df1f6", "sighting_of_ref": "indicator--7c6bc834-c11c-45fa-9c20-1f2bd565df54", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--464da484-f74c-41a1-a155-e699ce784368", "sighting_of_ref": "indicator--b5646e29-fed7-4bbf-b686-3ed8d50618f5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06f750b9-c5f6-4e47-9d3c-f9f6f7bd790d", "sighting_of_ref": "indicator--7e61cd78-293e-4c1c-88cb-59f47797b8d8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8dc783c-173d-4139-9c6f-8fba3872fc25", "sighting_of_ref": "indicator--41955835-d4d7-48c7-bbd0-297a9d4af93a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d0c9f4d-8199-4926-a87c-5fbc447ce3c6", "sighting_of_ref": "indicator--fa798d67-ec63-42b1-8753-4ee0d9dae04f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9140c71-6158-4db4-8607-258f79fe005a", "sighting_of_ref": "indicator--ae5bd777-fcd3-48a9-8ee3-09f0cf113fb3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31cfa286-0b5f-4768-bae9-4d6fabef5755", "sighting_of_ref": "indicator--ae5bd777-fcd3-48a9-8ee3-09f0cf113fb3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da4451cb-3a67-4682-8dee-2ed75480b2d8", "sighting_of_ref": "indicator--40fc361c-3e91-4f2d-b65a-5d007b321ee9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b02f9176-3871-4dc0-8f0e-b154e88be958", "sighting_of_ref": "indicator--0e33402a-c558-4eb5-a8ce-37a1eba49881", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9fcebe0-ccdb-42ff-8e5a-c6f786c9cc67", "sighting_of_ref": "indicator--0e33402a-c558-4eb5-a8ce-37a1eba49881", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e400a794-14b7-46e4-84d3-440f7df73dc7", "sighting_of_ref": "indicator--e712118c-10bd-4a5f-8877-51a34e62e21e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--149d5311-e417-4808-8226-59343d2ff15e", "sighting_of_ref": "indicator--917274a6-9ceb-444b-9242-e39fd8e95135", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--883f384e-fcef-481f-8af1-5f5a68269fbf", "sighting_of_ref": "indicator--9d302d33-bace-4702-a494-95a556936632", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92485955-006c-4257-9287-13cd1f5b19bd", "sighting_of_ref": "indicator--9d302d33-bace-4702-a494-95a556936632", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9688d9cc-abdb-4662-a74e-19749c296249", "sighting_of_ref": "indicator--eab5b599-bdc1-403e-9047-cae615c5eac3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--654ebfe9-9c75-4b6a-af75-0e00d3ee5669", "sighting_of_ref": "indicator--9f6f6e60-c6bc-42ec-b8de-d61d9d3abdab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae3241eb-9e32-4438-8e9c-595bb21f965b", "sighting_of_ref": "indicator--9f6f6e60-c6bc-42ec-b8de-d61d9d3abdab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9b1e0f5-3894-4ce6-b49e-cb3eed5750cc", "sighting_of_ref": "indicator--da89f3ca-e521-493b-8b69-72fbe3aca1b7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c6ed401-a17c-4dcd-935e-c43127fd59b1", "sighting_of_ref": "indicator--a7e8e67a-a16f-4ac2-8e12-01b460511b03", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ddfaac2-cd44-4867-a6e2-9aae013c8378", "sighting_of_ref": "indicator--31b9906b-35c2-4829-977d-a4b58f85a683", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24c19e0e-9829-4ae7-ad24-f25b9fce6a71", "sighting_of_ref": "indicator--31b9906b-35c2-4829-977d-a4b58f85a683", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75fdaf16-0be6-4a66-85e7-3d7837891b8b", "sighting_of_ref": "indicator--10070b8c-10b6-4eb2-89d6-e50dc3544f2d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--123082d2-83c8-4a02-9593-37b345f45c19", "sighting_of_ref": "indicator--754c4ee3-e7f7-40db-9929-edf7e9892c21", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08dc9966-3932-4abc-adf7-9ca35a5d494a", "sighting_of_ref": "indicator--d97f4556-bd8d-4fef-be43-f1aba7e5b0c0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--601e26ea-1fc4-484c-9704-8d4f1568512c", "sighting_of_ref": "indicator--c66b168e-7aa4-4a7a-91a3-80a0e2b96e62", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5ad9d91-470f-4664-9846-ed9b06c6d21a", "sighting_of_ref": "indicator--c66b168e-7aa4-4a7a-91a3-80a0e2b96e62", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c1eccfb-665b-48ef-83c0-750cfa7c0083", "sighting_of_ref": "indicator--342ef8fa-b1ab-44cc-80bb-d91bd92471fc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a819f3a0-ca09-4e72-bc3c-a8bac50e687c", "sighting_of_ref": "indicator--342ef8fa-b1ab-44cc-80bb-d91bd92471fc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26ccbe25-17a6-4f4c-b9aa-7d6443be37c8", "sighting_of_ref": "indicator--c2233e6d-5060-477a-adee-77241dd902d1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8a362a4-e767-4c1f-a2d5-8853963cee56", "sighting_of_ref": "indicator--9c51de8d-05bd-455a-a33b-6467d3f20f3f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f289f1d-e30c-4229-8b1c-35d6b3f4efef", "sighting_of_ref": "indicator--9c51de8d-05bd-455a-a33b-6467d3f20f3f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0b3e3a5-b58b-4c39-8402-d010e7141d83", "sighting_of_ref": "indicator--f614eddc-8308-4e02-adaf-902937df49da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd64755e-b0df-4711-b470-4ce3c1ed807b", "sighting_of_ref": "indicator--f614eddc-8308-4e02-adaf-902937df49da", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f053c610-d92f-4a15-baca-30ad91fed2f8", "sighting_of_ref": "indicator--87afb8de-de13-43bc-adbd-1985381a6b6b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7988c4ca-d581-4635-a2c0-223d029c09cc", "sighting_of_ref": "indicator--87afb8de-de13-43bc-adbd-1985381a6b6b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80cefe01-5e40-441e-b2b5-23966472da05", "sighting_of_ref": "indicator--f45351d3-0972-44db-930f-fceb8b548b0e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--906189b8-a8e1-4b17-9656-75c48275f802", "sighting_of_ref": "indicator--a6b83732-f571-4aea-8bf5-ab779b4c5964", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4de5df9-2b6b-4741-86f6-6f0b633c512b", "sighting_of_ref": "indicator--605a51a6-8c31-496a-8fbd-4625b0e06a14", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89190dd9-998a-4921-b625-a83ae7c256c6", "sighting_of_ref": "indicator--605a51a6-8c31-496a-8fbd-4625b0e06a14", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf8376d0-29a2-44b7-952a-86cc8de54402", "sighting_of_ref": "indicator--ffc71a2c-0e75-4554-82b3-42d5a970e744", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b12497a-8976-416a-b957-a0fb7d53b21a", "sighting_of_ref": "indicator--8f22b78b-b527-4b0f-9574-4f39b8109add", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5d5fe2b-ac9e-4d1b-93b2-5f334fe579b0", "sighting_of_ref": "indicator--34ca1dd3-a8cf-4e14-8193-ec240c284c4a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5111b938-5248-4a8a-b545-f6c8d3f3c588", "sighting_of_ref": "indicator--34ca1dd3-a8cf-4e14-8193-ec240c284c4a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84104ef5-a735-4ca0-a0bb-029b8a46e1b8", "sighting_of_ref": "indicator--d1d6dea7-b2c5-41ec-9006-9feead86a672", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd0a36ff-68e8-437e-a17f-d450cfb65f4b", "sighting_of_ref": "indicator--d1d6dea7-b2c5-41ec-9006-9feead86a672", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4afb5f07-6316-47fe-85cf-6a023a1ebdfd", "sighting_of_ref": "indicator--9131e09d-8ee9-4f80-a1c0-bd89d6dcb147", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c90c96d3-d100-45bc-a129-634c6008b04f", "sighting_of_ref": "indicator--3c6c59e9-3bab-4590-8069-cba0179b8c73", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88522e7a-ba08-4b90-8938-8c175a5708da", "sighting_of_ref": "indicator--3c6c59e9-3bab-4590-8069-cba0179b8c73", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96fea3ad-dbb4-4d55-9da0-bccea140c386", "sighting_of_ref": "indicator--e9a27718-4b86-433a-9ed2-97480dfc1bce", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73214a90-407b-41b0-8128-1fc056392216", "sighting_of_ref": "indicator--f6bdc915-e1a1-46f8-8908-4863990bb918", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6febf4a-fd33-4209-b4c7-57c5a7d039ad", "sighting_of_ref": "indicator--479aca0e-b286-427a-8839-a38d99701e46", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5585b95-a871-4576-b571-5b45755a9fd1", "sighting_of_ref": "indicator--e12dae2b-f18a-458c-a333-6ac9fec5b13a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18c3c0a4-204b-4bea-984c-1ff589ad29d6", "sighting_of_ref": "indicator--e12dae2b-f18a-458c-a333-6ac9fec5b13a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08fcfac6-e992-483b-959c-ec3bad86fdf9", "sighting_of_ref": "indicator--ad25017e-c06f-47c9-b676-34b3f87c99c3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87e6fadf-2031-4c63-8a52-13b45fedd3d4", "sighting_of_ref": "indicator--fd8c8808-69fd-4f4d-b65f-7bf6ed817660", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba1809ac-5380-495a-bd68-95a3052ebf2e", "sighting_of_ref": "indicator--d7cba386-c8ae-47b7-a3ec-b7155eeac817", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12be5448-6fb9-4ab9-b517-957dc9121381", "sighting_of_ref": "indicator--d7cba386-c8ae-47b7-a3ec-b7155eeac817", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2841ae0f-190c-413b-b78c-23f6de23df5a", "sighting_of_ref": "indicator--28fe7e7d-d613-4ab2-9411-58fa38336bc2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7d65a41-4750-4e3b-af20-1031a2ab9a4d", "sighting_of_ref": "indicator--28fe7e7d-d613-4ab2-9411-58fa38336bc2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9f24e92-3b9d-4e53-be52-eaa82231c88f", "sighting_of_ref": "indicator--cff08035-5e24-4b8a-8410-ebe296f145e8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85a738c7-92c2-46b9-960c-151cfba07166", "sighting_of_ref": "indicator--e40d187e-3014-4701-b9af-ddbcd08aa91b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4bffd75-27aa-4953-b092-df5d67b026c6", "sighting_of_ref": "indicator--1366f371-3d79-447b-94bb-fb71813c52fa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e7da093-7801-4578-953e-cc61ed96fd41", "sighting_of_ref": "indicator--1366f371-3d79-447b-94bb-fb71813c52fa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37857abe-c3a0-4d9b-a3af-b01f6c2a7eef", "sighting_of_ref": "indicator--01252741-717b-4c1e-963c-e716a141c177", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a340d478-d6eb-4469-9b2c-3cdb0c01383f", "sighting_of_ref": "indicator--42b6c27b-5f4a-4006-804f-b0da711f3406", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcfe74ac-f86f-40d8-869d-e908611be77c", "sighting_of_ref": "indicator--42b6c27b-5f4a-4006-804f-b0da711f3406", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47fbd4a0-ab0a-4552-98bf-8d48a89ba5ef", "sighting_of_ref": "indicator--96527b9d-3659-42dd-b2d2-c93f3ef7de0f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b10080e-6779-4a80-b3e6-6f06d55a9444", "sighting_of_ref": "indicator--65eb343a-dfa6-4420-ae6b-fef0f0302038", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--777be6b6-8344-4112-ac43-05c88c590360", "sighting_of_ref": "indicator--65eb343a-dfa6-4420-ae6b-fef0f0302038", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e322669-cbc8-4dd8-a9aa-19469d0e948a", "sighting_of_ref": "indicator--e1eb5dba-15a4-408e-9ea0-bdd880d180cc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c75b1d6c-df32-4d71-876b-1f8ad658107f", "sighting_of_ref": "indicator--ee436102-83b6-44ee-9646-df31143e9958", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--046598a6-3abd-49ea-904a-a09e3e4b10e5", "sighting_of_ref": "indicator--fbe9a0e9-b548-4abc-8ce1-3ff81e9d53d2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bee458d0-8fea-4b08-9cf9-e5c88e3d8fee", "sighting_of_ref": "indicator--9aaa79b3-065d-4c79-8e10-e1fb49ed725d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bcfd6dd-1b0d-4e78-9052-b89379b920c9", "sighting_of_ref": "indicator--9aaa79b3-065d-4c79-8e10-e1fb49ed725d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43bd645d-4a12-48b3-b636-2acdfbe88c64", "sighting_of_ref": "indicator--f4fcbd00-2c8d-4a1d-9738-d2ee012987e3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59dbe031-a0e2-4526-ad93-00d177017e73", "sighting_of_ref": "indicator--fcd7afde-8a24-48da-a2d8-41ee11ae068c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3730ef71-a5b7-4cb0-b8cd-5d7659289baf", "sighting_of_ref": "indicator--0ce2a340-3683-4c01-86ac-1e6c6910e28b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a7cd592-17f7-43a9-b0cc-30e4f8f48852", "sighting_of_ref": "indicator--9c022d5c-9a37-4ad1-9162-03c4ac7f42ae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d08c812-a4b3-4b6e-b954-81cdb84e574d", "sighting_of_ref": "indicator--9c022d5c-9a37-4ad1-9162-03c4ac7f42ae", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c70877e-83cc-407a-aa0e-696d508c71a0", "sighting_of_ref": "indicator--2b3166f8-9f6b-474d-a8bb-3ab91c52d739", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4774a18-285a-44b6-bb5c-c0921be3d507", "sighting_of_ref": "indicator--cd6fe63e-3e4c-435f-873e-d186471a78ef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc05c0e7-2aff-432d-897f-7e9c35e6e7e8", "sighting_of_ref": "indicator--cd6fe63e-3e4c-435f-873e-d186471a78ef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdf9a454-ee5e-4ea0-ae33-d059b9840363", "sighting_of_ref": "indicator--02d91e58-4a9b-44d4-ad5e-ca27eee6f6ae", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa35192a-3b2e-4c5f-92c8-b03015a48df5", "sighting_of_ref": "indicator--90e79a32-5e9f-45bd-9858-88bb5ca8c467", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f96212fb-4d5b-4810-be5d-9f02848ae3c8", "sighting_of_ref": "indicator--90e79a32-5e9f-45bd-9858-88bb5ca8c467", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--337930f3-9d8f-4a19-97a4-a6813ac9816e", "sighting_of_ref": "indicator--96652afa-ff95-4962-ba50-12f4c240e7e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81809e7f-27b9-4f1d-ae26-b524b5a53e0c", "sighting_of_ref": "indicator--926e6209-aee2-472c-8a0b-9cf2d92c9671", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ec3240e-e9db-4faf-85a5-6e335602fd8f", "sighting_of_ref": "indicator--ec0e1ea2-4b59-4fe7-be1a-56337338456d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0e3258d-a69a-4402-9c4b-d62c20f52560", "sighting_of_ref": "indicator--f64e57bc-d564-4fe0-b3a0-4738f05b5cb7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29e7296d-f99c-440d-a0bd-b7fa38aba1dc", "sighting_of_ref": "indicator--402d3f6c-388e-4066-80f0-58e5b29aa531", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab173faf-64c5-4a45-bd7b-b84d02237130", "sighting_of_ref": "indicator--41ede246-000d-4c2f-a1a0-4d21189d0169", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7142c462-b2a5-4477-8141-1aed772bd16d", "sighting_of_ref": "indicator--289a6f8f-ea40-4f0c-85cd-0e53a9aeee22", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb39cd92-5442-4d56-b3e4-6dd511c0ea26", "sighting_of_ref": "indicator--031f9fb7-418f-4401-b270-482b4a755f76", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f693a16f-8519-4a07-9761-85b7c596939d", "sighting_of_ref": "indicator--031f9fb7-418f-4401-b270-482b4a755f76", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5ae0cbf-97f9-4a43-a740-e9814c8f5e03", "sighting_of_ref": "indicator--e8688b43-8ce6-4dc1-9883-5b0f096c041c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a07c888-17bb-45ec-aa96-ae30321a608b", "sighting_of_ref": "indicator--c2eb55ce-2970-4516-b541-d281c1e640b9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b379d71c-0520-4e10-855e-38a358a0b1eb", "sighting_of_ref": "indicator--4a4920b2-7149-4d01-8136-45f9b6088017", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3a2e9fa-c7ec-48bf-8c08-02f96f6df083", "sighting_of_ref": "indicator--bd200721-03db-48e3-a5dc-0bc101a91bcc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b335a3d-0e7c-4c63-b505-16efaea23c1d", "sighting_of_ref": "indicator--5f403dd2-773a-46f9-97c4-c17301214be7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4133cc05-458c-4b1e-8bf3-a318860807a0", "sighting_of_ref": "indicator--0ad78fb2-aa41-49f6-95b8-e3f3b932c661", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de94244c-b79f-4c81-a7f8-ce60a301725c", "sighting_of_ref": "indicator--31af087a-f6eb-4ba5-854d-d0051fd542d1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b60d2cb1-631c-4493-937c-97c0c75438c4", "sighting_of_ref": "indicator--964aae71-af0b-438f-9066-3385de7a1726", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c437935-bd8d-4d04-8aa4-5fc6005de507", "sighting_of_ref": "indicator--964aae71-af0b-438f-9066-3385de7a1726", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a1cfbfb-d501-470c-aa33-55a14b63879a", "sighting_of_ref": "indicator--5c31aca8-35bc-479e-a6cb-2f30f1c78fd7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--513412c5-b609-4a7c-8a31-eeec56f7ccd2", "sighting_of_ref": "indicator--5c31aca8-35bc-479e-a6cb-2f30f1c78fd7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdd1a73c-31a7-4f1e-b9d7-ae2d9284e125", "sighting_of_ref": "indicator--c1037b98-ba45-4528-b24d-4a62997327bb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78026786-d3f2-487c-9ea3-6aaf47f7381c", "sighting_of_ref": "indicator--c1037b98-ba45-4528-b24d-4a62997327bb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dd7d53d-119c-4b50-a592-1fd9febbe18f", "sighting_of_ref": "indicator--f8272210-ab62-419f-ad3a-f2bd71923bd5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fd270d4-307a-4221-be79-7689c80b4d57", "sighting_of_ref": "indicator--775ce7b7-7024-4b91-a3e7-109b021668c1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a2e117e-9f67-499e-a5fe-9566de979c63", "sighting_of_ref": "indicator--60a5f649-acde-4d95-9bf0-9a372887c03d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68a61cbb-ac8f-4fe6-9522-71899b2aa3e9", "sighting_of_ref": "indicator--cd33a932-ecd8-4038-87b3-fcba84366b90", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b56132b9-742d-49ad-addf-2bd86e6cc0a5", "sighting_of_ref": "indicator--0a6cf6ce-b849-498b-b815-b1a982ae4616", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f23ce8eb-91a4-4060-a62c-04889df17776", "sighting_of_ref": "indicator--d64da7bd-76fa-4611-8a37-7434c988f23d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--890248ab-5799-495b-92d7-0b24d309f5a6", "sighting_of_ref": "indicator--054521bd-b3aa-4842-a581-934c63871e0b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61f59384-e9f1-4167-b0e1-a69367a13d5e", "sighting_of_ref": "indicator--6e37d365-a2cc-4a10-b857-507dd5180bf4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2b18a06-1239-4e91-9683-804a5ad48ee1", "sighting_of_ref": "indicator--6eddd32e-ede6-49e1-807f-67ce5d8056bc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--225c1935-a894-47d2-b3f9-f6ad87472836", "sighting_of_ref": "indicator--6eddd32e-ede6-49e1-807f-67ce5d8056bc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c31f6b22-1cf0-4ed0-9f38-1947b2de585a", "sighting_of_ref": "indicator--cef46242-3644-44c7-a24c-c5c4e4bcd631", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcb6cc50-51b2-473b-abd7-7cff65813d0b", "sighting_of_ref": "indicator--1166822e-b3e8-4583-bf77-3ee1c3abec12", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83335874-2770-4c2d-9063-8cea065e05fe", "sighting_of_ref": "indicator--52765507-d6e3-4ff5-bf95-76d572d2149b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--811f68e7-7077-43ed-bb8f-bdfade99f5dd", "sighting_of_ref": "indicator--9f9f107c-6825-4dd1-97ba-4e12b942d1a2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a718de4-08fe-4595-b61a-d55dd38aa802", "sighting_of_ref": "indicator--9f9f107c-6825-4dd1-97ba-4e12b942d1a2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24e60297-31b5-4ecd-86dc-384297caf8f5", "sighting_of_ref": "indicator--28aaab57-d5d9-4cc6-8888-a21f82f4a0b1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9219c3c0-d757-422b-b8f3-d8c33cf84b73", "sighting_of_ref": "indicator--8422205b-4ad5-4bd1-835a-e5466e6a5b63", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09b979ed-1576-43af-9320-bc30221dfb3a", "sighting_of_ref": "indicator--349c11c2-2e55-43df-b510-8e62505df2ae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b72223df-b31d-4c3e-a502-32157babf4d1", "sighting_of_ref": "indicator--7407e673-0238-4959-8233-b71d8ae58907", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ce2863e-c74e-42cf-a49d-054fc5242c5f", "sighting_of_ref": "indicator--6fd480fb-c0cb-4f24-a184-0428a6e10c32", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e936cf5f-eb05-4348-81cf-f59dc55f3049", "sighting_of_ref": "indicator--9e8c0bb6-87d3-41a5-b7a0-c253392b7305", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb2fc8c3-b990-429b-9826-3b9a84c29855", "sighting_of_ref": "indicator--d385d36e-2545-4715-998b-f522776287bb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcef4132-3b9e-403b-9b97-7b49da7f4d66", "sighting_of_ref": "indicator--c59aa6c1-78ab-4338-b903-a3ee920bfa7c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d55a487a-4b7e-45b8-89fd-e294753c7dff", "sighting_of_ref": "indicator--410400a9-541b-41cc-8d8a-f163bfdca8b8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc2579c1-6599-45ee-a19f-b34b97e0d9d1", "sighting_of_ref": "indicator--4d8f38e3-f647-44f0-a6dd-8d8e355c3829", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51b50d1c-0d7d-43ae-a588-d1143b70de78", "sighting_of_ref": "indicator--01066766-9441-495a-a88a-f426c28248be", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3276e24e-25d8-405c-b4f5-1afb8c20d28d", "sighting_of_ref": "indicator--5123672e-6e62-433d-a5f5-3363a3a2a081", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2aea04a5-52de-48af-97bb-9f7d068fca5f", "sighting_of_ref": "indicator--397ae289-5129-44be-8b9e-5d347353cf97", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaa28c9e-ad9a-4634-897b-143999458f05", "sighting_of_ref": "indicator--0b4d69f9-44e1-4465-a5bf-94ba9c557a74", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cb819be-b2d0-4f1f-9a52-1f7bc433aa8c", "sighting_of_ref": "indicator--43949f1e-e83f-42f1-a53d-57ab939201dd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af24d99a-8561-4f25-bc78-41615dfa928a", "sighting_of_ref": "indicator--6fd0afa1-214b-4dfe-bf14-ac7a0f310b6f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41195ece-b56e-4c38-b30d-c787ab128144", "sighting_of_ref": "indicator--064145ee-8cc4-49f5-9d83-8640332a4380", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf176e45-c42d-4701-b448-066b644fba00", "sighting_of_ref": "indicator--f57616c8-e27f-4fda-82df-65747a694780", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afc16a72-0309-4c0a-a5cf-c32985857d43", "sighting_of_ref": "indicator--1e8cbbc1-fb8e-4423-8fce-e8bb226712fb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90128f48-a444-4aed-bb1d-47ce5921f9ae", "sighting_of_ref": "indicator--47327190-8cb4-4673-91b6-84c32061be6b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--222d4d73-6cf2-46fb-bc31-77de58a89e1c", "sighting_of_ref": "indicator--93268d59-b69c-435d-82a0-fdb879bc7032", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--856f6496-280d-41bc-9927-c67a324ff185", "sighting_of_ref": "indicator--9c02e49a-69da-4ffe-9582-6519003f237f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6cd2913-2225-4470-b3dd-bd30508f991c", "sighting_of_ref": "indicator--5f8ef5b5-3c2f-40c6-98bd-1d435afc3f54", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db779f94-4b69-4872-84ea-76f5bd781a30", "sighting_of_ref": "indicator--6f98c9a2-9f68-43c4-a884-58dae228132a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17740e3a-4f77-45b7-935d-7ede2b2b1406", "sighting_of_ref": "indicator--ace1589c-8c24-4db9-865b-d500767d191b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a061c4a7-4db1-46fb-8376-dec3d9ef4e4d", "sighting_of_ref": "indicator--ace1589c-8c24-4db9-865b-d500767d191b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a778318-4b45-495b-95ef-cda140ced642", "sighting_of_ref": "indicator--e745e4f9-1126-4f4d-b85e-896eacbd3413", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--256ce2b2-2689-4cb4-adea-3acee067bfbf", "sighting_of_ref": "indicator--ae6f1b65-6e30-475d-a3ee-d8e42b7898ae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51a82e15-43f0-43a1-a901-3e00ef28e844", "sighting_of_ref": "indicator--ae6f1b65-6e30-475d-a3ee-d8e42b7898ae", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c42c849d-643e-4973-bfbd-e9d11494cee2", "sighting_of_ref": "indicator--3535bfde-ca10-4eb8-88a3-f36c51a6f4fa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33ab1025-aa3b-4b9f-aa23-1640770cf5af", "sighting_of_ref": "indicator--3535bfde-ca10-4eb8-88a3-f36c51a6f4fa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ffbe35d-0fc3-4c61-8665-d63efd3086a7", "sighting_of_ref": "indicator--53ca20fe-6e95-4d0a-b179-3bcafa02542a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79c8ab3a-30d0-4526-9135-88996616a581", "sighting_of_ref": "indicator--c034a02b-ea4e-4efb-9f68-a61d48b45fdd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5f86ad3-48ba-4746-b646-582ee7ee6842", "sighting_of_ref": "indicator--c034a02b-ea4e-4efb-9f68-a61d48b45fdd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0383ca60-01cb-4062-bddb-f53d6fbe26ee", "sighting_of_ref": "indicator--62cb9289-4c2f-4c57-b4fb-5ebb198fb7bf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0593c032-156d-4396-852b-1c9d5d528087", "sighting_of_ref": "indicator--fa8cf68b-6cd7-42bd-ac3f-727febe4b5be", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11c02a53-8d9b-4237-828b-f5f695d8bb50", "sighting_of_ref": "indicator--faa12910-74b8-48ef-8399-ede037fd08e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53865ba3-65bc-4e18-8ccc-89dd448d43ae", "sighting_of_ref": "indicator--2bed7c1c-0d1a-4948-82ee-20147b7198eb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95a9d828-d17a-4c9e-90e9-11bb24d0e0a6", "sighting_of_ref": "indicator--d8dc53e3-96ff-4e67-b605-514a226d532e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--124ba6e8-8f81-4b20-bb67-6468629a98be", "sighting_of_ref": "indicator--4242518f-270f-4c35-8e43-13b9307b66a1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08aced29-6b4d-45b4-ae0a-9ce99310292c", "sighting_of_ref": "indicator--14b6a5d2-6959-4745-b365-26442a3bdb7a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9a26909-d33b-430c-afb9-c4423a8c31b2", "sighting_of_ref": "indicator--14b6a5d2-6959-4745-b365-26442a3bdb7a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f38a3804-5997-4bfb-a70c-cdb117fae194", "sighting_of_ref": "indicator--549c7f65-681e-4ba4-be51-b20f6de42e87", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92e84be2-31dc-4b26-be0c-b5baf3c8581f", "sighting_of_ref": "indicator--d7839b77-f9c8-4f11-8512-47bcb9260956", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0764f79-2808-4343-8e0d-2e8ced5019e0", "sighting_of_ref": "indicator--63e6524c-f674-4571-8979-afea2cab87ef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c45e082-a90b-4084-a330-494aeb26b35c", "sighting_of_ref": "indicator--ea5fadf4-3777-46ad-82c1-8d200917f4bf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cb030de-4ff0-46e4-aff8-fd0dcb8dccdf", "sighting_of_ref": "indicator--2a8496c2-df16-4361-a863-e7ce33f82cd0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--621b619c-f55b-476f-b800-807df09bd336", "sighting_of_ref": "indicator--b170d883-dba7-4210-a974-f3077ff3d8a2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d227a75-e9d4-46c1-9775-2d461d924500", "sighting_of_ref": "indicator--75580cdf-dc28-441d-9458-8faf42efbb3d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ccf7367-0f85-4908-9a02-7a0ffb9999b3", "sighting_of_ref": "indicator--92d2e21f-e92c-41a8-9d0e-efcb64509df0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edd3e411-7341-4246-9d5f-c603aeb3e24c", "sighting_of_ref": "indicator--9368e0f3-e170-4b04-99e7-86db8af76047", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eac0d3a-ba21-4b3c-a588-d3359525089d", "sighting_of_ref": "indicator--dce8fdf6-609a-4900-991c-fcc154f3c0c4", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02d886c6-c55d-4377-8d0d-b9a8a24e4cef", "sighting_of_ref": "indicator--fc8c77ec-f0e9-4ab2-bf34-c3f84e4ebec4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a61cf1f4-ceb1-4fa9-938f-e767bd54026d", "sighting_of_ref": "indicator--fc8c77ec-f0e9-4ab2-bf34-c3f84e4ebec4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09e085e5-833c-46b0-8424-7ed060361d43", "sighting_of_ref": "indicator--22bde52f-82b4-411f-96c6-455bddbd99a6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28c919ef-637e-418e-ac01-aa0522e65da4", "sighting_of_ref": "indicator--fab5e6b0-fc46-4d57-be41-6619ae1cd32d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bd1be5d-1ad7-47ef-8f20-563095112e1f", "sighting_of_ref": "indicator--5e37c655-95bd-431a-ac31-158a9137e72a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2085aac9-ee4b-42ef-87a3-d6a8b9346d43", "sighting_of_ref": "indicator--5d27ea0e-50e5-44cb-9f15-335ac1c88eb8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7515594b-9e46-4af1-8577-216132fb4606", "sighting_of_ref": "indicator--505019a0-5c67-4951-b738-f311d3dee3c7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--268b7b6b-f525-4336-9bc4-ec852684eb4b", "sighting_of_ref": "indicator--aae3b8a5-48be-4813-b827-34cb903d37aa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d73b0442-5ae0-4975-a195-a605eb96875b", "sighting_of_ref": "indicator--8e0a6700-4790-4529-9e25-e2cc3be6ede6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--287d0745-649c-471f-b504-da175e986233", "sighting_of_ref": "indicator--f7005f96-42a6-4155-80c4-41d498c3e114", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08b0123a-02ff-4195-a742-8c19d3f4a553", "sighting_of_ref": "indicator--bab758a4-a459-444b-be80-0802d5302fe2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9a6cb0a-f38f-4937-8fa0-c172c0c49dfa", "sighting_of_ref": "indicator--ebc39698-9158-4836-9d79-00e0416621f2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--477a77a8-5cf5-4720-a35c-37c99a6184df", "sighting_of_ref": "indicator--19d7d394-e989-49ff-bfe0-cd45f3448fce", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1aafd784-f148-427b-ab4e-ce8895da0c65", "sighting_of_ref": "indicator--ab48ad95-275d-4579-9a1c-9ee0fd2fa41b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c1cfb26-50e0-4468-976e-c288c40a5745", "sighting_of_ref": "indicator--d3e53006-70a5-414e-88c0-f203121fc4f0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--793e83b6-12be-4ddd-b6ca-2ef0065a29e1", "sighting_of_ref": "indicator--dcee0719-368c-4afe-a226-7192800a8f60", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d46cf699-e91f-4945-a4b9-302ec87849dd", "sighting_of_ref": "indicator--9dfcd3bd-ebe4-4eb8-aa36-52217f6d3016", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d771a51-9b20-4c07-ba65-7fd7ec36a366", "sighting_of_ref": "indicator--11b75a33-95da-4ea3-be2f-6aba6669e9ea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f1f117d-4ef4-4da3-a84d-4d7bc0a46b60", "sighting_of_ref": "indicator--11b75a33-95da-4ea3-be2f-6aba6669e9ea", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7937103-7d7e-4d95-89bb-e28123ea4b4b", "sighting_of_ref": "indicator--e8a50f41-ce89-421d-8fe3-c7a77a3b31d7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c270c1e8-77f0-430b-9957-e649cf6cb702", "sighting_of_ref": "indicator--0aa42523-7b5e-4d4b-b194-652951932464", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd4ad8e3-a1cf-43be-885b-04e799b6133f", "sighting_of_ref": "indicator--2bde6a92-b639-4f34-ab3c-cf809682b379", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32e36e82-39f5-49cb-b4af-f66be2af4707", "sighting_of_ref": "indicator--2bde6a92-b639-4f34-ab3c-cf809682b379", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f07eccb-6e33-47b7-8bf0-b562c4841768", "sighting_of_ref": "indicator--960338f0-0c85-44f7-b99a-e8c04f110636", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e27f2ee6-6c77-460a-8059-24091fe9751c", "sighting_of_ref": "indicator--bd3bcfe2-9de6-4d0c-8077-fed935621d80", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aff84f60-4e97-4833-a6f0-e47053c353b0", "sighting_of_ref": "indicator--bd3bcfe2-9de6-4d0c-8077-fed935621d80", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea6ea098-0131-4905-8d22-2f24f6f0e319", "sighting_of_ref": "indicator--46d32190-6407-4199-abbf-8d66109526fa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cbbc85f-a4e2-4c14-9e18-59608a23d333", "sighting_of_ref": "indicator--26705b04-c2a0-4cbb-81b3-84625b8cdc41", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bc997e4-8a00-42b2-b5c7-f2b4eeb777b4", "sighting_of_ref": "indicator--0c24a30a-04ea-44e7-8bc4-eed274e79915", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52564533-c2a9-418b-bdaa-b8f6e6cad483", "sighting_of_ref": "indicator--01ab3940-29a3-4e10-abe3-6e0b7eb32864", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2953d0cd-e1cc-41a3-b610-b5cdbe956196", "sighting_of_ref": "indicator--c201762a-e6c1-491b-bf0e-e8ad081f1e49", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa5a8ffe-0399-40fe-afc5-bcbfa70e97c2", "sighting_of_ref": "indicator--9d12da18-529a-4f3f-a281-2ad637a27fb7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b00174b6-ef83-4281-bf87-b9a92a26f775", "sighting_of_ref": "indicator--b71ea942-a743-412f-95b6-e6cd51f0d0e3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0176090-53ee-4957-8fe9-6bc93e9e74e8", "sighting_of_ref": "indicator--b6efbcc9-348b-40e3-9b1b-7d030ba4c831", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f913185a-e490-4c7d-87f8-6eb728f8493e", "sighting_of_ref": "indicator--bbe41ba0-650c-4d7a-baab-5f7ffa355c8e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ce0a354-e208-4e1c-9b2d-4d50590a99a4", "sighting_of_ref": "indicator--15379822-4cf7-4e82-8c88-9e133d89233e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80a02ea9-780d-4af7-b233-0b39997ad502", "sighting_of_ref": "indicator--605024d6-d189-4feb-9bc6-084ff126286f", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4ee7def-5798-4403-8818-324b65acfbfc", "sighting_of_ref": "indicator--605024d6-d189-4feb-9bc6-084ff126286f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06d526db-ed32-4f75-bfc4-8e84ca06ab2b", "sighting_of_ref": "indicator--ee4fe639-6274-482c-b97d-7acfeadf0e1b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afc02bc0-1118-4ed2-8c64-0a8e1d4b650a", "sighting_of_ref": "indicator--33a9ba37-0a53-4c6c-8589-70faf491f757", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ef015a1-efd0-4126-9690-71a4b27b378a", "sighting_of_ref": "indicator--2cb8cdfc-f32c-44b0-96f3-920b107afab8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75851065-49dc-47c2-a788-086777265d47", "sighting_of_ref": "indicator--fde86eda-5eef-4f60-90b5-a14a3b0abf7a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6311be3c-62ba-4618-b7aa-eaeb79272514", "sighting_of_ref": "indicator--a0f51291-b324-453d-a157-005d3aa2a223", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b963304-3c9e-4254-be1f-ce742395e030", "sighting_of_ref": "indicator--35fbed7b-a11c-4346-bffe-11a609c0aeba", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a50d4ffe-25d0-4051-8369-51f6cb4ebf8b", "sighting_of_ref": "indicator--fa9663b7-55cc-4243-a25c-659ec0a99083", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf9f364b-be77-408f-ae70-65b3ce004c54", "sighting_of_ref": "indicator--f511dbfa-300b-4352-be92-56aa2f3561b5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--225cbb90-1bf9-4f06-b9a4-6171a9a0762b", "sighting_of_ref": "indicator--b8737379-9f0d-4035-bdee-f82f4e072baf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72b9be95-8c9c-4610-b117-dd5b0f76e408", "sighting_of_ref": "indicator--175b58f8-1399-438e-9854-93ef247fbfa0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1f5e562-b828-4dac-a1ab-842ed3dfbfe0", "sighting_of_ref": "indicator--1d569b77-e74b-41e0-b64e-8f788beac866", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d1e4eea-7505-4038-80da-f3599a260fc1", "sighting_of_ref": "indicator--40f9ea67-4589-424e-a10b-46c3ce0f935e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcaa4ead-fa0c-45ea-adfc-59db742a0467", "sighting_of_ref": "indicator--003ca04b-4ca3-48eb-9bbf-e9dedfca9cd3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a22c0d34-ba1e-4d1a-97b6-8790e8899f84", "sighting_of_ref": "indicator--334603dd-0ac8-4960-9df2-cfacc1626593", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1245b6fa-1fbb-4f20-a2a8-3456321b43bf", "sighting_of_ref": "indicator--334603dd-0ac8-4960-9df2-cfacc1626593", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af962263-cd92-4ea7-9895-27a9fe7de782", "sighting_of_ref": "indicator--4085b931-ded2-4cb2-848e-cb64f9fdc122", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d8758b5-b452-41a4-acf7-488d044687e5", "sighting_of_ref": "indicator--c7935f35-543c-4361-9f2a-fea09a523c8c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a92ffa45-3271-4f5c-ae64-fb63a558ccc6", "sighting_of_ref": "indicator--2c2bb150-b37f-4265-bfe0-a298588a5050", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32679df9-479c-41f9-adbe-a6928306f293", "sighting_of_ref": "indicator--2c2bb150-b37f-4265-bfe0-a298588a5050", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dd1a1d1-92a4-48e4-98b1-0fb72e9bacb1", "sighting_of_ref": "indicator--932c2131-bc77-4460-8aaf-3d38dbf58a3d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--971ba32d-58db-4512-8127-32f3ec6af12c", "sighting_of_ref": "indicator--3fe13186-1f4a-4084-a150-b4f0474d9a1c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88174409-8e0d-44fe-8b05-7094c3074c98", "sighting_of_ref": "indicator--3fe13186-1f4a-4084-a150-b4f0474d9a1c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8ba2347-abcb-4441-8d9c-bacdd7f99ff5", "sighting_of_ref": "indicator--ed486cb0-5644-4d12-bfa6-dd0be4f5370c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4dfa3f7-8195-4e40-99d5-b4da3e162dc6", "sighting_of_ref": "indicator--ed486cb0-5644-4d12-bfa6-dd0be4f5370c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c183a8b1-1513-4a04-9e9b-19a2aad3cbba", "sighting_of_ref": "indicator--e6032dad-f8ad-4423-b04a-d4a92ece6e97", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5a784e7-c96d-4208-8c70-9d9bd3b4a28a", "sighting_of_ref": "indicator--792ca16b-eacb-43ab-acae-24d2a281a065", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e487c7b-c46f-49fd-bf4c-83907b479b4a", "sighting_of_ref": "indicator--792ca16b-eacb-43ab-acae-24d2a281a065", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52a22240-e2fe-40a0-8e83-a510e6497a8c", "sighting_of_ref": "indicator--4028f6df-1e69-4709-8aad-0f84abe9084c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a0fdd82-e088-44fc-b671-4255fa542210", "sighting_of_ref": "indicator--d22cd954-0e61-458e-b550-4ee52206d033", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c58ea78-c5d9-43eb-83b8-9840ac6911f0", "sighting_of_ref": "indicator--d22cd954-0e61-458e-b550-4ee52206d033", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78783520-de15-47f0-9853-4c9a3e89360c", "sighting_of_ref": "indicator--c2edcef4-f61d-495a-a0f8-a825df27dffb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4fbf92e-e698-4fcc-be68-7194bebbf1dd", "sighting_of_ref": "indicator--c2edcef4-f61d-495a-a0f8-a825df27dffb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d253f188-6b6a-485f-b761-d5ad65e3573a", "sighting_of_ref": "indicator--e5bcb9e7-0000-43f5-bf59-936303d098e2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74cdafec-513c-4451-a398-3b2b614508c0", "sighting_of_ref": "indicator--e79a4335-b3a6-44bb-bd26-c2837fd0a72f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7451b365-e217-4f02-be26-e27941c0684a", "sighting_of_ref": "indicator--d699376b-70b1-47ae-9437-c26bf0c2ea65", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--475cec0f-34bf-43e7-9005-9452cd4a4db4", "sighting_of_ref": "indicator--75c4dac7-6224-4f81-ae33-05cb1bc4aa7e", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3d95ee5-b6db-46d2-890b-a84b9c3f1575", "sighting_of_ref": "indicator--f93292c4-10c2-4c32-bb71-970e7586c391", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dafd5dd1-8cc4-47ca-bcd6-0ef618a20957", "sighting_of_ref": "indicator--b99e20c6-7b22-431b-9688-00e3b44c39fb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb02d4d4-eb9d-4d9b-b8dc-30dac5feb613", "sighting_of_ref": "indicator--69d5d090-733c-4b2a-bf03-6ef01510c469", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--312aa7b4-871c-4c50-87d8-a4fd462ea6cd", "sighting_of_ref": "indicator--eb33dead-ffd8-467f-a2cf-31c562c595e1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e44d8718-bf3b-4b35-8b74-4aa7af7c0d67", "sighting_of_ref": "indicator--baf864cb-0b18-4431-a164-4992513fd65a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bc54887-a337-403e-8818-939657d1d4e7", "sighting_of_ref": "indicator--250dfec1-8184-45be-8f12-edd216b41d9b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db544d96-c522-4072-a06b-5dbc3b868f14", "sighting_of_ref": "indicator--82c69b19-41ba-4d10-9f5d-bce7af7afc01", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96088e3f-8e61-42bc-be14-260eeab9aed1", "sighting_of_ref": "indicator--1abad4a3-9821-4504-b5aa-b360241eb418", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eb2eaff-3d61-4eea-915c-e0618b9fe357", "sighting_of_ref": "indicator--7b62995a-5dbb-4b31-8387-123b32573fac", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8fc8558-c02f-491d-8c67-01f5120e173b", "sighting_of_ref": "indicator--5c63123a-8cef-4054-87c6-0df7299f5853", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7dfa03f-0223-455a-91db-898d6c4b0bd1", "sighting_of_ref": "indicator--2657711e-6fae-4529-8e45-809ef7604070", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c416eefa-13a1-4038-ac29-e4e0aa383c4b", "sighting_of_ref": "indicator--8fef8e12-1a8d-4dc9-b77c-5816ea9dd303", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab7c8c3c-4f1b-4134-99b1-8542104c24b0", "sighting_of_ref": "indicator--43852372-dd56-4998-8598-39173734da1c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a498df30-d0bd-421e-9d6a-bc73a0f434ad", "sighting_of_ref": "indicator--9601a649-e67a-419f-8f8c-ea024d03604d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df36b86b-4e90-4f30-b550-95f60670fb65", "sighting_of_ref": "indicator--ec5f682f-5d6c-4da1-8fd5-1f0c8f2631b4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d833f58e-bfca-48d0-b008-a1b128d48db6", "sighting_of_ref": "indicator--2d23824f-426f-4729-a509-5978d0401e62", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ed0e411-bb70-46f8-9e01-28d86839cc8b", "sighting_of_ref": "indicator--2d23824f-426f-4729-a509-5978d0401e62", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03ffd605-9907-4899-a332-1b0428ee8f18", "sighting_of_ref": "indicator--5b8da7ac-ee83-4bec-a14d-fda5034548e8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a56de920-edca-4a3c-9856-5b0776f01467", "sighting_of_ref": "indicator--4c25236c-6c52-4dac-b40e-49f02d7e9a7c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--695a7eda-b612-4f16-96c5-7a3ae0b6931a", "sighting_of_ref": "indicator--4c25236c-6c52-4dac-b40e-49f02d7e9a7c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aae93bbf-968d-4ca8-adae-f20cfab823e5", "sighting_of_ref": "indicator--93d6fa1d-0437-4cf4-8b25-048f7b29e7bc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc5375e2-660a-4e76-af0f-6f51dd0bf512", "sighting_of_ref": "indicator--93d6fa1d-0437-4cf4-8b25-048f7b29e7bc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd453257-de7d-4582-88b4-1b47410d12e6", "sighting_of_ref": "indicator--ec0a31bc-ea56-4b50-8cc1-c0c2355d82ba", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edb262f2-931d-41dc-82a9-b33071008f80", "sighting_of_ref": "indicator--4f6bf485-a201-4b98-88cb-071be261b954", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--811c2451-5995-4df9-bce4-0ddb7dc91570", "sighting_of_ref": "indicator--84de227f-b4ea-40ce-9a29-a20352228649", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4edcfd4-87e6-488c-91cc-54ae2d717af2", "sighting_of_ref": "indicator--b293ac06-9c82-4c82-b41d-9070efecb6b7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d195aab1-18a6-4e24-87e6-d83ef59c1970", "sighting_of_ref": "indicator--b293ac06-9c82-4c82-b41d-9070efecb6b7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ebf91a4-2e4b-4925-88db-5a88670815d8", "sighting_of_ref": "indicator--486333f8-b4e2-4bba-b59a-d0c04cb0b8dd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d91fda38-2ef6-4c9e-b121-048940083d04", "sighting_of_ref": "indicator--9894006d-f82b-480e-a6bb-a5a8ea2a4d7a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5888bcf1-9506-47e8-9d4e-dd56ab9feeca", "sighting_of_ref": "indicator--ae132c25-b7dc-4834-b091-872478f585db", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--383f5779-64ab-417c-8bf6-4b88ba153e73", "sighting_of_ref": "indicator--5061f1d1-a6ed-436c-9f11-421fbc4561ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--648a73f3-0ec8-474c-beac-5bf7624e237e", "sighting_of_ref": "indicator--56b21b0c-ce21-44a2-8f7b-1b88c6d72c4d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcbbd81b-26cc-4816-8b12-a3621530a7a2", "sighting_of_ref": "indicator--9573fbda-5207-4d27-aea9-902ade9a7da8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd53c1d9-2a7e-45e2-814b-ada8c02b3428", "sighting_of_ref": "indicator--9573fbda-5207-4d27-aea9-902ade9a7da8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02d0ce5a-3894-4306-8e9e-338e902f679a", "sighting_of_ref": "indicator--96a081ad-7e07-4e5c-a9c0-b7507656f848", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9780878-5574-46ea-8855-3c4b0949bb1e", "sighting_of_ref": "indicator--96a081ad-7e07-4e5c-a9c0-b7507656f848", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aeda08d2-54c4-4bd3-bf1a-76bc111dcc12", "sighting_of_ref": "indicator--3cb2a02a-3566-4542-98b4-86356d50f722", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d69704f-5da3-4684-ac69-7cd5b0862f0a", "sighting_of_ref": "indicator--98265bf9-8501-4248-979e-406b2ec6efe9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd8ef04a-95ec-450b-bbdb-5617f62f1407", "sighting_of_ref": "indicator--5b03339a-7b8a-4cf5-9630-fce15a99cc14", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f832be0f-8e5f-4584-a1eb-5ffc230f6f9c", "sighting_of_ref": "indicator--5b03339a-7b8a-4cf5-9630-fce15a99cc14", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75c08be0-16a0-4f03-942c-290286a5fcdd", "sighting_of_ref": "indicator--13762076-d0c6-463c-a0f8-241b1bd9b0ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58844c98-cf2a-4855-a7ed-100fed4dea79", "sighting_of_ref": "indicator--3d85bbc0-4987-4b2d-803a-93d1ca519ac6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6607bf6b-27a1-4e50-b726-7d40d1ba2d6d", "sighting_of_ref": "indicator--3d85bbc0-4987-4b2d-803a-93d1ca519ac6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bc8c9ca-7b40-46b5-9943-b7396cae7209", "sighting_of_ref": "indicator--237b9732-7132-4d75-b94a-2d02fa076d4f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a6ab5e5-582c-4bdf-b752-de0182688f13", "sighting_of_ref": "indicator--40417205-9825-4564-955f-dd968b764f76", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac33d16f-81ad-4135-919e-6a40e8ae56c7", "sighting_of_ref": "indicator--40417205-9825-4564-955f-dd968b764f76", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10359b1c-8e0a-4a2e-ac67-d5508ae15265", "sighting_of_ref": "indicator--3069b211-c3cf-4e47-8c38-e852e96eefcc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6c11fe6-1ca8-436a-a794-8e89889426de", "sighting_of_ref": "indicator--bd5f2dab-0354-4c63-800b-de8246b7c46c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b80662c-6732-42b1-bd9d-70fe5c057ab1", "sighting_of_ref": "indicator--f2effcbf-d0fc-4b0c-beaa-77bec4dc9ced", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66f39a3a-8a30-4971-aef3-a2e90cb24bc1", "sighting_of_ref": "indicator--f2effcbf-d0fc-4b0c-beaa-77bec4dc9ced", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12f37be4-ad8a-4400-b938-0b6bdaa5eb8f", "sighting_of_ref": "indicator--a489eea6-f300-41d7-9a88-41380c6cd961", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ec8f965-7889-4ce7-ae82-89d2dee25c8d", "sighting_of_ref": "indicator--38c614aa-3438-41df-b47e-7f2c0094b009", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4d8d40f-d149-4305-9eec-47c923c63a4c", "sighting_of_ref": "indicator--38c614aa-3438-41df-b47e-7f2c0094b009", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a242b4e8-4dc9-4402-afbd-10b6abe106b7", "sighting_of_ref": "indicator--73616525-b9da-4740-9718-263e5118fdb5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b1f0cd6-e72d-4eb9-b387-7de02a4c343c", "sighting_of_ref": "indicator--73616525-b9da-4740-9718-263e5118fdb5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3665c223-2206-4922-96cd-02be12b9f5c5", "sighting_of_ref": "indicator--ab54573b-ce40-4705-87a1-21bf523879d7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a16fd806-10c8-43f3-bcb0-e475e5ed14dd", "sighting_of_ref": "indicator--7d6a173f-d19d-47f8-aa00-1bc9327a398d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32ee5638-978d-4819-9d77-ae8ab389c5d4", "sighting_of_ref": "indicator--d953cbf3-b193-42f3-ad1c-e1f51e033a96", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5f74934-beb8-40d8-8fd6-5d0f130f8a6d", "sighting_of_ref": "indicator--d953cbf3-b193-42f3-ad1c-e1f51e033a96", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--708ea933-d936-4f0b-bb3d-e4605a073eb7", "sighting_of_ref": "indicator--7e261277-35b1-4852-a432-06a787bdb09b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b477588e-dc59-4bb8-9205-b8711a665355", "sighting_of_ref": "indicator--7e261277-35b1-4852-a432-06a787bdb09b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23f95259-2a03-42d9-9194-df9358833b61", "sighting_of_ref": "indicator--dc3c81ca-a5f1-4643-a97a-f70dc5b89166", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2b175b9-a01d-48ff-bd69-2c9b6e119e10", "sighting_of_ref": "indicator--7cbd2888-da94-45f5-9eb2-37534097e9e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca97da3a-4e16-4e9a-89f1-0b370856a2e4", "sighting_of_ref": "indicator--95cca180-631d-4f53-b8a1-7fcbb87ba674", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a91ec98a-0c79-40ef-bf39-645f74da94a1", "sighting_of_ref": "indicator--d739f431-0cc3-4e5b-b0a2-dfa2a832a12f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f2ff358-cfd9-4f34-99d6-a98f093c0f5b", "sighting_of_ref": "indicator--103fd768-8c1a-4daf-afb9-e368abbcf29a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a97a45c-59d8-48a7-871a-741cc93c8432", "sighting_of_ref": "indicator--103fd768-8c1a-4daf-afb9-e368abbcf29a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b797ead5-05cf-49c8-9221-c2b5cabffc07", "sighting_of_ref": "indicator--e193f573-9b7e-4cbe-a2c8-998ce2caa035", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8ac4f24-b626-46a6-97d1-2a0c38eef596", "sighting_of_ref": "indicator--362c1650-e7b1-474c-b7f8-3d0b068d78f6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2d11401-6596-418e-a8cd-ede5a92d83d4", "sighting_of_ref": "indicator--a7acfd18-60c8-4291-a47d-c6bee693743d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--088d33a1-4347-4423-ae3e-cf20520ca016", "sighting_of_ref": "indicator--7c48936f-7a79-4920-89a4-6e66faf8926b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ac39ef0-4046-4b69-98a1-afe07dcef706", "sighting_of_ref": "indicator--e1d228c0-851a-4e07-a6cb-16aa088b4390", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9b395b6-6a9c-4978-ae8f-19f6f093b68b", "sighting_of_ref": "indicator--8e0551c5-f218-469a-bac6-6bfafa8ccba2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7a8ee32-08b9-4d8a-a9c1-911c7e84629e", "sighting_of_ref": "indicator--176d2002-d7dd-43e1-9709-2d96b1d23181", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cab2e14-c575-47ba-b2d0-2c4b76d564b3", "sighting_of_ref": "indicator--25b73193-7505-4583-841f-baa59ab855a5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20aa27a6-7f63-4220-9576-90712eb15e7a", "sighting_of_ref": "indicator--a2e168a9-94f8-4285-a9df-6661b36f46db", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f2a5828-c3f4-40e0-ae53-ac4d524add34", "sighting_of_ref": "indicator--59d0a054-1788-4bed-96e0-3a4a0a3851e0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b241bf0a-b169-4097-bc13-f554c665188c", "sighting_of_ref": "indicator--59d0a054-1788-4bed-96e0-3a4a0a3851e0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f39fdcfe-4edd-4be5-90e9-6753c2d3aec8", "sighting_of_ref": "indicator--8d5e7012-a375-4f93-8080-7153668fe807", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d0b3e9e-8404-4d47-a8a9-d271fc85249f", "sighting_of_ref": "indicator--dbe6c7cc-cbe6-4b07-935c-346819c42eba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38ee4b73-3c86-4e0d-a8ec-1e6bec97253f", "sighting_of_ref": "indicator--863d6cea-fc3d-435b-b3e9-68d88c32dbcc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05bca5aa-219e-49fe-bd66-40eb4a585721", "sighting_of_ref": "indicator--863d6cea-fc3d-435b-b3e9-68d88c32dbcc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bb9a8c3-9b59-42f8-871d-bab0eb558617", "sighting_of_ref": "indicator--a4adc55f-e724-4b74-aae2-f8e8a7bb722a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb49161a-27a8-4b9f-9e11-9854ddab770e", "sighting_of_ref": "indicator--ea61dd4a-ce56-48c7-ac09-e9f00831f523", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0a716d6-2299-4ce8-a91d-696196cd7c27", "sighting_of_ref": "indicator--ea61dd4a-ce56-48c7-ac09-e9f00831f523", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fa93e82-ad24-40de-9032-36f97430b910", "sighting_of_ref": "indicator--829fa77c-5bad-4762-a341-72de9041b70e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36f58575-cbd5-4bc1-b37f-0f5d0e37250c", "sighting_of_ref": "indicator--829fa77c-5bad-4762-a341-72de9041b70e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de6a36d1-cd95-4ae1-b2a8-9a0bb9900794", "sighting_of_ref": "indicator--691d258e-c59c-4ea7-a73b-b2887a93773e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--014cce7a-7b33-4c1e-b89d-2d68c73e9017", "sighting_of_ref": "indicator--0dc0ca21-df7d-4054-9982-26b74423223a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ab8b1c8-7d88-4263-86f4-f6da9cf1ed62", "sighting_of_ref": "indicator--e4e79f42-9e9e-40b2-9062-4e72770bf36a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--162e7697-a6ef-4748-ae77-70af4e27bd58", "sighting_of_ref": "indicator--e4e79f42-9e9e-40b2-9062-4e72770bf36a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd655072-c96e-433c-8369-bad1ab83ee2b", "sighting_of_ref": "indicator--9f088297-df4f-4a9c-bb44-151ca39c9fda", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3ad4eca-2af8-42c7-8e3a-afb03f7594ff", "sighting_of_ref": "indicator--af2ff6bc-1de4-40ca-ae3e-f5ecf40c55bb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f4389ac-177e-4b22-bd39-76e08e82a7a4", "sighting_of_ref": "indicator--fc08b0fa-f92c-44e5-934d-8c971899ebe1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--867632c6-7551-4676-b074-dd63821498a2", "sighting_of_ref": "indicator--946f8bd5-0b93-4ff7-8ee4-04ddceab987d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a186b8a4-8377-4671-8179-53e157aaf90a", "sighting_of_ref": "indicator--946f8bd5-0b93-4ff7-8ee4-04ddceab987d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c582e6b5-07fc-4659-9540-aedefc07bf74", "sighting_of_ref": "indicator--66f9d389-871e-4939-b3a7-f8aebb785b9f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f3e900d-db3a-41e7-beed-6416fd42604c", "sighting_of_ref": "indicator--66f9d389-871e-4939-b3a7-f8aebb785b9f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddc0be82-c265-4870-8886-36e92e1befdc", "sighting_of_ref": "indicator--89c44155-41a1-4776-8018-da158d7d34e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fff4866-a33c-4c01-b175-bc31d83eec8a", "sighting_of_ref": "indicator--89c44155-41a1-4776-8018-da158d7d34e6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--997488b2-f315-4fce-bd07-d1564be91fa7", "sighting_of_ref": "indicator--fb54c50c-1dda-44ad-b153-040217414cc5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d0270ac-9b36-47c2-8b3a-744956af034a", "sighting_of_ref": "indicator--e26ba93a-2661-4c1e-b9be-a57a3b1c0e47", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29b81a75-c2b5-4382-bb3c-755f9afd9639", "sighting_of_ref": "indicator--3bd5b4e1-db74-479d-a6ba-65673dded10f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c82eeff0-049f-4b21-896b-e35987f00ba1", "sighting_of_ref": "indicator--6902aeec-a1c8-4bdc-b631-ad152aef5b9b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f79050b-b041-431f-b5ee-2378e1066641", "sighting_of_ref": "indicator--6902aeec-a1c8-4bdc-b631-ad152aef5b9b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d6d88b0-69de-4aee-b21a-1e1b635479f9", "sighting_of_ref": "indicator--8f826b97-0304-48f1-be52-8b5a8f3069c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc6d4b18-ace1-4734-859d-6b5d94d8da2c", "sighting_of_ref": "indicator--0802f2da-5629-491d-b286-d36015fa03b2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--851f2978-610a-416d-9c25-6d75b5df40f3", "sighting_of_ref": "indicator--0802f2da-5629-491d-b286-d36015fa03b2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce4544d2-8e98-4cdd-9bb6-1ef37b322073", "sighting_of_ref": "indicator--b89a9c04-a41d-4353-b898-9b286ed16b09", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3329cd86-4c13-4dfc-9b90-cb8601370504", "sighting_of_ref": "indicator--b89a9c04-a41d-4353-b898-9b286ed16b09", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54125708-08d5-48c5-9cb8-11a79cd52e92", "sighting_of_ref": "indicator--1a64cbb6-e786-431f-8bc4-e0755dfa5c3e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f70c53e-940b-47c2-94e8-09e4f386de71", "sighting_of_ref": "indicator--1a64cbb6-e786-431f-8bc4-e0755dfa5c3e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92403b4b-f2f9-4a20-8735-8e27ebae7ddf", "sighting_of_ref": "indicator--7d44c625-9420-49f4-b354-3e96c8e804e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60589361-c2fd-4442-a513-8fd3ac0fd01e", "sighting_of_ref": "indicator--7d44c625-9420-49f4-b354-3e96c8e804e6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a52fd6ba-f24a-40de-a5d4-32ca1627e535", "sighting_of_ref": "indicator--a8d76656-9cf0-40a1-9926-70f868eb73cd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fb320cb-1055-459d-83f5-3af02090566b", "sighting_of_ref": "indicator--0a5a6db0-ee3f-4cd6-b65c-7015e2406961", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--330d81c1-d835-46ae-a406-0199ad77b28e", "sighting_of_ref": "indicator--4f84859a-f22f-49aa-94bd-d7f220a12443", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f326e25-f331-4380-9a47-b58b189ae939", "sighting_of_ref": "indicator--4f84859a-f22f-49aa-94bd-d7f220a12443", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e41b602c-eacc-46a6-ba5c-cfe73bed2f9c", "sighting_of_ref": "indicator--e2c3f32b-9fa0-4c9e-9b67-8cc64455b140", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db5eca7b-85bb-4236-8f55-ba6ca19d2d1c", "sighting_of_ref": "indicator--e2c3f32b-9fa0-4c9e-9b67-8cc64455b140", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1b352c3-c552-4006-bd4b-617469e0408b", "sighting_of_ref": "indicator--1cb2aca6-6dff-4557-b773-55a392053e82", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10c3deb0-df03-4ab2-908f-2b8fc34fb57d", "sighting_of_ref": "indicator--1cb2aca6-6dff-4557-b773-55a392053e82", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd81356c-d22e-4f14-a084-61362f5e870d", "sighting_of_ref": "indicator--fdee6a84-5d30-498f-8e57-7b556a6be4b3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fc3b2f8-a013-428a-9ee9-c6e56ec25170", "sighting_of_ref": "indicator--dc7e009d-eb75-4185-8823-053465ef4a0c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c06ba61-49ae-4b03-a92a-70496f56148c", "sighting_of_ref": "indicator--dc7e009d-eb75-4185-8823-053465ef4a0c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88e574bd-69fd-4486-86ab-375c6380119d", "sighting_of_ref": "indicator--4b67c17d-abf8-4134-b6cf-01e5740cccf4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc3a70db-3cf6-42ba-93ec-5514109ef626", "sighting_of_ref": "indicator--40bf04e2-c0c8-40b3-ad6f-c298745c33c9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b32a77e4-ba8e-4544-b4fb-1e7acef13b34", "sighting_of_ref": "indicator--2d6b0a8a-39ed-4f05-af75-a0d799b9d05d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00f98dd1-499c-4e8c-8f62-19fe07503ec8", "sighting_of_ref": "indicator--ed3a29b7-eb3e-463f-88d1-34e1e6bbac85", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0b25f5e-a2d9-4f70-8122-ddb147dc040f", "sighting_of_ref": "indicator--cb617545-90b6-4e43-84f5-df8934bb145a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6394fd1-7df4-4b4f-a667-236c2e8b7d84", "sighting_of_ref": "indicator--ac77c658-6102-4b9b-bd35-6a67a49464ac", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4d78413-8ca1-428f-8939-4834bbbd341c", "sighting_of_ref": "indicator--e5c3321c-a795-4b9e-875b-2856fc12ecbe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e5649b7-457d-4217-972b-4e243669f695", "sighting_of_ref": "indicator--e5c3321c-a795-4b9e-875b-2856fc12ecbe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96555e51-1940-48c2-a621-ed00f452da85", "sighting_of_ref": "indicator--82a81055-8c54-4178-98ca-1aeb7754cf7f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63d05fa9-f22a-40ed-8ba2-2b1b39933e46", "sighting_of_ref": "indicator--72696e25-394b-4f7e-ae13-05137557b736", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ea0217b-e35c-4f95-a522-bb9d7b42f822", "sighting_of_ref": "indicator--d64895b5-09ba-4e57-83da-05f129d8b0ef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61ee789a-7be5-4c85-8036-05c6e4663799", "sighting_of_ref": "indicator--d64895b5-09ba-4e57-83da-05f129d8b0ef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff254591-3a7a-4bdf-a2ee-3145448cc541", "sighting_of_ref": "indicator--7b9890d6-c35a-41aa-8bc6-d2fb86c4ebba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b044ec73-b6df-404e-bca6-cabf24234738", "sighting_of_ref": "indicator--39996a8c-1188-4631-a89d-c066a01ee148", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2c767de-a30c-431f-a33c-6ec0e1c8bfca", "sighting_of_ref": "indicator--6c442f05-b47d-464b-bfb3-a752f2384943", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--540e16dd-9195-4fed-8b25-828cc07b9b0e", "sighting_of_ref": "indicator--149c2231-db0e-413a-a95c-5c06b028ccc4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2689fe2-6a0b-4fb8-b9e2-da35f8513e54", "sighting_of_ref": "indicator--0b3e1509-3da8-421a-807d-017ae59d740c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3a98606-22bf-42ca-ac4d-9aafcff65919", "sighting_of_ref": "indicator--23d7bdea-181d-4bfd-a5b2-4cf47da69c8a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e21dcce-ed37-45c0-ae9b-bf1bf677c958", "sighting_of_ref": "indicator--f9cbeae2-7cb4-483f-b5bd-d3a223e89c0a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dfd91d4-3fac-461e-b386-c40e1c77b32b", "sighting_of_ref": "indicator--71722c39-a66a-45ad-b995-8d5cbf4345ee", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--941c2dcf-7e64-4c7b-b7ef-503282b3d4a6", "sighting_of_ref": "indicator--2bc85224-cd92-43b8-a903-5510f9f26065", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05ec17d2-fb08-4181-a327-ed49da06dd06", "sighting_of_ref": "indicator--78826fbd-591f-4543-9005-20d64803d23f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fe76160-d489-478b-a75d-3d360cb8ee28", "sighting_of_ref": "indicator--9a312a63-0792-4a02-8140-ed79d4eec916", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a965ce3b-b8e6-45a2-95ed-5d1e900bcad9", "sighting_of_ref": "indicator--17e32042-b068-40aa-9edb-d416860a854f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cbec3b5-1e9d-4da5-b1f5-3dc2fe4c78a2", "sighting_of_ref": "indicator--8eff53a2-c2f6-4930-b5cf-ead3ee692332", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae19908c-2c23-427e-8a82-faebe0285e45", "sighting_of_ref": "indicator--8eff53a2-c2f6-4930-b5cf-ead3ee692332", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1c10e95-5177-4bda-85f6-fd6e2bcf6619", "sighting_of_ref": "indicator--c5995cfa-c506-4239-a86f-f387e91ac94c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc4e4dcf-28f7-4b9e-ab7e-36723dd5731f", "sighting_of_ref": "indicator--04a0ba21-16db-4947-ba58-db059a86e34e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8423db0e-c596-4f7d-b07e-eff05f8eaa9a", "sighting_of_ref": "indicator--04a0ba21-16db-4947-ba58-db059a86e34e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--321c10ec-794f-49fa-be9d-3f2dfedf6f92", "sighting_of_ref": "indicator--f1f6371f-0192-4599-8146-134197f7df30", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3b2065e-b97c-4d89-9492-3ec87ca63e4d", "sighting_of_ref": "indicator--5996d849-4a42-4201-929c-ea9d86443a98", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37a1e890-8358-467d-ab5c-a91630b91ae0", "sighting_of_ref": "indicator--443367a0-1826-4745-a2d1-e6cb4984e80c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5cca64c-4acd-44eb-b552-5e0a83326402", "sighting_of_ref": "indicator--85454ca4-04aa-417c-b63b-552488fbfced", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b64cc8c9-9e7c-4fb3-bf85-5fc96f1dfbdb", "sighting_of_ref": "indicator--17ffe764-cd66-4985-be83-6f825a24cbc1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8afdd86-78fe-4ad4-874f-0bacb57a1eec", "sighting_of_ref": "indicator--51f3e48a-6b7c-4c3d-8a8d-b50e2dc3bbc8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b87ae59-5767-4258-a5ee-4d56f1004eb8", "sighting_of_ref": "indicator--51f3e48a-6b7c-4c3d-8a8d-b50e2dc3bbc8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d22c9e71-b938-4b14-8911-7b9e718ddedb", "sighting_of_ref": "indicator--b9a6be10-7dad-42c3-abf9-605010182566", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c91be23e-8a16-4234-9dfa-f1fda3b50dea", "sighting_of_ref": "indicator--b9a6be10-7dad-42c3-abf9-605010182566", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aad976d1-e2a2-4302-b209-3f1d7130c5fa", "sighting_of_ref": "indicator--c0fffb63-69cb-43f0-bbd5-8823b6e89db4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c0a9d12-e1db-40a5-ae4b-88b80e4e4253", "sighting_of_ref": "indicator--036a2f73-c337-49e2-b681-bbb6f1be851f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3391c120-d0f1-42f8-a964-4c239d9b5cb0", "sighting_of_ref": "indicator--b075dc8d-6615-4ef6-9961-4d32eab18415", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e2f9a79-a561-4b88-9f2b-6da1d17f25c0", "sighting_of_ref": "indicator--e01b80f8-e449-4841-9385-791df5a57fb8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b4eb313-02b4-4325-bd62-8a499335e78f", "sighting_of_ref": "indicator--1a18147c-b907-4514-9c5c-2dd6ceb0f064", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--292fe730-84fb-4a50-9190-20bf3449b909", "sighting_of_ref": "indicator--a4a14e3b-85a5-4188-b9d3-a99ca362dbfd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52cd5a28-cbcd-4a13-89c6-e88be3615c1d", "sighting_of_ref": "indicator--a4a14e3b-85a5-4188-b9d3-a99ca362dbfd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--121dcb67-6bfa-4eda-9c76-a9cc1f8c0c90", "sighting_of_ref": "indicator--9fb6d638-7926-48e2-9aed-f3722209cd0a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3d54110-0c60-4a63-a6fb-27634a97c01a", "sighting_of_ref": "indicator--0d1c143b-26f6-404d-bbdd-9a13205d7d35", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c8b802c-960c-42cb-a95a-aceb474fdeb0", "sighting_of_ref": "indicator--0d1c143b-26f6-404d-bbdd-9a13205d7d35", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d38b9d1a-1f3b-4d14-8657-af535dae5040", "sighting_of_ref": "indicator--3c951200-4b62-4793-9c0d-ae8b89de6868", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ec48bb0-fbaa-4009-9f00-f74b1bc4cc54", "sighting_of_ref": "indicator--3c951200-4b62-4793-9c0d-ae8b89de6868", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34d03219-50a4-4af6-92bc-e4ca02f68be0", "sighting_of_ref": "indicator--fb77e887-b229-4b09-a8c2-337be50c07b5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a0e6855-096f-406c-a2c4-09e647748b82", "sighting_of_ref": "indicator--df90d137-8f70-41ad-944d-257555e5d1f8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1a781eb-3059-46af-91cf-411f3752ce3b", "sighting_of_ref": "indicator--54c8be91-ff16-462b-b49e-6d26802ccde9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2ce645d-4aa2-4e77-9dcb-6ad2f4a30978", "sighting_of_ref": "indicator--b47976ae-2018-4024-b081-879e295850e3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d16271e-1799-406b-878b-54518fcec0d9", "sighting_of_ref": "indicator--53b93260-60f8-4a94-a1ab-25bbf4f8a6c4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6d4b406-938a-4416-812b-b783239a3499", "sighting_of_ref": "indicator--32645184-70b4-4171-9319-d29738ba2562", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--462d68fe-b5f2-4872-b0c5-715d2a3fbd5d", "sighting_of_ref": "indicator--a599edae-c288-492b-b1f0-f08801293e6e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad027f84-a3e7-406f-ae72-c4684b3eac0a", "sighting_of_ref": "indicator--595397fc-1041-403d-9b47-b24d1183db99", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb60248b-2b35-4146-ac15-bf29e1185d78", "sighting_of_ref": "indicator--595397fc-1041-403d-9b47-b24d1183db99", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e2251f6-8f55-4c61-97b8-f5ee85c390ec", "sighting_of_ref": "indicator--6f68f4a0-9148-4707-9a35-b3935c25f999", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80cce5fb-72c5-42a6-a622-d815d6662dc5", "sighting_of_ref": "indicator--ac1cc6d2-cb19-4916-abc3-5c7e275ec758", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8332ba3d-9096-46bd-bdba-0154ef4c5c87", "sighting_of_ref": "indicator--2a7c315d-b9e7-4599-ab75-27224e3227ed", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2a23227-13c1-47a9-95fb-e409a31072da", "sighting_of_ref": "indicator--bcc95a2d-45f6-4493-9506-7de82caa5bd3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c4424c8-d55f-4666-afa8-530061fa949c", "sighting_of_ref": "indicator--0778144f-e5c5-4691-8f8c-d56aa9c3cc41", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cb1693c-e217-48a6-af86-f724a130acf3", "sighting_of_ref": "indicator--c8b0f53e-5a37-4d71-8b3f-86a07cf45faf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6804edec-8b29-42b8-9f73-76cc8f0970f9", "sighting_of_ref": "indicator--dce0ec54-6b29-4d31-9a3b-f59308bccdcb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddb10eee-d458-493c-ab0a-9a742f5751d1", "sighting_of_ref": "indicator--d165d526-5f4a-4840-9446-7fc7a1f45591", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63a7f341-ebb2-41c4-86a2-10fb52698384", "sighting_of_ref": "indicator--8231f264-dfa0-4528-bf82-80b57d9cad31", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63cfd057-88f0-4f77-b06d-d3a5f5e9e923", "sighting_of_ref": "indicator--402bc653-1376-43ee-b187-ef259371924c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9f6a6ca-11d7-4495-bbab-1e41ba4eb509", "sighting_of_ref": "indicator--26dffdc6-279a-445d-936a-cce6a70f7de7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e901e661-99c5-4319-ac2e-b760ac8b2f88", "sighting_of_ref": "indicator--7e4de772-26e5-4853-abf7-865f9c0af8f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1326f7ce-e5f8-4980-8b48-bcfa2eec6afe", "sighting_of_ref": "indicator--7e4de772-26e5-4853-abf7-865f9c0af8f0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b2faeb6-f590-41c5-981a-ff6f7ef41e63", "sighting_of_ref": "indicator--446f8939-a3be-4ad5-b2c1-d1cc5ae6d3b4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17ed91c0-2c7b-4378-9fb6-a31bd9ee3c9a", "sighting_of_ref": "indicator--9f01aca9-7f53-4004-a31c-12dfb83a94d6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92cb4e8c-471f-4744-963a-fb2c5bb54b2d", "sighting_of_ref": "indicator--0a5c10bb-85eb-467b-a171-856e923bf585", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae80901b-d2de-4929-b96d-691461df64dc", "sighting_of_ref": "indicator--9f08a727-7914-474e-8df6-49309ccac34c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--106c3e4e-3d05-40ed-8838-ee7901ad4f5d", "sighting_of_ref": "indicator--8d50324e-f12a-48eb-944e-e898229432e6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8074a23-6e9c-453b-ae15-15491cc56fff", "sighting_of_ref": "indicator--92e77aa9-a4f0-429b-9acc-387d309d298a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d56eae52-a712-4cd7-8269-6b95e53654bc", "sighting_of_ref": "indicator--92e77aa9-a4f0-429b-9acc-387d309d298a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21233add-8128-481b-aa7d-9a3676229db4", "sighting_of_ref": "indicator--d4350ec6-3507-49af-b830-65c2794b3988", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe58aa6f-f73e-4819-84d5-96dcf5ca0afd", "sighting_of_ref": "indicator--b18f97ff-e4a4-4448-8bf3-b41e03f23097", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f09a39e-4929-4e64-ba8a-c04fabdabec2", "sighting_of_ref": "indicator--f19f181f-25c7-4b33-a51a-231cd0904b10", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77967050-2886-45af-978d-0f80d9d2d2fb", "sighting_of_ref": "indicator--f19f181f-25c7-4b33-a51a-231cd0904b10", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffe34515-4b7f-4455-916c-e78f7da968ee", "sighting_of_ref": "indicator--c0e83861-c6c9-4c96-8854-db393d76ca5c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00c9a0d1-140a-4b4d-a99a-e31338505d65", "sighting_of_ref": "indicator--24b960db-755f-43df-8c88-8e86b2859d46", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53238201-aaa2-44d3-8bf4-52f564c8fff5", "sighting_of_ref": "indicator--d9493241-078c-43c2-9798-009717a73c9c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9afd948d-02a6-4bb5-b5f2-2f45b500d465", "sighting_of_ref": "indicator--d9493241-078c-43c2-9798-009717a73c9c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6185291-72c3-40ac-a963-ce640c486f56", "sighting_of_ref": "indicator--733b610b-eb23-4bda-8292-06080fd4ecce", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--079b3440-b3e1-48ce-b636-587da38e9d27", "sighting_of_ref": "indicator--8d8651f8-194b-4115-8618-7c0dcfe34771", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9d0afc5-1f72-48ff-8d3c-7aae3a21c2dd", "sighting_of_ref": "indicator--9df8cc0a-6a99-48ce-8b3a-f2f38fc15450", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--049c70c1-6b1f-4506-b128-b1a1ceb5c749", "sighting_of_ref": "indicator--18cffa03-cffc-4490-a710-7bb71ee7a1e1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--335badea-c506-4496-9cb7-a9513b08d107", "sighting_of_ref": "indicator--1c2ac0a5-d800-48af-abe7-68b46aa6727a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3add9ca-a953-4893-8adb-05ef2b7656e2", "sighting_of_ref": "indicator--0f44b071-7f24-468c-ade7-3c21e2c7d931", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94baa32a-709c-48f4-807b-708ed92eebd4", "sighting_of_ref": "indicator--0f44b071-7f24-468c-ade7-3c21e2c7d931", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcfdc85f-df5b-4b34-b4bd-599345271a19", "sighting_of_ref": "indicator--331e9916-d34e-4d68-a9eb-0fc05119b807", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--668e6e4f-bd07-4b44-a8e1-85ba7faed124", "sighting_of_ref": "indicator--d2cbf4b8-7074-4908-b406-a1cc6c6be33b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee78240d-13c9-49e2-9a9c-2ba77cfe8fad", "sighting_of_ref": "indicator--e1463332-5c9d-4a45-abde-7929ebecb4ef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9649481-282a-49e9-92dd-b8b61fe41171", "sighting_of_ref": "indicator--e1463332-5c9d-4a45-abde-7929ebecb4ef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--781af97b-28d1-4de9-8a8c-3d8118f067e1", "sighting_of_ref": "indicator--520407b0-7410-44bd-acc8-b154e85b14a2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a834fb6-085c-4538-987e-d8e8690d6795", "sighting_of_ref": "indicator--520407b0-7410-44bd-acc8-b154e85b14a2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73feddc9-208e-4f66-b20c-e543c604c189", "sighting_of_ref": "indicator--c2c7413a-7686-4fba-8e52-8ef4f8445c7e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a345bf2a-ae2e-4308-858c-35f540c0c2e1", "sighting_of_ref": "indicator--a4183a84-1423-415e-a2d4-75178b858953", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95780774-88ca-4256-ae3b-8e00717d8675", "sighting_of_ref": "indicator--a4183a84-1423-415e-a2d4-75178b858953", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0314997-32c5-4dd6-9437-ab101752f5de", "sighting_of_ref": "indicator--d1bb40bf-aff9-46fe-bcb7-470f4a65608b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a1db0c6-8951-4a3d-822e-d4117bc10eff", "sighting_of_ref": "indicator--d1bb40bf-aff9-46fe-bcb7-470f4a65608b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e10bcfc-8342-4849-a0df-77fc61ff223a", "sighting_of_ref": "indicator--e1911750-2ca8-4a1e-add7-8b9b9789928e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca78e531-3ffb-4b20-a8eb-6139b9de4f94", "sighting_of_ref": "indicator--f556b01d-38c1-489a-adb4-b417bbb3ea96", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d338c13-d8e8-4dc4-a434-69965a94ddd5", "sighting_of_ref": "indicator--f556b01d-38c1-489a-adb4-b417bbb3ea96", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c16b15f9-2dd0-4b6a-81ab-bb75374bd9b9", "sighting_of_ref": "indicator--6c81b7d1-8c13-4a3e-9e07-3bdf8e04a2dc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fccb135-2656-412b-8acb-8f714c7c67b8", "sighting_of_ref": "indicator--f3a67026-3a8a-4223-a828-b8250c78fe87", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c6f30ad-617d-4ad9-810b-6bae1baa70b0", "sighting_of_ref": "indicator--cd95324e-4a6b-4dc3-920b-0636143457d1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c18c795d-a876-48e1-b9e3-cff14d095c6f", "sighting_of_ref": "indicator--44ddaadd-92d9-4ef2-95b3-082fd1337a46", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef4b1249-00ae-4e84-ade9-ed637df66297", "sighting_of_ref": "indicator--533ec9e2-16e6-46a0-9dbd-f7a90d652901", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9142da87-4c89-465d-a93f-3768dcc5f583", "sighting_of_ref": "indicator--f98e4b7c-7436-49d7-856c-673c7c6cd4e5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff6b5ef3-671c-46eb-80d0-58e8bbe04b39", "sighting_of_ref": "indicator--f98e4b7c-7436-49d7-856c-673c7c6cd4e5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22471557-6266-45c0-8fcd-1d0b7a2a711b", "sighting_of_ref": "indicator--7482f773-95c7-4323-a4df-7086d42c9eeb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1850639-2347-43f7-aa5f-b7d0e145f8e5", "sighting_of_ref": "indicator--35ec237b-a902-438a-8c80-a9fe25e7892f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ec0f42b-f542-4036-b265-a608e76459f1", "sighting_of_ref": "indicator--35ec237b-a902-438a-8c80-a9fe25e7892f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85884f03-d5fd-4412-a5e0-6cdc39390814", "sighting_of_ref": "indicator--d281677f-2d8a-4b07-a362-180505cd8124", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfc47082-d98e-4669-8d17-2f06f1c87e0a", "sighting_of_ref": "indicator--ea1be919-d5db-4e17-b401-9a4a58cf406c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edec77fc-2c72-4387-8374-534a440e76fc", "sighting_of_ref": "indicator--910f724b-f33b-432c-951c-ac3033ea1656", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--932fd5d8-5460-4258-b059-8a27c175e74a", "sighting_of_ref": "indicator--910f724b-f33b-432c-951c-ac3033ea1656", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2b597f1-4920-4f0a-91a0-0dc62b8858b8", "sighting_of_ref": "indicator--5c1ee8a0-d907-474e-a670-fb72a0ab4cc8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28aee074-63db-4b90-8366-701904b9a78d", "sighting_of_ref": "indicator--5c1ee8a0-d907-474e-a670-fb72a0ab4cc8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51e4547e-f2d1-4bf1-84af-2bb196178d5e", "sighting_of_ref": "indicator--38e9513a-6ab0-4124-859b-a6e6d8701ee2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d16c3bcd-8991-4337-891f-ca638c014ed9", "sighting_of_ref": "indicator--272f89c2-e1cc-4156-8be4-51e2ffe652d8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b1ffe1d-0591-4562-a09f-66cd48645377", "sighting_of_ref": "indicator--e91a498c-71f8-4f15-8272-f0900f740f90", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cae5514-8d4c-4e4d-b6de-a0b3ef2d321c", "sighting_of_ref": "indicator--e91a498c-71f8-4f15-8272-f0900f740f90", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--800dd780-dfeb-4778-84c0-8e667d5fd07c", "sighting_of_ref": "indicator--28f26526-5fa8-4311-8f60-984da2ecdf13", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5aebf467-3c99-4839-87d5-df35759e82ac", "sighting_of_ref": "indicator--90b03be1-dae1-4ed4-81e8-d9a0db32afe7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02d52aa2-0473-4344-b9a2-fe3ecb28c0f9", "sighting_of_ref": "indicator--90b03be1-dae1-4ed4-81e8-d9a0db32afe7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d8b7d89-ae88-473d-8895-d2e739a82f4a", "sighting_of_ref": "indicator--f4d4159b-7d5f-4af2-a78a-e6310edf66e4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9c5a94d-21d0-40d3-a2e0-db7e5edb6815", "sighting_of_ref": "indicator--daee3bba-4fb3-4017-ab05-f8e4cb159d32", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f4dab57-d590-446c-a458-76e2ec877a71", "sighting_of_ref": "indicator--daee3bba-4fb3-4017-ab05-f8e4cb159d32", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--748954ae-6366-440a-9f21-d847f876f69d", "sighting_of_ref": "indicator--c6d996f1-4dd5-4d74-a624-6327f4458221", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0d4707d-71d7-4b9c-a800-c2f3923d9e7d", "sighting_of_ref": "indicator--3e53ac31-6688-40b7-a1fc-42ac5f4a07f5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31690209-3b6a-4378-a696-1dbf159022f7", "sighting_of_ref": "indicator--a596da41-a9ec-43cf-b515-b6585aa1702e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4009c9e7-8592-493b-a5da-29098f224067", "sighting_of_ref": "indicator--1aef0308-cd9d-4d56-a8a4-1d8e3c8313ae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bce7fae6-8e11-4a21-b6c8-07c34d48f939", "sighting_of_ref": "indicator--aa9cec45-26f2-4fbe-a57e-68a1b504b75b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5ef998e-3a16-45ce-bb25-1dede200a710", "sighting_of_ref": "indicator--aa9cec45-26f2-4fbe-a57e-68a1b504b75b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5561f575-573d-43cc-8c7c-908b4cfc48e4", "sighting_of_ref": "indicator--e844f83f-3401-4e67-abb7-65daf49e8822", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47f6a8b2-37c4-49a7-a84c-cf53b6beae20", "sighting_of_ref": "indicator--e844f83f-3401-4e67-abb7-65daf49e8822", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94d82ad0-aa16-48a4-bd77-434b67aa711d", "sighting_of_ref": "indicator--00130adf-9f4e-4339-a412-ab82cb24c182", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b383610-0db3-4112-8ee7-a60dc523c200", "sighting_of_ref": "indicator--00130adf-9f4e-4339-a412-ab82cb24c182", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35c6db92-bd28-4d36-b000-7b8e0c84a603", "sighting_of_ref": "indicator--f81c7555-78b0-46cf-97bf-e04d765da467", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41237cb7-e1f4-4fd4-8f42-b3a8a0e68002", "sighting_of_ref": "indicator--763cfaaf-42b0-4292-80b7-b626335a8c2f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--605f1d71-68e9-4b29-a64d-db0c385d3620", "sighting_of_ref": "indicator--b616e331-64a2-48eb-a4fa-100469b12fc4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89cf89b6-a647-4298-b394-d1cb69f7bc72", "sighting_of_ref": "indicator--b616e331-64a2-48eb-a4fa-100469b12fc4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33a8cdf2-0f65-4527-9abb-b037b1c6634e", "sighting_of_ref": "indicator--bc5f47c6-0bd3-4bed-b51d-2cd671605013", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e683f62-33aa-4900-9292-15ce12b7bec5", "sighting_of_ref": "indicator--e5702e6d-eaab-42f5-8172-2bc376a42716", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca9c2961-267f-4d31-a62b-cda997f55d21", "sighting_of_ref": "indicator--e5702e6d-eaab-42f5-8172-2bc376a42716", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18fcd4bf-8799-470e-839a-640d3d9ab38c", "sighting_of_ref": "indicator--27985d99-eb69-4f5e-89ba-3af33a09d719", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9c2331c-3367-4efe-b686-5d903256bf2d", "sighting_of_ref": "indicator--2f807365-a0ce-45fa-8ded-94ef52d58548", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--373b44ed-d4dd-4dbc-a783-fda355cfa671", "sighting_of_ref": "indicator--08864493-7b28-45b9-bdda-0d12a690864e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ead806ae-0e22-4f16-ba2a-0a6c0d34bd94", "sighting_of_ref": "indicator--86a13a14-80bc-4c7a-809c-dc90a782217c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bad03e11-a825-43fa-94a8-d911d5194ced", "sighting_of_ref": "indicator--66607288-479b-443f-99d5-0a536157eace", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af03db5b-e4b9-48b2-a98a-89cd0dc8557a", "sighting_of_ref": "indicator--8715591a-96d2-46ba-9704-8227767a4313", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd9c30b9-74d1-4914-9ffb-9b0d9e4e9d38", "sighting_of_ref": "indicator--01eabf7e-0894-4542-a123-336fa79f5b3c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--578ec4ab-3e4a-4aac-9e03-043d106c96a1", "sighting_of_ref": "indicator--01eabf7e-0894-4542-a123-336fa79f5b3c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edde4c43-0ba1-4541-a674-3027ce0b65a0", "sighting_of_ref": "indicator--064f4929-e8c4-4b16-b05e-92d4e61cb6af", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f146749a-bdad-4133-b2e2-9c658753f95c", "sighting_of_ref": "indicator--302eecf3-b487-40cf-bf62-cca195a91b51", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54836533-8faf-4fb5-b662-4ee821189e70", "sighting_of_ref": "indicator--7ef69d6c-0b14-407e-9b73-907d4a7eb031", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a920080-3915-42c7-8bb8-70a9fd9b9a52", "sighting_of_ref": "indicator--431e4547-a5d9-48b7-8cd7-a9d1a354eec4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ec42441-d4da-4cf5-b134-f77b53359b5d", "sighting_of_ref": "indicator--431e4547-a5d9-48b7-8cd7-a9d1a354eec4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62e31dfb-f1bb-4b20-82ba-7bfc62b9b0fe", "sighting_of_ref": "indicator--9b10825f-c846-4c30-a2b0-fee68d1553b1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73a00d3b-c359-4e7e-8ee4-00b17336d188", "sighting_of_ref": "indicator--9b10825f-c846-4c30-a2b0-fee68d1553b1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5ad7b4e-85dd-4782-9078-945ecce0c45a", "sighting_of_ref": "indicator--824cc709-fa21-4a95-a305-19750fe5edd4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32e0f31e-e0ff-49a4-97fa-d31d53921270", "sighting_of_ref": "indicator--824cc709-fa21-4a95-a305-19750fe5edd4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3f94a3b-f622-47f4-a052-fde953ad1efc", "sighting_of_ref": "indicator--61a5c22e-1e5f-4699-bfa9-c4321f03a0d9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ad2d70a-440f-47c4-9a96-be64e8196cf6", "sighting_of_ref": "indicator--356c945b-5f5f-4aaf-ac06-07bc9e1e7ff3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cae1166-a6cd-4a5c-ba5f-90bd07f153f6", "sighting_of_ref": "indicator--e5b5b707-ccec-4555-b908-4990c41a1de2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e29a38e1-a059-45d4-98e0-bfb223ffa3db", "sighting_of_ref": "indicator--e5b5b707-ccec-4555-b908-4990c41a1de2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--457648ac-bec1-4f4d-be2d-b5fca72b9cf0", "sighting_of_ref": "indicator--81c23583-001d-496a-af04-c612fc197c93", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e328ad42-6480-4d2e-9578-e79b3589bd74", "sighting_of_ref": "indicator--81c23583-001d-496a-af04-c612fc197c93", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c86aaef4-6100-4f9a-bae2-7f64cc8f4e57", "sighting_of_ref": "indicator--513654dc-2623-4959-96e1-1c1b59cd59c8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08966623-79d4-4b5e-9dd0-5b894cad0379", "sighting_of_ref": "indicator--e6f1685b-578b-4c25-bcc7-87364c563bb7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d6725fc-9736-4a9c-ac82-9f542604fad8", "sighting_of_ref": "indicator--65556829-4d35-4c4b-bda8-86fec406150f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df664f2c-73df-4280-95fe-acdeaa939d7a", "sighting_of_ref": "indicator--1baf24d1-73fa-48c0-bd64-4c2a7bee749a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2a7895c-b9a0-4d10-a888-ff4589a0f01b", "sighting_of_ref": "indicator--74052187-4990-44c3-aab1-22ca029b6ac7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a9c0d5d-ac3e-4aac-bd1f-95f0edaf2c01", "sighting_of_ref": "indicator--0a044cd4-e9c9-48e4-a8c1-d7034c1ba982", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad5923ca-af7f-44d2-99f7-73751c7563f2", "sighting_of_ref": "indicator--24d8674f-6af8-4509-b57b-3572a463f8f8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c920bd8-dcb2-47ed-83c2-c33bec549542", "sighting_of_ref": "indicator--b59dc970-b143-4225-ac3a-dfcb8d24912d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--396eb068-6fba-42bb-bc7c-a5dddfb12072", "sighting_of_ref": "indicator--b59dc970-b143-4225-ac3a-dfcb8d24912d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b084edd7-fef3-4410-a85c-ac11ebc02b00", "sighting_of_ref": "indicator--0a485012-5e27-4be6-b825-0322537ec889", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c711b5ee-5e0f-4864-89a7-7634c3af8ca7", "sighting_of_ref": "indicator--89750b36-bc61-4d1b-869e-3781ba00702e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa467be9-9e82-4ccc-8a14-c96488043391", "sighting_of_ref": "indicator--3eef6981-e70e-4a4f-9909-41262ed8b98c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96f1d542-23c9-48f0-8d65-7e09220d6855", "sighting_of_ref": "indicator--3eef6981-e70e-4a4f-9909-41262ed8b98c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f4fa584-6a85-4dd6-8d7c-70e752ca1b3d", "sighting_of_ref": "indicator--6d90f641-427e-4ee9-9c13-694667d316d9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f726b905-8b1f-4a1b-a84a-aedaddcea9cc", "sighting_of_ref": "indicator--035d62ef-29e9-4b27-8c16-7dd634c6ff47", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b74e892-240f-462f-b015-4c0cb8eedbae", "sighting_of_ref": "indicator--7cb450e4-fbfc-4995-b7ae-15417ea661b3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70e8a7a9-f7f9-408c-875e-c1b1c5099453", "sighting_of_ref": "indicator--3736944c-ae3c-4bcf-ad6c-21fb1c9b1bd4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34fc52f5-2fd7-4f78-abe0-15f44d3ad3a1", "sighting_of_ref": "indicator--acdee2f4-b739-4097-a962-becb6c55652a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--910db324-38b8-4f28-b953-5f0f12843129", "sighting_of_ref": "indicator--acdee2f4-b739-4097-a962-becb6c55652a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16a9c84a-9326-483f-b990-fbed0fd8239d", "sighting_of_ref": "indicator--39490d0e-8974-4108-87d2-61eaa7431ed6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14c7db59-04a4-4ce6-836b-b736bba5cd58", "sighting_of_ref": "indicator--39490d0e-8974-4108-87d2-61eaa7431ed6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e87655e-6714-4185-af12-1609cfa30988", "sighting_of_ref": "indicator--64d9a23f-21e1-453e-83f2-511b84c7172c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1b4b848-a356-4e84-8e21-672bb0a84545", "sighting_of_ref": "indicator--64d9a23f-21e1-453e-83f2-511b84c7172c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3514a9e4-aa85-4fc4-adf6-5c128b66c2aa", "sighting_of_ref": "indicator--3670f563-1420-43fd-9410-22e6eec9ef55", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a5851b6-38e6-48ee-9dce-ad88d114ec8e", "sighting_of_ref": "indicator--0d0edd73-cc13-408f-8c1b-bc1c5ac4afe6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b77bd49c-a65f-49ff-947e-e13438b07938", "sighting_of_ref": "indicator--88c0d3b0-19aa-4e69-b241-1defa2db2418", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a52eada9-ba43-46c3-9c32-47262d449477", "sighting_of_ref": "indicator--88c0d3b0-19aa-4e69-b241-1defa2db2418", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b723236f-8a81-4a7c-bba7-d9a5a585305a", "sighting_of_ref": "indicator--0da2eaa6-153b-47df-ba9a-fa9d92e571b8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f513577-036b-4b8d-b0d0-d70a85dcde37", "sighting_of_ref": "indicator--0a7bdeec-4d26-4892-83b0-75dd82418139", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bbd263e-62f1-4604-a5ab-aabeea45a5f5", "sighting_of_ref": "indicator--0a7bdeec-4d26-4892-83b0-75dd82418139", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6020e934-572c-4528-b8eb-b6ef83aea9fb", "sighting_of_ref": "indicator--80717376-3998-4434-96a8-b0f69a5c222e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36a20db2-d76c-4400-9fdb-d69aa9a9cb64", "sighting_of_ref": "indicator--80717376-3998-4434-96a8-b0f69a5c222e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1643349e-0de3-4aeb-a551-106eb0b401ab", "sighting_of_ref": "indicator--c3f0173b-373e-479d-a9ef-899d3ff96ea4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--846b3427-2590-42b4-b1dd-d689c530a444", "sighting_of_ref": "indicator--653c7fd4-94f7-454e-8db3-53619a84de0a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b9eeaab-05ef-4934-b326-4f9bd5c60ec5", "sighting_of_ref": "indicator--653c7fd4-94f7-454e-8db3-53619a84de0a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--330f3406-f335-4d63-9eda-37d3eb6996e4", "sighting_of_ref": "indicator--69534325-8b5a-4ab5-8e8c-505c204c4a97", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cfbbe81-c936-444c-b6ca-4dd5b8b9cacd", "sighting_of_ref": "indicator--1e945308-0c69-4406-b01e-2f48939d0011", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--201051cb-efff-4995-b34f-0ce431a86e7a", "sighting_of_ref": "indicator--28d6b63f-ae7c-42c1-85bc-48a3f96a6fba", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4264e47-deaa-4205-863f-f29a1784f35a", "sighting_of_ref": "indicator--ac90cdda-33b5-4037-85ef-f6e475f9fb91", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80ac4350-7859-4801-bed6-fd44c0ac08e1", "sighting_of_ref": "indicator--ac90cdda-33b5-4037-85ef-f6e475f9fb91", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e884572-0c26-42b0-88d5-628441cb5bcc", "sighting_of_ref": "indicator--e051d9fa-ae84-4655-a13e-2b33dc2140ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0385db7b-9da1-4c49-a93a-8c79c31bbeb7", "sighting_of_ref": "indicator--2182b2c7-3635-44cf-b56b-7f6070f329b0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--deed9f87-c23b-4888-a9f5-5afe5ff2c95e", "sighting_of_ref": "indicator--fc3711a1-4c78-49d5-84de-a2cefc2686ef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5bf1c32-292f-4d3e-b098-26768b961ab2", "sighting_of_ref": "indicator--f2b3455a-134c-46e4-afa2-2799387ddc60", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33c1ebed-bcb2-4a16-8f1e-f24f612fb0b5", "sighting_of_ref": "indicator--0505a702-5a5e-44a9-981d-dc7d7d68ff42", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f6cebc5-4ab5-4b73-b976-393beec8816e", "sighting_of_ref": "indicator--4d7c9566-067b-40b9-a63c-9c953c3e5808", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d75f601-ea16-4d9d-af8d-6a4cadc27436", "sighting_of_ref": "indicator--4d7c9566-067b-40b9-a63c-9c953c3e5808", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3230207-f7ca-44d7-bcec-eeef6d385640", "sighting_of_ref": "indicator--f381a38a-260d-4df2-ba25-405c14732865", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17935060-c132-4fc0-a80f-11710126a759", "sighting_of_ref": "indicator--1722417e-0022-4ab1-ac5c-95ac1fff2295", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65ac2c0a-3c4f-447e-9eef-1a51410054fd", "sighting_of_ref": "indicator--c17f2a1f-7ded-494d-bf42-46084fe3c587", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2d863e6-d337-4d22-b15b-f2729de8112c", "sighting_of_ref": "indicator--c17f2a1f-7ded-494d-bf42-46084fe3c587", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce167d86-2f1c-4c21-abac-9e2f8a4d0c31", "sighting_of_ref": "indicator--996c7d35-ad0f-476a-9886-a2a8cd1e70e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b838e8e-f808-4b46-9473-ad149fa8d744", "sighting_of_ref": "indicator--996c7d35-ad0f-476a-9886-a2a8cd1e70e6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--728b92d6-3ae4-4b0d-8b53-581719c8f525", "sighting_of_ref": "indicator--563b0bf5-e347-411c-8335-47bbd4397656", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--409cd334-9800-443c-884b-701a48eeb3c5", "sighting_of_ref": "indicator--563b0bf5-e347-411c-8335-47bbd4397656", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a998392a-144a-4b82-9ac0-e3d843564414", "sighting_of_ref": "indicator--98fa1eaf-d871-46ba-99b1-0329af93edcc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6e11927-84d8-490f-9765-fdf3189819c7", "sighting_of_ref": "indicator--7fdbf785-6a7d-40a4-8a18-8071b3c3d974", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f953939-2b57-4af8-8cfe-849759db5c1f", "sighting_of_ref": "indicator--6978d4c9-3151-4cb8-a41b-6bcd6545ab12", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b837ea1-0a61-4e19-90ea-1d7cc3cf2ad1", "sighting_of_ref": "indicator--44e3d7a4-b893-46e2-a5ac-40cd9d0b60c7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bef0d23-5363-45fa-ba08-8e0f900c8501", "sighting_of_ref": "indicator--0d386112-872c-488c-8997-4fdc14d5bfab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--befc73ee-68e3-4239-ba49-32716c3d7a67", "sighting_of_ref": "indicator--945af1d8-006c-4b08-867e-481c1584dca6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a201d606-5bf5-409a-a8d4-b394a4ab6a84", "sighting_of_ref": "indicator--3c4782a4-7197-4c86-9bfd-8727534df91a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72f720a2-532f-4dd1-a25c-ac87b709e906", "sighting_of_ref": "indicator--efac467f-7c87-457f-993e-7b3d876f7484", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d439f209-b419-4c2b-88a6-63dce6417004", "sighting_of_ref": "indicator--1a16caa5-9cc8-480e-a34c-68efdcf1f268", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d17e03c-0a1a-471f-b4f4-8ee2c304280c", "sighting_of_ref": "indicator--ab33bdfc-e676-450f-9366-a91814ab6f9b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c26b83cb-61e5-497f-bbaa-683d6a66ef42", "sighting_of_ref": "indicator--7f97e6ed-15c6-44c2-99af-e9b13c305b06", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f891c23-2e5a-4d19-8da0-da5699dd87f8", "sighting_of_ref": "indicator--7f97e6ed-15c6-44c2-99af-e9b13c305b06", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6eb99ed-2ae2-4790-ae5d-d42e78177ad0", "sighting_of_ref": "indicator--7a3a19da-5677-4502-ab0d-e9f2cf87cf45", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26b0e79a-3e2a-4069-a9c7-9365ba6a26ce", "sighting_of_ref": "indicator--e527f581-971b-4a6c-91fd-031fb978e9ca", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab9ff131-d95f-486b-99f2-aff73a13275a", "sighting_of_ref": "indicator--49e0d98a-60ba-409d-8b8d-61a66ee5a09e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--853ef293-2008-4a66-bb94-f288744be25e", "sighting_of_ref": "indicator--82f9023a-1570-457b-9175-bf06e1b720e9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--062da2a8-6973-4d83-a206-db12027ac618", "sighting_of_ref": "indicator--aa0f797a-e1ea-4b79-b5b7-507be509ac35", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43ec977d-2c62-452a-8901-35a55a768ca7", "sighting_of_ref": "indicator--aa0f797a-e1ea-4b79-b5b7-507be509ac35", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d051f8ab-15dc-4ba9-b8e8-a35919937cdf", "sighting_of_ref": "indicator--3a16686b-1f27-4ab6-b5ef-22f27d58c7f1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edd21ee6-f795-430a-b789-6a50c656d8a4", "sighting_of_ref": "indicator--e6ef8e37-f56e-4fa2-b2ea-37fc5dbd74f1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de8fac48-1bab-4ade-a9e7-becc0067a17a", "sighting_of_ref": "indicator--ecb9c26f-260a-4c29-ba1a-78128fdb0537", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd3f99c4-9354-4b76-a5f3-c795b60fc724", "sighting_of_ref": "indicator--ecb9c26f-260a-4c29-ba1a-78128fdb0537", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a7c2794-ac2b-4ea8-879f-13aab88bc8fa", "sighting_of_ref": "indicator--620611f3-0cc3-4c4c-8237-fe22ae90d273", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea7376e6-ab58-4f83-aff0-04452e0200e8", "sighting_of_ref": "indicator--620611f3-0cc3-4c4c-8237-fe22ae90d273", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4dddfe4-fd2d-484f-9dde-64f45a5d5250", "sighting_of_ref": "indicator--926474df-f11f-4b88-92d3-e17ee0f4c3ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7910f1f5-0b4d-4126-a2e5-4593653395bd", "sighting_of_ref": "indicator--c2b708c9-88a4-464f-addc-cbdcc4db55e5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--480db404-c0ed-4bb6-975a-8a01d584d106", "sighting_of_ref": "indicator--b646c488-7dc8-464a-8c8f-c1204604e391", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a79be93-d749-4d65-9fce-5f151f73143e", "sighting_of_ref": "indicator--160eb2df-508c-4aa0-819b-95d19c87bd1e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c3a1e41-5e12-4aed-b508-e574a569ead1", "sighting_of_ref": "indicator--43fb8fc5-39c5-45ec-9fac-8d00b8d52306", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68fc062d-1642-4802-8b4c-9732eec682a0", "sighting_of_ref": "indicator--43fb8fc5-39c5-45ec-9fac-8d00b8d52306", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e74551b4-9550-424e-be47-0628788747b0", "sighting_of_ref": "indicator--1ca30c3d-e3e1-4c50-b45d-02468da9f782", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--885b1202-6255-4965-a753-ee3b06b2afb2", "sighting_of_ref": "indicator--a1b7da07-2de8-4478-bc99-ca05b5ad2fd9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b6e8aa1-3a1c-481a-b6c3-0d6f1bf79140", "sighting_of_ref": "indicator--a1b7da07-2de8-4478-bc99-ca05b5ad2fd9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8303253b-4ace-4fd8-9b23-d750b7aa2ecc", "sighting_of_ref": "indicator--b56e0317-4e84-4470-9a5a-8f7c4748a0c4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61949fd0-1fa2-4528-a236-39bc6e7b2e39", "sighting_of_ref": "indicator--26bf74b7-df69-487a-a8b4-76370b03707b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0e49923-3f58-4742-815d-b2be2a490016", "sighting_of_ref": "indicator--a38cf514-6f43-4b21-8246-40e076d40d0f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cddaf86-45df-42f6-8419-05cedf4daaae", "sighting_of_ref": "indicator--bf27c208-4e90-4ae6-a059-42d45530372a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff65929d-33bc-4ba1-b4e8-de6322d813f0", "sighting_of_ref": "indicator--a66ae81f-1aaf-4611-bc8a-19cbd2583849", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--259942c1-b806-4435-8a97-73ae0022322a", "sighting_of_ref": "indicator--a66ae81f-1aaf-4611-bc8a-19cbd2583849", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b54604be-4838-47f9-8168-8c584e73f06b", "sighting_of_ref": "indicator--8d08dad9-af55-4386-87e8-8520b8ba9834", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--deabe480-819f-4de5-947d-3830dd14d30a", "sighting_of_ref": "indicator--93f0b74d-f205-492f-be52-c6ca05ac9331", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1715d8e8-73ed-449f-bcf9-f57a751e3b86", "sighting_of_ref": "indicator--93f0b74d-f205-492f-be52-c6ca05ac9331", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88d6c43e-84c8-420b-992f-241186ec3ee6", "sighting_of_ref": "indicator--8b7bd734-9eaf-4bb5-8e61-d1c6c0c2a0ad", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47209f76-e675-46d6-b7f6-93db531c5eed", "sighting_of_ref": "indicator--bfd380f2-a1bf-4aad-991f-7f472e092658", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bc15d50-5160-412c-9b50-19427b13c668", "sighting_of_ref": "indicator--d60c3c75-e394-4e5c-8b6e-43ba4c59d603", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfa383bc-f0b7-4636-aad8-7a3d7d1e1b88", "sighting_of_ref": "indicator--d60c3c75-e394-4e5c-8b6e-43ba4c59d603", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5c7a67d-67f9-418f-9f9c-8d247a06f68f", "sighting_of_ref": "indicator--9d6b7d13-5b07-47d5-9d5f-04f176386e98", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2674e83-c686-4f66-910f-cd2b3717ec06", "sighting_of_ref": "indicator--5fd9694f-ea58-4f8f-b8cf-b75fd9bb9443", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ff8a21b-cae5-4dea-86da-781545768785", "sighting_of_ref": "indicator--5fd9694f-ea58-4f8f-b8cf-b75fd9bb9443", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7dfeeae-deb0-4f91-ba88-9e65d687a74e", "sighting_of_ref": "indicator--5b8cea5b-79e1-4c6e-9845-c1a0a21832e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5397d9be-8f61-4544-95fb-9b90a2a910f3", "sighting_of_ref": "indicator--2e40ff04-31f6-450e-8eca-51a9c1f7fd43", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7436f7d9-398e-4325-a4de-1ecbd186ca9e", "sighting_of_ref": "indicator--3cc75446-dbd1-4ba2-b4a9-69e4d456b58f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--388e09e7-4ab4-4f06-ba15-b7e51d15e486", "sighting_of_ref": "indicator--3cc75446-dbd1-4ba2-b4a9-69e4d456b58f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8559ad3d-60a7-4837-a0d7-8e6cabea20ac", "sighting_of_ref": "indicator--cf6de188-95f1-41fe-a69d-3081e9f0c3c9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08763992-ddb2-4656-8552-163ced5b5274", "sighting_of_ref": "indicator--1d40422c-2518-488e-a6a5-8a365076c7ef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d69e0fce-e2d0-4de2-baf4-18226edf54dc", "sighting_of_ref": "indicator--1d40422c-2518-488e-a6a5-8a365076c7ef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6bd0dfb-af28-4168-bf46-f9f1e00f68a6", "sighting_of_ref": "indicator--a056734a-15d0-4b5d-ab7a-b9d9541a6a1b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--809d8b8a-c884-4a13-bad9-ea05989f34a9", "sighting_of_ref": "indicator--44fa1c92-89ca-47f7-a562-38fe63cc10c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0fd8548-3548-4e88-acba-e1e80590919b", "sighting_of_ref": "indicator--236970e6-a53c-475b-aa85-e8ffd883565a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84a58b50-74d9-4588-8f56-91a827268521", "sighting_of_ref": "indicator--14167b8c-f49f-4d4c-9f50-a8d5b9ff780f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4187ae0d-e0c5-4a0c-96d3-bd4f2deb1edf", "sighting_of_ref": "indicator--4b6e6ab3-46fc-4469-ad0c-c40107eb1098", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d47c0a40-0cca-4a38-ab93-aca4460b56b1", "sighting_of_ref": "indicator--64129437-dbab-44f8-8558-94da25f07f2f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5650771-198b-473e-9055-1f9da5f4196d", "sighting_of_ref": "indicator--ba60f951-d615-42a7-a3c3-1a00bda52e03", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32dbc150-e05f-4775-b43f-1e319dfbc62b", "sighting_of_ref": "indicator--ba60f951-d615-42a7-a3c3-1a00bda52e03", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a7c81d9-ca12-4df4-95d8-ba2947cd1dd0", "sighting_of_ref": "indicator--145316f3-91de-4a5b-b77d-04a233602eaa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc347972-fab7-40b6-a6e9-efa4a9bef8ba", "sighting_of_ref": "indicator--516838be-9163-44c1-984a-5b8f909e485a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efd1f483-5f26-404b-8f36-bbb91d39be84", "sighting_of_ref": "indicator--09d20580-0c89-4858-99b0-fa71d6cd99f5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13373e12-0be1-4126-b1e4-da56953dfa65", "sighting_of_ref": "indicator--a9768c69-9b94-4ddd-8fd7-24ca92668bc9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab0af4cb-9394-4ad0-b223-be6305495969", "sighting_of_ref": "indicator--9ecd0283-a897-4ad1-860f-7261cc562e38", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48a7d29a-2c95-4e1a-93b0-5eea38591e3d", "sighting_of_ref": "indicator--9ecd0283-a897-4ad1-860f-7261cc562e38", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e82593f1-881e-43a9-9513-56cfe85ec15f", "sighting_of_ref": "indicator--1c1e7c91-85fe-4a1b-a5fd-abc4bff267aa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc606da2-4d63-45ce-8a08-b784fc4812b4", "sighting_of_ref": "indicator--8838d9a8-84e2-4ae8-8959-b167b37d52ea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--add5510d-7c6a-4010-9d2c-cadf9f8aa7f0", "sighting_of_ref": "indicator--8838d9a8-84e2-4ae8-8959-b167b37d52ea", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--246895c1-1ba0-4b71-9988-d8dc3153ab35", "sighting_of_ref": "indicator--0d5a90ab-5860-4d9c-a519-4831ee453137", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b226116-2067-471d-be89-3ffd3b72ecbc", "sighting_of_ref": "indicator--54662efc-c065-41c6-a283-0658e386be41", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6a8100b-c1cf-4e90-ac4c-d9b664206eb4", "sighting_of_ref": "indicator--54662efc-c065-41c6-a283-0658e386be41", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a9a1e6f-eb73-466e-a7f2-7e592178f6e1", "sighting_of_ref": "indicator--364ddf8e-d897-4139-a1ed-9fa1078aa5dd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d49cc743-2d45-401d-8b60-836ab5325459", "sighting_of_ref": "indicator--fbb1ac35-f04a-47fa-92c7-e5579182217d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--787c347a-88c5-458e-ba98-c75c667c5581", "sighting_of_ref": "indicator--212c4e8b-9d33-4562-9550-ef4bf42ea2d8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--beda4b36-4232-4e6f-b464-0e6c259664ba", "sighting_of_ref": "indicator--212c4e8b-9d33-4562-9550-ef4bf42ea2d8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d41c662-9304-48f8-8822-ccd24984c5d6", "sighting_of_ref": "indicator--41584da1-4949-48b4-af81-a457eced0dc5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f342bc8a-beac-429f-a15a-54867056a2f6", "sighting_of_ref": "indicator--e2068bce-6c97-4a24-b317-5bee17c10b53", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--913fb693-25c0-4a63-8008-dc361c82b19e", "sighting_of_ref": "indicator--55b1f232-e2a7-47aa-87b4-4a3a7f2daeac", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df4a1de2-58c3-4ed8-83f5-36d4adb412bb", "sighting_of_ref": "indicator--1568f9de-be1f-4401-8c33-4596b6c66ab1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--118795b2-2551-4dc0-b4fd-35d8c4aab1a9", "sighting_of_ref": "indicator--1568f9de-be1f-4401-8c33-4596b6c66ab1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--734fb376-b064-49d0-982a-a03687e72c1e", "sighting_of_ref": "indicator--19c32f81-c183-4726-b81a-914abfb60475", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a762a0d1-279c-4571-84cb-2257bc610e2d", "sighting_of_ref": "indicator--bb015b6a-27a8-46b6-a9ca-1013b1b9b702", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b2bd433-8f55-49d7-a503-e80c49c4aaf2", "sighting_of_ref": "indicator--bb015b6a-27a8-46b6-a9ca-1013b1b9b702", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df511a39-6043-462d-95b0-b2beaaea0da3", "sighting_of_ref": "indicator--06d207da-4120-43e2-a595-77ff2a6b7b70", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7598b5eb-7f4f-41d4-9b1e-69a5bc0eda4e", "sighting_of_ref": "indicator--7ea2768a-a1d0-4f7e-b6cf-2454c2d0cef4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e8a6abf-a23c-406e-a9a5-6f7978b6f5d5", "sighting_of_ref": "indicator--887e40dd-fc85-41ce-8f87-5f47bee4090e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d487f2cc-c952-4898-bb8e-56d675b5c39e", "sighting_of_ref": "indicator--304da6bd-2ec0-42a1-833a-01dc696f9f5c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0caf3828-2aa9-4fce-a357-745c0dfa94f4", "sighting_of_ref": "indicator--e5581017-35a6-4a92-b0cd-cef7eb03e6a9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9bdf573-2ef8-4363-92cc-c30f2a3e9651", "sighting_of_ref": "indicator--d18de0eb-a62a-4215-9cd4-8f8cb43a4fd1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d62d002-51a0-40ca-b08b-780e15acd8a2", "sighting_of_ref": "indicator--7cf7aa78-0393-494a-9519-3d964d197f76", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56fb299a-dfa7-44fc-a2fb-9e05b44109aa", "sighting_of_ref": "indicator--7cf7aa78-0393-494a-9519-3d964d197f76", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b60fdc9c-452a-495c-b092-63555ae195c8", "sighting_of_ref": "indicator--6b4f68ca-bab1-46d9-b823-61cf0be3ae5d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfdcc551-1b71-408c-811d-e6311c783ed9", "sighting_of_ref": "indicator--6b4f68ca-bab1-46d9-b823-61cf0be3ae5d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1a5c987-85ed-40fa-9785-28e6889ae228", "sighting_of_ref": "indicator--46c5326b-ea36-4c0d-aa34-eacacb88bd46", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dbdf101-cc22-429c-a7b3-cde4c09b75d8", "sighting_of_ref": "indicator--11cb19fc-522f-47d7-b746-f26b73beb67e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--073df73e-45eb-454d-87f2-bf6395fa2ffd", "sighting_of_ref": "indicator--11cb19fc-522f-47d7-b746-f26b73beb67e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4324fca-7feb-43c6-ad5e-846958817625", "sighting_of_ref": "indicator--313e098c-3b51-4832-9073-4ba13ba4082b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98aa2f6f-d367-4a1c-9698-0199cb73cbf1", "sighting_of_ref": "indicator--313e098c-3b51-4832-9073-4ba13ba4082b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91ad3c10-3a30-407f-8bdb-70745e3e0b2d", "sighting_of_ref": "indicator--2ce5158b-440c-4705-8eac-b938919563f2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7cabfbc-bfee-4570-b8bb-04759fb9635c", "sighting_of_ref": "indicator--2eec4167-1d69-4137-8266-0fc24ebfd8ce", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--126cf6b1-6154-423b-9394-0383e3429ab9", "sighting_of_ref": "indicator--2eec4167-1d69-4137-8266-0fc24ebfd8ce", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea8d0d62-e314-4ed8-ba41-af5bb1286e4c", "sighting_of_ref": "indicator--eae632b8-c771-43b4-b3ca-13a3387c4bb5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ce78050-7bcd-488a-aa4e-6430ecd8a034", "sighting_of_ref": "indicator--a4ee0a4b-70d9-41fa-9fb7-c9b401d356c3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7a35735-1fdb-4d8e-966e-31154a2df924", "sighting_of_ref": "indicator--a4ee0a4b-70d9-41fa-9fb7-c9b401d356c3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--879a8609-4a69-452c-b146-2d99dd9f05da", "sighting_of_ref": "indicator--eb769d0e-21b6-4679-a676-97b07fcb8f6e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de4a7e5c-0a47-4b57-8457-1e60434010af", "sighting_of_ref": "indicator--3dd37a20-d18b-48ba-9482-16666eea0631", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b1feedd-11a4-4083-bbc9-a0a04bf000c6", "sighting_of_ref": "indicator--3dd37a20-d18b-48ba-9482-16666eea0631", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a34e2447-6371-4adc-ac3c-619b3d2eb292", "sighting_of_ref": "indicator--fedacccb-ad08-4f6d-accb-e8e6370feaaa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2d0f5b1-838f-4e98-8cec-566c62ea4ef0", "sighting_of_ref": "indicator--fedacccb-ad08-4f6d-accb-e8e6370feaaa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--992db62d-e163-43cf-831d-83e8a1dd6ddf", "sighting_of_ref": "indicator--45dd398a-4449-40d1-907a-47c094e5d6eb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d225fcd-7ecc-483b-94c3-a7b6ea02ea49", "sighting_of_ref": "indicator--ddbb7d92-ff8b-4a89-ba68-9fe10a58dc99", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a101885-4e84-45df-ac3b-abfdeb565c0e", "sighting_of_ref": "indicator--f8bbd3cc-52fe-416b-b503-81156b6b83da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--834f0588-1174-4764-a102-660ada743e21", "sighting_of_ref": "indicator--f8bbd3cc-52fe-416b-b503-81156b6b83da", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ceaffe3e-2078-439f-a2c8-1d671f871349", "sighting_of_ref": "indicator--5c9bf145-dff6-4d5b-9b9d-daa93e785402", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a2e6322-06bc-4103-91e2-d7cd42c63631", "sighting_of_ref": "indicator--a7543bc1-59b9-41f9-92b3-29a8c8bc4045", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09ce1de0-93e2-4345-b288-682022318f14", "sighting_of_ref": "indicator--a7543bc1-59b9-41f9-92b3-29a8c8bc4045", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdc6e548-6183-4a98-8fd9-a5ce03b05092", "sighting_of_ref": "indicator--18882a00-5a47-436a-8a02-7c49ea71224f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ee55fa2-974d-4521-b0be-9feed5f3a214", "sighting_of_ref": "indicator--ed49b123-a492-4c56-ae97-4c06c17d7eff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1adf1dd-f90d-496c-a737-da3dcfe3558a", "sighting_of_ref": "indicator--eefc6acd-0f5a-42f2-8147-3f3b8b7d20ad", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fccaf5e4-8680-461b-8ae1-55ee272cd5d1", "sighting_of_ref": "indicator--8c8f3002-774b-48af-8c9d-5082f035c1af", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19285bd2-d07f-4824-bc09-a3da25b637b4", "sighting_of_ref": "indicator--dd78ac17-e85a-42f1-b18d-07a65ecdc18b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9daf6ba-a10d-4751-b54c-fc0bed789360", "sighting_of_ref": "indicator--dd78ac17-e85a-42f1-b18d-07a65ecdc18b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27a8f9d4-a637-4692-98d7-7460208e3097", "sighting_of_ref": "indicator--f10168b1-7593-44ba-99dd-f176c3afe087", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f93dce07-27be-41fb-b2dc-489d08f84e70", "sighting_of_ref": "indicator--b61af116-d928-4e92-8c2f-7bd53053bfe3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--395f250f-c0c6-400c-a2fa-1cb730208682", "sighting_of_ref": "indicator--67bda937-b6fa-41b1-ab0e-5e1fdaa67c67", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e2241d2-6c3c-4e83-8376-080c35900d60", "sighting_of_ref": "indicator--67bda937-b6fa-41b1-ab0e-5e1fdaa67c67", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7df760b-da39-4acd-8c13-3984612c57b0", "sighting_of_ref": "indicator--2597b77b-dc39-45fb-b6e2-9221eb374be2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90d57ed3-b62d-4c08-a318-471bba176c76", "sighting_of_ref": "indicator--11791d43-1e13-4aa6-8b7f-00f3661c2e2a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d889bc3d-4f89-4ec3-9ef8-da7b327a189b", "sighting_of_ref": "indicator--1ec1b814-fe29-47a0-8db8-fd7e6655ad6f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7eb3c1b6-1a15-4537-a3dd-b0ab863c52e1", "sighting_of_ref": "indicator--3c63ffb3-58b0-40fa-82bc-2f05eab538f8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2be59195-55f4-4eff-82a9-472a8061132a", "sighting_of_ref": "indicator--55349636-ca54-4d5f-86e4-3c0e20fe310a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21810c52-c5dd-4dcf-b5e2-3689f05e42e0", "sighting_of_ref": "indicator--566800eb-c671-44e5-9c9c-1906b2a67893", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f85597f8-5636-4187-a08f-57bd2e691117", "sighting_of_ref": "indicator--566800eb-c671-44e5-9c9c-1906b2a67893", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95045d30-ea2d-4654-b355-ca6d6d67b90f", "sighting_of_ref": "indicator--93e2d005-6c31-48ea-972e-50d68d1af71f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a19388e-4c89-4ca3-a0b2-9a02d8390e29", "sighting_of_ref": "indicator--952cd4bc-1542-4959-bc42-0a69fbb194c6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04a8f544-46ff-4c95-a661-1a78497a9788", "sighting_of_ref": "indicator--952cd4bc-1542-4959-bc42-0a69fbb194c6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce3d3347-63ff-4471-a725-609c1a2fb894", "sighting_of_ref": "indicator--6adba6a2-cbc0-4197-b253-e7feb1b5131a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ddc7d84-0de8-4286-a0ca-b1c6c902e5a2", "sighting_of_ref": "indicator--0a6119f9-f48c-4be6-ae15-9a00985ab6c1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f90e1b2-0e38-49dd-82ce-e9f5fddc99db", "sighting_of_ref": "indicator--377ccc1b-6ced-42e5-a127-509b22bd9dd4", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5fc637a-bbbc-41b6-9116-15d758fb71ae", "sighting_of_ref": "indicator--5d33343e-662b-4ccb-981e-5f6d13d783ae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41b4d295-76f1-41f8-9bef-4e146aec8d26", "sighting_of_ref": "indicator--03103db1-26c0-4878-922a-8bf4a9a33bb3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74ac0ad6-fe35-4efc-b3fd-46ddf1d7d423", "sighting_of_ref": "indicator--90829371-47bc-4be4-a84b-3cc16898e264", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b91fd7c6-f663-4921-bdf3-ed6ac7e69952", "sighting_of_ref": "indicator--c1ce916f-0568-423d-ad07-40a8714b3e87", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1b9d66a-58d7-40fe-b9aa-d582ec09a428", "sighting_of_ref": "indicator--8535df0a-5854-41cb-af46-9d8675c1b46c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--272c3734-df79-458c-a30a-08fa54ef22d5", "sighting_of_ref": "indicator--8c41c857-1c46-4858-9381-1c4d48a42558", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86e3b175-19b4-4da2-95e5-49fc1dcd6c99", "sighting_of_ref": "indicator--b19bea9b-dc7a-4d4c-a878-a7bfc577f8fc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef143ccb-cd53-44d0-b1fe-c27ed4bd3f45", "sighting_of_ref": "indicator--b19bea9b-dc7a-4d4c-a878-a7bfc577f8fc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0a3c66c-d3b5-4bef-9d0c-7b47ab9ffe39", "sighting_of_ref": "indicator--4eb2f59b-3f0f-4eaf-a90f-97fc789db56f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--697baac9-bc4c-4ad8-b258-6783ed557cf2", "sighting_of_ref": "indicator--d707388f-1ce5-455c-a143-6a8f99d3487e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2c7a047-1212-484b-a038-7bb53c6e2fac", "sighting_of_ref": "indicator--ada5bd2e-11b4-428f-a479-77a5e7457591", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c870301e-2995-446f-8294-9f766497e456", "sighting_of_ref": "indicator--ada5bd2e-11b4-428f-a479-77a5e7457591", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f26d703-903b-44a4-9554-c5e8623ec054", "sighting_of_ref": "indicator--1149b011-6f98-4917-aad4-ed917adfb127", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e9b0719-e01e-4740-8ebc-7d556621b6ec", "sighting_of_ref": "indicator--ad4ebc39-c2ad-4119-88fb-369df8517086", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef0f7d60-bbc8-44de-aa00-29f67e003927", "sighting_of_ref": "indicator--4a4e277b-3d4b-4a9a-a163-1a35bb591b7e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc0a1631-f254-49fe-9cdc-24145a2b3435", "sighting_of_ref": "indicator--837fdf70-fbb2-4e01-b775-07198ec7e362", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25708bc7-7a50-411e-af1a-a901a368922d", "sighting_of_ref": "indicator--86261bf9-f989-412f-84b1-fee97d4e9f85", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--666f2d1f-99b0-4005-a413-bcd363cee8b6", "sighting_of_ref": "indicator--58a893e8-9ec8-4519-b20b-e7ed7238f983", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46aac987-a4c5-4e41-9a3c-6cc2b375b4ae", "sighting_of_ref": "indicator--2cd6512c-2b0a-4b75-bca8-b3a5b243a692", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81c446b1-bb24-4d65-92e8-1b498c145945", "sighting_of_ref": "indicator--c78b0299-321a-48b2-8977-ddd44972c483", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--061e87d2-73ff-4d26-b977-a3284a7c0b5d", "sighting_of_ref": "indicator--0c027ddc-7f34-49ba-a422-51500bb1ae53", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d714e34-db10-4bb2-b80c-73b5192865a9", "sighting_of_ref": "indicator--00eaf6d8-82fd-4f0c-b507-1de3b398f0a0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--339d941a-15a2-4152-94d4-5547a0f2f572", "sighting_of_ref": "indicator--bdd29486-e3d0-4100-b7b5-4e4169e8b5db", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70eeb05f-06de-41b2-a9ee-71ffcc170e33", "sighting_of_ref": "indicator--e23d6b84-ddab-428e-8b97-91c4cac4a0ef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48948e15-a6d8-4f2d-896a-a70d9ae663d9", "sighting_of_ref": "indicator--ac37c98d-25e7-479f-b79b-5f71697293a8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10e9f0de-aac0-4fef-8859-7feb5e67b392", "sighting_of_ref": "indicator--fbe8a2c4-8cce-4c50-b5c0-0aa1e46c0a24", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2486175-d59e-4032-9d5c-aedb2d062704", "sighting_of_ref": "indicator--981d50f8-b8e0-4909-be53-3f5656ba3ee0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cfe3345-c1ce-4f6f-ab78-50568619d08d", "sighting_of_ref": "indicator--21efb56f-0c61-4a34-a57a-710ec5feca11", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24773e0a-14e5-4e4e-b02c-fdc32b792171", "sighting_of_ref": "indicator--7c388339-255d-42d7-809b-6419c0046354", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c69d2052-e8dd-43fb-b97f-29822cd47c3b", "sighting_of_ref": "indicator--7c388339-255d-42d7-809b-6419c0046354", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb624082-f34f-4557-839d-9f670b5da6f8", "sighting_of_ref": "indicator--51e3c0f7-d0f4-4c4d-bb57-07fc294f285a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--313448d0-1066-4d98-8f7c-9540715ce0dc", "sighting_of_ref": "indicator--51e3c0f7-d0f4-4c4d-bb57-07fc294f285a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f28243af-3b49-44be-a757-51fac166ad91", "sighting_of_ref": "indicator--bb1fc2c0-0399-4a1c-a792-c17c3aaa9119", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--348e925b-7803-4b15-8357-2cff82984210", "sighting_of_ref": "indicator--e3c4be07-fda7-4972-ae19-7d03318bca95", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a13a17b-0969-4e8b-b9ff-4471814a134e", "sighting_of_ref": "indicator--4e095fb8-3687-454d-bb0c-0862b5f0356d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--875996f5-7ac1-40b3-abf6-4b523d40b964", "sighting_of_ref": "indicator--4e095fb8-3687-454d-bb0c-0862b5f0356d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2bc5ada-df0a-4338-b0a7-108c4f1da399", "sighting_of_ref": "indicator--e7aae08c-f363-436b-a24c-8bf368af5d9c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5039d5e2-f5e7-4b9d-bed7-6b1a2c6ff67e", "sighting_of_ref": "indicator--e7aae08c-f363-436b-a24c-8bf368af5d9c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18d8af0f-42ab-4b7b-a76c-70861672153e", "sighting_of_ref": "indicator--e68e7a73-25f6-4dac-a047-6c5ce293f197", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3a4a2d3-bc57-48cf-93d3-95e621672751", "sighting_of_ref": "indicator--e68e7a73-25f6-4dac-a047-6c5ce293f197", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--744636ed-480c-4cb3-8e14-763b266ffb6e", "sighting_of_ref": "indicator--34f11866-c5ae-4147-b155-811d729006a8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--682f54c2-88f3-4a75-9a1c-8a784e789a93", "sighting_of_ref": "indicator--34f11866-c5ae-4147-b155-811d729006a8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87f2e5e0-24e3-47d1-8fae-012649ea11dc", "sighting_of_ref": "indicator--b9120472-323e-4630-9ca9-6e439ce4de96", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72142d1b-49f1-4cf5-aa90-052556de6a2d", "sighting_of_ref": "indicator--bb039616-8634-4252-a859-029da3a7b9e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fe09d43-767c-4c5d-ae4c-aaec714c77e2", "sighting_of_ref": "indicator--6778b9e6-10e2-42a9-9bed-792907d8ce0a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ddd059b-ad1c-4330-8214-8655dc8e0731", "sighting_of_ref": "indicator--e3d02c1b-e475-4dc0-8089-f8799a6e2aa7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55de09af-d5b0-495b-b99e-9fa8bdd1c965", "sighting_of_ref": "indicator--c2a5a2bb-3ddc-4435-a104-30cb92d76d26", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dfa290d-3cf6-47ef-af86-bcaeac85337d", "sighting_of_ref": "indicator--f58a6bfa-586f-4c50-97c8-af7fe1de24ca", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0906be06-1e2f-4cb1-ba5f-51480aef5da1", "sighting_of_ref": "indicator--920b5db2-9e67-412e-aa24-0ed84c089c6e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c26e947c-86d7-4b92-831e-b284e3a24df6", "sighting_of_ref": "indicator--ea3fea00-6b4e-4bf3-9e2f-687f0eee97a1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c2b316d-f9a7-4c22-935d-8b6feacafd4c", "sighting_of_ref": "indicator--ea3fea00-6b4e-4bf3-9e2f-687f0eee97a1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5130e6c-cec1-498a-a786-e886f9ff5814", "sighting_of_ref": "indicator--3b8716a6-fe18-407a-890c-87689c1f4963", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb92398a-80d2-43b1-8413-a48257bca5a5", "sighting_of_ref": "indicator--9c592cd0-4327-4933-ae6c-509d50d5ec07", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--402691c4-213b-4ede-ba9e-a505202acee7", "sighting_of_ref": "indicator--8732266c-46c7-4268-ae9d-28499508e328", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84ffc831-5294-4b71-a525-7195ea845a23", "sighting_of_ref": "indicator--d1d953be-3b11-47c5-b7e9-df8143dd8f9e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2e7580a-4342-4fc6-a1a8-ab893c4695bf", "sighting_of_ref": "indicator--ce11f4d6-c561-4afc-a881-68daf7de085e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ec6a1f9-fd64-49b0-b216-6e435f844a0d", "sighting_of_ref": "indicator--7f30b07a-0a86-4209-8723-96015b4b73c1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41b41d7d-ad77-47a4-8578-befacb5f500b", "sighting_of_ref": "indicator--a055ae25-c57d-4185-b910-60af6a125fe7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5dcf514-6b07-4205-8d57-05c1b957ac81", "sighting_of_ref": "indicator--079483eb-0554-49ec-9d43-778773107f6c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--745a8e4b-57df-46a9-a513-99f4410625a6", "sighting_of_ref": "indicator--6a2410a6-de72-467a-b276-50f4fbec7a77", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c8f0819-b430-4665-9aba-e565f5339c09", "sighting_of_ref": "indicator--6a2410a6-de72-467a-b276-50f4fbec7a77", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a1c6ae2-84c5-41df-a33e-ed9a5663ee73", "sighting_of_ref": "indicator--173345d7-80ab-4325-9f89-c670bcb902e3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24074144-131b-4548-ac32-1a3f0ed2857d", "sighting_of_ref": "indicator--37af8a1e-a173-4ca2-9e5d-c3e014e212c4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e75689af-e9c5-4b22-9cb1-6f4ef9eef461", "sighting_of_ref": "indicator--9b6f3f20-f4f3-4551-8321-d7a49410bfa5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1c689dc-3892-4052-bcd1-daf21a16f303", "sighting_of_ref": "indicator--2db3b2c3-d105-4885-8f48-a8f51dbd7aa8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--452d4258-cd08-49c5-acf2-7dd9c02ddac8", "sighting_of_ref": "indicator--d072c163-6a60-4ea2-8149-64a33be83bed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bc818d9-eec1-4b7e-9e53-4dd3de8eaf02", "sighting_of_ref": "indicator--d072c163-6a60-4ea2-8149-64a33be83bed", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e5a6dc3-0b30-4483-a36e-07de53addd1e", "sighting_of_ref": "indicator--64975592-399d-4afe-a76f-84524f622768", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15aec9a0-1870-4f73-9f00-31a446145aac", "sighting_of_ref": "indicator--0e8607a6-61cf-4e96-a929-1fd4d9f6ac6f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95b19064-ad1f-42d0-bdd5-8d3c87e21290", "sighting_of_ref": "indicator--7abb2855-6c1f-4224-acbd-bcbd37146d99", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d01f7c5a-5e5f-4fb5-897a-10ff9846d92b", "sighting_of_ref": "indicator--4753afcd-a93f-4345-9c36-9db161c556ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ffd8146-614d-4770-80f2-fc633462074a", "sighting_of_ref": "indicator--4753afcd-a93f-4345-9c36-9db161c556ed", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5779a121-3153-477d-a0b5-6c8ba05d59ba", "sighting_of_ref": "indicator--d3b2ab3f-2c3a-490c-93f6-d86e0ae07095", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c69cc1f-ce07-4d53-a694-c47265ed9a06", "sighting_of_ref": "indicator--9c858340-762e-416b-b62b-d760a5da35fa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b60210a-05d2-4594-8a56-2d6accaddf0f", "sighting_of_ref": "indicator--fb1395f7-83bb-46d3-8f2e-4162609ec062", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7c67f52-dd5a-4b5a-bf04-de7a87765012", "sighting_of_ref": "indicator--b2e99f03-1a1f-49cf-b4a4-2f3fb20d487b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a7e59e9-ab5a-419a-abc0-6b922592784d", "sighting_of_ref": "indicator--554838b5-ab7d-4f4b-ae6f-6f3484f0f746", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0d3869b-a180-473a-9e68-7ab85881c0f8", "sighting_of_ref": "indicator--598bd10a-498c-4680-bc09-cf87d0aee52c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--becc3610-3db6-49d8-979a-cfb4045910b2", "sighting_of_ref": "indicator--9c6f1e48-cbdb-4638-a50f-0ae728d32057", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f14a15e0-56e5-4d79-9ce1-56bba427e211", "sighting_of_ref": "indicator--fe3b6f83-ba93-4b9b-8c6e-e6dba4ebbcf3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aadfd4ea-4cbc-4987-a4a0-6423eadf18dc", "sighting_of_ref": "indicator--0cf4487a-bc17-4b73-8151-a73edfd50535", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--daa570f9-fe36-410f-b035-c27d870f0ee5", "sighting_of_ref": "indicator--9fb97986-1da4-4021-a2eb-12ba653f7313", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1800fb7-bcdf-425e-bb82-5da242b2df2a", "sighting_of_ref": "indicator--9fb97986-1da4-4021-a2eb-12ba653f7313", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d8611a7-1a40-4622-98f3-9a9eedb9c912", "sighting_of_ref": "indicator--c636fcff-a9b9-408d-b7bb-c315277ec598", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d22b7279-7919-4a84-9b5f-c58e42c0a729", "sighting_of_ref": "indicator--c636fcff-a9b9-408d-b7bb-c315277ec598", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bbd3a54-2081-4b05-a76e-0c18da963622", "sighting_of_ref": "indicator--7758e5da-40db-4509-8542-9fc411764ca3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a4b038e-3961-4a27-8eef-beb6c1683ced", "sighting_of_ref": "indicator--4f045939-2b4f-497f-baca-004ccaa62ed9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7079e44d-641b-49c8-884a-c709eea2f09a", "sighting_of_ref": "indicator--b0695964-a52a-4f11-9087-d5303e07ef6d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b5a2fbf-8966-4eca-bb47-2b011614ffa0", "sighting_of_ref": "indicator--3af34e2b-97a8-4712-91ba-d001031148e9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebb45f01-02bb-4a03-863e-33c41a1601a6", "sighting_of_ref": "indicator--3af34e2b-97a8-4712-91ba-d001031148e9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--254893c7-2b04-41ca-9f07-60380e8399c2", "sighting_of_ref": "indicator--3956cc85-24ec-46e9-bfed-02432da93467", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ac6539d-a3a4-4f54-be10-6f0f387824c9", "sighting_of_ref": "indicator--3956cc85-24ec-46e9-bfed-02432da93467", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb3794ed-09ff-46b0-a3f5-d91be73a9f01", "sighting_of_ref": "indicator--90feaed9-19c4-46c0-b00c-4975e997a90e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--783e1a57-234f-414c-a7dd-34b132c1acc8", "sighting_of_ref": "indicator--8efd5006-7cf8-425c-b7a6-1f05e117d98f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f57d5ea-a8a0-42b6-915d-55ea2517a132", "sighting_of_ref": "indicator--8efd5006-7cf8-425c-b7a6-1f05e117d98f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1f4c609-1fb4-4566-a3bb-7517c8ab3f0f", "sighting_of_ref": "indicator--8492e6df-c0b4-46aa-a83f-022e7f8098c6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe89e96a-8c84-4c1e-b681-6d6da4ac9ebb", "sighting_of_ref": "indicator--45e9b18c-8c26-4136-9517-d317daa8e7a0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3269ca38-f5e8-4274-9cac-c02883b29698", "sighting_of_ref": "indicator--45e9b18c-8c26-4136-9517-d317daa8e7a0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bbec063-01cb-4fd0-b3aa-729da2eda1e7", "sighting_of_ref": "indicator--2ff44f30-204b-407a-b84b-e0b5bb8738fb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5de9176-60af-4f48-8add-5d7ddb513269", "sighting_of_ref": "indicator--b47dd9b1-5c04-468c-9d9c-f5517b9c9370", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a79e7ca-aa94-497c-8a4e-2b0ea693738e", "sighting_of_ref": "indicator--9dad2122-92ed-4b44-9c2b-6a004bc13e66", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e36502a-dac6-4549-87ef-a0208aa4fa2e", "sighting_of_ref": "indicator--6d17ea2b-d695-4bd5-9766-000cc956b121", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28382be5-4695-4cdb-985c-b6ddbe21a8a5", "sighting_of_ref": "indicator--2950ad1d-f194-4c27-93de-d6c2fd85236e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--243a3398-fe03-4ee3-b890-e79dd7bca61f", "sighting_of_ref": "indicator--4c929555-c576-43a6-a1fc-22be137ebdf8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4ae2cdb-5fc2-41e1-b996-425b00b1e9ef", "sighting_of_ref": "indicator--755159c9-da95-40f5-828c-c01d0b9e4951", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--989a63e0-e421-43fb-9011-127caf86dd41", "sighting_of_ref": "indicator--8d14ac3f-d9d0-4248-a410-a9c49297319d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22497b2e-7f9d-48f6-bb10-94ee43ce95ff", "sighting_of_ref": "indicator--8d14ac3f-d9d0-4248-a410-a9c49297319d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb82dc32-c37a-4057-8442-974a6133f346", "sighting_of_ref": "indicator--1e2cf894-c5bc-4015-9984-993a7cfe5e3f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca0fc08a-c929-474d-abb6-d9a759f5e99e", "sighting_of_ref": "indicator--8409e8db-337b-44da-b490-0c2354f2ae19", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8e7ad83-c775-4b76-a4e8-83a55bb36a7a", "sighting_of_ref": "indicator--6ccdb3ed-f94c-4d50-83fb-87db922d51d3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ff84959-d138-4f64-af06-285891b17919", "sighting_of_ref": "indicator--6ccdb3ed-f94c-4d50-83fb-87db922d51d3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edbcad93-0c77-4ca4-8854-3183580da1ba", "sighting_of_ref": "indicator--275b0fdf-e32a-4914-9b58-cdd974b18579", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25d857b3-c59b-42f1-a91f-b4da70b94d93", "sighting_of_ref": "indicator--bd7df996-0f53-4317-8087-824ccacc2034", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af47f792-7aa9-41ab-80c2-1b5ed13f970c", "sighting_of_ref": "indicator--bd7df996-0f53-4317-8087-824ccacc2034", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcd2ed30-1e39-4251-b9fe-8ff7e4b22e7e", "sighting_of_ref": "indicator--37807f96-d04d-40b6-ae6f-ee9aef935e55", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db1e6227-d6a8-4f58-b856-e4d534bf6ea4", "sighting_of_ref": "indicator--1d40d08b-0f60-4738-b1d8-6207795c3e62", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a8cda8f-b539-49c8-a41d-c1a2e94df156", "sighting_of_ref": "indicator--1cb44f25-ebe9-4611-943b-8161b898d1c2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c0d964b-4378-4b4f-98bc-67c4336739d3", "sighting_of_ref": "indicator--dd99d236-551b-43b0-bd21-0fa87788ffd5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f36d299-1803-483b-bfc1-76d513e925e3", "sighting_of_ref": "indicator--dd99d236-551b-43b0-bd21-0fa87788ffd5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52c1e072-0376-48d6-89ab-fd8910b9aab6", "sighting_of_ref": "indicator--a6ad9614-e61d-45ed-bc33-f179a509d9d5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44e45d33-acb7-497c-94e6-24f6aa95c203", "sighting_of_ref": "indicator--a6ad9614-e61d-45ed-bc33-f179a509d9d5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27c3df3a-eae5-4c05-b88b-2e8b75c543e3", "sighting_of_ref": "indicator--fb07a558-a3e1-4386-97c3-fc788386ce1f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13b28849-c9f9-4bf2-a0d9-7ff1c85308c4", "sighting_of_ref": "indicator--7a408634-9ea9-4e3a-8a4f-e8c6e6e93a97", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--497874d6-ceee-4e80-a815-927fa911ea7a", "sighting_of_ref": "indicator--7232e177-379e-48d8-9925-577d51c88169", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b328e272-7e90-48fd-954a-2849470fa1be", "sighting_of_ref": "indicator--5c6c5daf-684a-4a0d-8aab-48f9529c5e3e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d0c541b-946d-457e-89d8-9562aca861db", "sighting_of_ref": "indicator--16af2154-4873-42ed-bdb6-6849de55d212", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f393e6a3-f2f2-476a-8a07-fc466f161675", "sighting_of_ref": "indicator--8db62350-ba3a-466b-8c59-416fd73e75d4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f5ce614-4089-4525-a8c6-717170c613f2", "sighting_of_ref": "indicator--b094cf7d-a8a8-4638-8a8c-a11b09e427d0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c57eaed2-6db3-4f9f-abec-b60f8aac5f15", "sighting_of_ref": "indicator--5f56d5ad-1876-4144-8397-85d6bd062a50", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0467381a-2fcd-4e11-a1bf-6ade13271c6a", "sighting_of_ref": "indicator--5f56d5ad-1876-4144-8397-85d6bd062a50", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41efe66c-a8b8-4123-8c7d-dfb9bb20aa5a", "sighting_of_ref": "indicator--c62cbef5-6029-4c56-b524-a8f158763061", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a51b7e7e-d0bc-44a3-811e-e87266b4c8cd", "sighting_of_ref": "indicator--c56a7535-b11a-403a-b797-d130807c69e3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d02a35fd-562c-466b-9b1b-00c77d92a0d8", "sighting_of_ref": "indicator--c014e437-3493-4f86-865a-27d9cc490920", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35577c18-3405-41e2-9025-78b294be33af", "sighting_of_ref": "indicator--c014e437-3493-4f86-865a-27d9cc490920", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ab325b3-c3af-48d4-97cb-fd9968f3d3b1", "sighting_of_ref": "indicator--8a06c558-1fc0-4498-aeed-bfe901b4e803", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0029827-9f28-4aeb-b2ee-4037eb45206a", "sighting_of_ref": "indicator--5b002433-756e-41ca-95e7-bcfd5398e6d9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08e8961d-e106-4394-9cde-b992deedb6e0", "sighting_of_ref": "indicator--26105f76-ee5b-49ae-9468-cb24d112802c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a4fdd81-ba43-48f9-b367-991ce2241f2e", "sighting_of_ref": "indicator--26105f76-ee5b-49ae-9468-cb24d112802c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5dbd34b-44f7-4932-9245-c2e011287dd4", "sighting_of_ref": "indicator--7f5d1cdc-5ccf-4747-b09a-0cd5fbef1b7b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05cb72df-7ef1-4aa9-9be3-ec8bd0843c56", "sighting_of_ref": "indicator--d199f484-8410-43a1-841f-786962c83cb0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10a7e74e-3a36-4592-be29-d7742837ca09", "sighting_of_ref": "indicator--d424a5dd-ac5b-44ce-ad0d-3a02eca19309", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62dc068b-6848-45f6-bb09-1b4c20e01afc", "sighting_of_ref": "indicator--a21ac3c1-1fbf-4f52-a8c9-3a3236853cc5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--198fb0f6-18f0-4c10-b05f-772cbbb8fbe9", "sighting_of_ref": "indicator--78ed1f47-cf4f-4bb4-9340-0eab2ea3f019", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05a13558-a793-446f-8b33-90446ace1fbd", "sighting_of_ref": "indicator--3883784e-b4b9-4a50-832d-ecd04d611a33", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8fc4964-298e-45ae-9691-4d229a5aeeb9", "sighting_of_ref": "indicator--3883784e-b4b9-4a50-832d-ecd04d611a33", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--799e1ab9-0a7a-44d0-aa78-0ef7fa763bb8", "sighting_of_ref": "indicator--a56bd2b2-91db-4123-b97d-45b20a53da65", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d4b3b4c-5e15-476e-84d6-4b86188806ca", "sighting_of_ref": "indicator--ab2e0773-5b24-4f63-9a97-22e50bd71d26", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42178087-d2ce-42f8-9396-44598c8da582", "sighting_of_ref": "indicator--ab2e0773-5b24-4f63-9a97-22e50bd71d26", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d66251c-de16-4928-8c4a-b552bade8ff0", "sighting_of_ref": "indicator--56273b28-71a2-487b-8215-86fb4c16ac7b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfb1de01-233b-40d2-895c-3b08f14ddd73", "sighting_of_ref": "indicator--b9b6dafa-9c97-40cf-a7ed-5a979d061f11", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c45a4421-a304-44ac-852c-00772ad93786", "sighting_of_ref": "indicator--4c5178f4-cdd2-4a40-bbef-481961461302", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b48761c6-5a78-4639-aa50-4137f55a3c3b", "sighting_of_ref": "indicator--e317cfda-73ef-4050-bb38-387fe89f311d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c40c7de4-aa4d-4284-bfcf-83568316f0cb", "sighting_of_ref": "indicator--bfa0944f-ccaf-445e-af3b-7fd978f4d2a0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c996fb3-a90a-4f96-af02-4e72c60b01a1", "sighting_of_ref": "indicator--b520249f-995d-416f-87be-60fdc7de7c78", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0c105a3-b0b8-42f6-ba4f-5390abc8cdb0", "sighting_of_ref": "indicator--f2a7afde-6d64-4aea-9177-f097216c6dfd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c12500d8-f62d-4420-a8e5-9c21e3799187", "sighting_of_ref": "indicator--ab3ff3c2-0919-41ad-a94b-0ea42b1f77f4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5d19472-4454-4fc4-a6e4-05e5ba5643fd", "sighting_of_ref": "indicator--123220bc-5179-49d9-80ae-243546b4a8ec", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42125c7c-1e47-4dcf-bfd8-23430ccb0e02", "sighting_of_ref": "indicator--288cc8ea-eb20-41f7-9259-b1d89a4e5083", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a02fb07f-5b1c-44d0-b925-6ec00d7db349", "sighting_of_ref": "indicator--de1b93e1-0732-47b6-9a4d-5628f9b5e98e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be68d192-b2cd-4859-a1c2-5982b166d998", "sighting_of_ref": "indicator--13229a0b-b9de-41d6-8f25-6b1173ed693d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5974ad6-4d36-4b9e-9628-2d32e41ad21e", "sighting_of_ref": "indicator--02bb143b-164f-454d-a08b-cda2320da74b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adf8db21-af71-4e5e-9ef7-6aebae486f1b", "sighting_of_ref": "indicator--02bb143b-164f-454d-a08b-cda2320da74b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4369a9df-b838-49dd-81c1-d3c182c9e03a", "sighting_of_ref": "indicator--890b8ce1-3133-4b77-85b3-b970533e8814", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--343ef568-43ec-4d32-853c-748246c541f9", "sighting_of_ref": "indicator--081a3914-2edf-46f4-8e16-18f67038afa6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0436548c-0725-4a70-8daa-32f32e34d473", "sighting_of_ref": "indicator--e0fdbf83-7d1c-4d2c-8c5d-92c8a2e60043", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c58eb511-526f-4957-9195-94cad88540ec", "sighting_of_ref": "indicator--e0fdbf83-7d1c-4d2c-8c5d-92c8a2e60043", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e76b573b-2e42-4cae-bd93-3ac4d22a01c7", "sighting_of_ref": "indicator--f8abdc2f-2976-4b2a-aad4-8f06622ac421", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32575767-3db7-495a-abad-609d8ce12fe7", "sighting_of_ref": "indicator--6701db9a-89d1-4caf-8a71-f83d448da244", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1543918d-7130-4bd4-a873-4317c1eca5bc", "sighting_of_ref": "indicator--854ccadb-1f13-449d-b337-73d9a882ac9b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9687abe1-5e3b-47c9-bde7-29a9e830ba03", "sighting_of_ref": "indicator--b8173151-838e-45df-8a2d-37181d3aa59f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--535cac5b-a632-4b7e-8bb4-6f71a7efcf2c", "sighting_of_ref": "indicator--6a34af67-2a0b-4a70-9c63-f43b8822d161", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51c47dc8-7fae-4f07-b580-bd38702baf1d", "sighting_of_ref": "indicator--da723568-9fff-464d-bd83-8cfcc20a35cc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7ced35f-03c8-4369-ab43-82f617e03ae2", "sighting_of_ref": "indicator--b4b4b285-36f9-49fc-bda2-0d9de273d902", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d439703-df0a-4636-bf95-ffb6eaad6be6", "sighting_of_ref": "indicator--6066612f-7c03-4096-b002-249511ef69e2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1827d67-8d5b-4dba-a174-7777d4047446", "sighting_of_ref": "indicator--82958ef0-ccc2-46ce-be17-5b749226e7ea", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c83a05c4-cfaf-4532-abf5-adf9b9117453", "sighting_of_ref": "indicator--c6e1cd4c-6894-4aa9-b0a7-086c3cb93c3e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d0886f1-103f-4bb3-88f1-89f96f9fc4df", "sighting_of_ref": "indicator--c6e1cd4c-6894-4aa9-b0a7-086c3cb93c3e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--511314ca-1e9e-4867-a217-ad9bd36af2e9", "sighting_of_ref": "indicator--19b98588-3f8a-474d-a63b-0f7844181777", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7380ad5f-0a43-4174-a1ed-0132f3820bf3", "sighting_of_ref": "indicator--f32339a5-433d-4c3c-affb-d4cbd5000df2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68b2819a-2dc3-4aa2-aaf3-8b54cbba219f", "sighting_of_ref": "indicator--f32339a5-433d-4c3c-affb-d4cbd5000df2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--250c9dbd-327a-4fdd-b30d-240d3bd33bb1", "sighting_of_ref": "indicator--c995f498-21b8-428e-bb5d-63273333f42c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e967700-a3a8-476b-88c0-8abc80076837", "sighting_of_ref": "indicator--28e8f067-f378-4e2d-a711-b83a3bec2451", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b782c473-5ead-4b3c-84b7-84c2066f1f00", "sighting_of_ref": "indicator--28e8f067-f378-4e2d-a711-b83a3bec2451", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3bcc130-88d4-48fd-aaf0-31656d37789f", "sighting_of_ref": "indicator--7b48b2b9-4fa4-4bee-a7b7-09fb0b441680", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--145eab6c-9b19-400a-aefa-2c0a83bfe1c8", "sighting_of_ref": "indicator--872042c9-432c-446c-9a63-21f36f7b40a6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d97befc8-b25d-45d2-bb1e-7884a3661388", "sighting_of_ref": "indicator--afe2a9f9-2204-4812-bdb6-ee3e2bd987b0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--947399db-fd37-46e9-9251-b25c537a25ca", "sighting_of_ref": "indicator--a90dba6d-8e43-45eb-ad8c-bd7910da9374", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49c5b491-4540-46fa-8a84-f3286f290648", "sighting_of_ref": "indicator--cce23122-4e23-4636-9bbb-7fe5e7998578", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0778fd56-4220-4af6-865e-585c7b2cacdf", "sighting_of_ref": "indicator--94eb8e52-f72b-493e-b347-f9fbf42a9e41", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92b91cfa-b91f-484e-a901-c6ce0f25b6e2", "sighting_of_ref": "indicator--26ff6f41-c4aa-483b-955e-c8c6cd3af94b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4170099-6e47-4212-8c27-41ef0fa45b6e", "sighting_of_ref": "indicator--0d1879f1-712e-4cb6-8003-7ea23afc222f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56175ee4-554d-4807-bc8b-36a4b6f3fa50", "sighting_of_ref": "indicator--df264123-3510-41f8-85cc-b288c87c505a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04654987-72df-403a-ac1a-b7f4c3704ab3", "sighting_of_ref": "indicator--0378fa7a-d54d-42ce-aa31-1ae94dac665d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--429ef23f-8410-4755-a98c-5ae8d888388f", "sighting_of_ref": "indicator--8819ddc8-88db-45d4-b814-02d371bc66db", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dc77983-1854-40aa-8717-25ebb2299ad5", "sighting_of_ref": "indicator--35890783-9a2e-4790-8f5f-0efef5339076", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1b17ecf-ed47-4ee0-b83d-58a9b7b9521c", "sighting_of_ref": "indicator--1fb5d5ad-56df-4334-8f96-5f4f034e88a6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e62f090-7458-49ec-8fbb-b49089a09404", "sighting_of_ref": "indicator--94dd0ff4-1509-48fe-9e70-c6a333410218", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d64c2c5d-fbeb-48a7-a886-baff1177e39a", "sighting_of_ref": "indicator--be02bce3-896b-4267-a9ea-7b2e9c4e5e07", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd85e536-47e0-4b97-80da-2b1dfe60edea", "sighting_of_ref": "indicator--c8ac5711-fa8f-4c57-8844-6c8b3add257c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--123bd3d5-b5bf-4d18-81b7-d1f33ac09b7c", "sighting_of_ref": "indicator--6a90036a-86fc-4ecf-8843-30290481305d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed904e42-43ce-448c-9674-30b733325439", "sighting_of_ref": "indicator--73648e40-aaf9-42f1-a78f-21915d5c7c8a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6f0c051-a932-4200-8745-98930b0deb26", "sighting_of_ref": "indicator--14735dac-ce15-43d0-94d0-2f3b88754cc3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2efde2c4-3ad5-4915-a217-891f81948596", "sighting_of_ref": "indicator--012f2962-40ca-43b5-9cfc-655724d73b67", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c772910-e1ce-44da-bf31-bbc1632cb2a6", "sighting_of_ref": "indicator--5ec75e27-8bbe-4f1c-ab0b-56e3a12997ef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d40a9dd-bf8b-4448-a7ea-8c2e6e9cc6e5", "sighting_of_ref": "indicator--c40b79d6-734d-443a-b66d-8c7eb6019c04", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ffe5a73-219c-4987-a3f3-98c1e17f4dbc", "sighting_of_ref": "indicator--c40b79d6-734d-443a-b66d-8c7eb6019c04", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--785bfba2-c241-411a-bc11-c55fa5ec5179", "sighting_of_ref": "indicator--8fa52cb7-9d8f-44b9-8386-d6fc5f92c689", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9d579f7-2fe4-40d8-bb65-cffbf43ee404", "sighting_of_ref": "indicator--7dbdc9a5-2f2e-43d0-9005-988fa312c9b1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e413b12f-267a-4973-8c05-daf34953357a", "sighting_of_ref": "indicator--92518fe1-df68-45e8-8c98-25d03c11d7c0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e853b985-ac5e-46a1-9552-1e815032666a", "sighting_of_ref": "indicator--ed7d6d96-744d-4ffe-9668-e996ef3ba22d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d511ae84-0cc5-43c1-aa66-03d0e0c1184a", "sighting_of_ref": "indicator--102b2046-3f45-4ee9-870c-d45d158a638b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--882f77c8-9de1-40e4-ad12-36e62a20d5da", "sighting_of_ref": "indicator--8e59b61e-a6fb-44a7-946e-aff03dd49dcf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--827858fc-a6c3-4933-ac32-2683e757d6c0", "sighting_of_ref": "indicator--8e59b61e-a6fb-44a7-946e-aff03dd49dcf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b268647e-73a9-4da1-b8e9-9f29c979038d", "sighting_of_ref": "indicator--81baf560-39cb-4c22-a541-6df103973594", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d5300c3-ff27-4eff-a6ac-e45bb4fe8ade", "sighting_of_ref": "indicator--c541d86b-66c2-4a00-a6b0-2613b2f90563", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e0427c7-c94f-424b-ac92-8fab3ff630f0", "sighting_of_ref": "indicator--0a9e5d74-14d2-48f4-a25a-380a1f873680", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1abe85bf-8fc5-4976-9857-ac93d9c8e961", "sighting_of_ref": "indicator--d3bb3975-c2b8-42f2-82a4-0b109bef6655", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01c432e6-3d46-45ca-986d-6eb9d036b9a3", "sighting_of_ref": "indicator--91193468-1951-4309-95e4-837e861f0039", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f0eea8d-5938-4a4a-a2d1-3e3d140b6c9d", "sighting_of_ref": "indicator--1d484283-9ba0-471d-9cea-77e7c5dd2092", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01e317f5-0e51-43b0-aceb-6204d3b7d442", "sighting_of_ref": "indicator--ab0b853d-8c19-4e6c-9648-b245805e5a7f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73739126-b4a1-4041-a116-84f5aa43eb1f", "sighting_of_ref": "indicator--0d39870b-b3e3-4d49-9dec-d9c947b0f525", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bf9d340-f3c6-4ae9-bd0b-4b97225356f4", "sighting_of_ref": "indicator--770dd859-6079-481a-939a-619a65a434cd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c61c961-4830-4e67-bf75-16f2113d993e", "sighting_of_ref": "indicator--f6d12955-db38-4bf6-a914-750b50160cab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbe8e8f0-8524-4535-b996-37795da274df", "sighting_of_ref": "indicator--e5f6d006-ca06-47a2-8a85-3ee9f51630f1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26005ae7-0f51-4b99-b223-351d72fd4f13", "sighting_of_ref": "indicator--1006b165-cb18-4335-ab46-c0aa3d530ed6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de64ceac-b1e9-4156-a972-24b4a4c2b385", "sighting_of_ref": "indicator--969dfe85-945c-4e7b-8182-4d7fe35d788a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54a992ef-960b-49e5-9f6c-b853321ed492", "sighting_of_ref": "indicator--969dfe85-945c-4e7b-8182-4d7fe35d788a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9286d3d-7243-40e9-baa9-74f021897591", "sighting_of_ref": "indicator--2f344559-1cc1-4dd6-b9d4-1b8eb138e542", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60be00ad-020d-4eca-bfec-dacedc092873", "sighting_of_ref": "indicator--2f344559-1cc1-4dd6-b9d4-1b8eb138e542", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1832587-4c9e-4eca-a8a1-30a9ef4cec1b", "sighting_of_ref": "indicator--ac9b2a9c-4bf6-465c-83d2-e0b8d6762466", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79d53fea-57af-46cb-ae01-6a12ca0e8c98", "sighting_of_ref": "indicator--f0b9c05b-fe3c-4f81-8ec2-a58c5fd67754", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02c1fa67-098f-4b1b-9268-136d70d80a49", "sighting_of_ref": "indicator--b4a95cd8-575e-4398-899a-900d50cc8b77", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dc281c1-1177-4b94-9fb3-5c9ca8f51a96", "sighting_of_ref": "indicator--afcd1e0f-e019-4d3b-8f56-01c9e55952a8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24eddca9-feed-451c-b7db-e18922cd75e1", "sighting_of_ref": "indicator--afcd1e0f-e019-4d3b-8f56-01c9e55952a8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f7da1a7-0787-44b2-b930-74e8707f9dda", "sighting_of_ref": "indicator--47ddbc19-89c5-4609-ad40-fd9838c40387", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90d33fbb-e753-4739-8b86-f5409ae2102d", "sighting_of_ref": "indicator--f500b285-d38e-4c68-8494-b7fc337da7e8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd454261-6906-42ca-9148-17b0b7256d09", "sighting_of_ref": "indicator--35321ae4-fe94-449e-ad4b-29c8c7636bb1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eacb216-ce2a-48a7-8ddf-db76703d27fc", "sighting_of_ref": "indicator--35321ae4-fe94-449e-ad4b-29c8c7636bb1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fd65828-76d7-47a5-8497-6e002928d994", "sighting_of_ref": "indicator--cbf5585b-8953-4e0f-881b-8d91d9667ca2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba1e7cb4-5d50-4548-91af-167db29d33f1", "sighting_of_ref": "indicator--66e3a847-1cc7-40f1-a37a-8e4e78c7bda1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d9b9799-7b1f-4388-8f9b-5616cdaa627b", "sighting_of_ref": "indicator--66e3a847-1cc7-40f1-a37a-8e4e78c7bda1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b44845b6-3445-4d5b-855f-82247a64074a", "sighting_of_ref": "indicator--49b3ff1f-0227-466d-911b-32c16ccfbe6e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc1e306f-eb9b-4639-b406-e009d87b6ddc", "sighting_of_ref": "indicator--3e1c21e3-035c-461c-a1fd-fb677c42e09d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3607575-6ca6-4c02-8e21-9c1de3494b93", "sighting_of_ref": "indicator--3e1c21e3-035c-461c-a1fd-fb677c42e09d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f65ec3e7-8ab3-496d-9dd8-34b89c861aac", "sighting_of_ref": "indicator--95042a98-99bf-4519-b714-19d64d815f82", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8eb0dd48-5147-48dc-9a0e-aedf596856dc", "sighting_of_ref": "indicator--dbd58cf3-ca37-425e-aafb-a63ca0ace442", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e67cf5f8-d044-4f68-9108-59eac7bf81e9", "sighting_of_ref": "indicator--7a5d3f44-b2ca-49e8-96ea-3d95a04655f3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e158d09-33ea-4141-9987-2d4e223d4623", "sighting_of_ref": "indicator--8950ad98-489d-49e8-ae7f-20d714cb0bf5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bca3714f-85b0-4040-9f1a-b12c6dc51f42", "sighting_of_ref": "indicator--72c2c52e-5542-4002-8960-e30b0103c640", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e7cadcb-3fba-4cbe-b41f-8ceb8c8762ef", "sighting_of_ref": "indicator--246f64ce-9340-4f76-9601-bd82f3ad58b0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2512293c-7f1a-4bd2-a231-dc823e43fc41", "sighting_of_ref": "indicator--246f64ce-9340-4f76-9601-bd82f3ad58b0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19a794cd-5700-4bd6-aedf-525bb365bcf5", "sighting_of_ref": "indicator--223dc8fb-11a2-4e25-ab4c-78928ddba562", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b97d89b8-2802-47b3-bec1-50b1ca4fd9ac", "sighting_of_ref": "indicator--2fac43fe-a372-4dec-8aad-b79f23fba29b", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f334bdc9-8ae7-4e30-9852-4fb7b0d1422e", "sighting_of_ref": "indicator--747b91b9-789a-4caa-8e10-c87413608b58", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ebde67d-a3da-4f3e-a168-4b9d04289efd", "sighting_of_ref": "indicator--747b91b9-789a-4caa-8e10-c87413608b58", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4ea703e-ea97-4235-aa68-34e936b0ac8b", "sighting_of_ref": "indicator--1cfb5e91-98a5-4242-bb93-de223ea16f4a", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5bb3271-0a2b-4caf-b72e-f236ad56c73b", "sighting_of_ref": "indicator--1cfb5e91-98a5-4242-bb93-de223ea16f4a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b906406-cb3c-4bee-b9b7-05545beeb12c", "sighting_of_ref": "indicator--3f575db6-a18d-4519-b782-af73e001df85", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28b1f720-b425-4390-b2c0-48b6dcae0632", "sighting_of_ref": "indicator--181b4eb0-4e48-402c-8d40-d48c99f908f7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed06e2d5-9944-43b6-ac6c-5cc77fef0773", "sighting_of_ref": "indicator--ba90dfa0-aa50-42c6-83a6-bcc43622c6d6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--667d5c1c-4a14-4024-9e38-a34c5efcc912", "sighting_of_ref": "indicator--a5f762fa-bcd7-457d-bd82-d25fdd072306", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04036169-e24c-4c74-b8ec-c53578675a74", "sighting_of_ref": "indicator--4f9bcdd3-f682-4ca5-9d36-ca13650ee38d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc189bfd-47fb-4f8f-8aaa-ed543183c71e", "sighting_of_ref": "indicator--95c1bea3-8943-4ccb-a386-075c669eefa7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d93d32c9-1af6-4665-aecc-f732aea53546", "sighting_of_ref": "indicator--16ab0811-f042-4fe9-ad2d-c9626b1df5d3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b2e84e6-ce45-43a4-8ffb-28162b0072c4", "sighting_of_ref": "indicator--6d701664-57dc-4e1b-a587-f87ec6ba3302", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53bfcc1c-4af1-4df9-9669-d4fc14737929", "sighting_of_ref": "indicator--b5b1f141-2c92-4239-9696-e98b55eab7ea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f5629ad-c09c-484d-95a6-2aa9a7fa0bd6", "sighting_of_ref": "indicator--f83c4090-1791-4cad-9cf1-a19b07f9561e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db97ec35-7d32-4e4e-9337-be8445dd2c45", "sighting_of_ref": "indicator--be8017f9-23ad-47ba-ae87-acd28d7dd6c2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f200682-3731-4f25-8ec4-e76c97b12ef4", "sighting_of_ref": "indicator--4e684625-9692-41e1-91a4-c0d6a03d79ac", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e93583f-7312-428a-a702-12dd687ad80e", "sighting_of_ref": "indicator--c5d173fb-7f65-4054-932e-518cc133dc41", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8e21881-6fa3-46cc-ae76-7549209cc4a1", "sighting_of_ref": "indicator--abf28d2e-37d2-4aaf-843f-436fdf51ed44", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4595d57-9f20-4fda-b7a8-1f104f034d91", "sighting_of_ref": "indicator--43009c4c-8fca-4340-b2ca-2ebf1eff5926", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4df6faa3-85f7-4bf2-bcb6-27ce2c8ae5da", "sighting_of_ref": "indicator--86ce4a4b-0110-4f9d-a867-4105c2afc9a6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6058b8c-0eb9-4c26-be4f-e5630c032d1c", "sighting_of_ref": "indicator--85a74485-61d8-44a6-bb55-ace32ae53872", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81d18ffd-68a5-4804-a237-696a0efa0fed", "sighting_of_ref": "indicator--fcacf1f3-9805-460b-b1be-9829459ebf1e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b489f81f-214e-46e9-8292-f240f8044aa8", "sighting_of_ref": "indicator--28310990-831c-4ae4-9398-62d06bbdc6ba", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eec29ef6-272f-4f07-a7f6-51f7fdd42ee8", "sighting_of_ref": "indicator--b2c6b724-7a3d-4166-82f1-927f81074bae", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d53555a-4242-4b6b-8698-0d5d6df4b123", "sighting_of_ref": "indicator--84e89924-8206-439b-bf62-28040cea4284", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78b93c8d-7f27-4102-91c4-46b0bf4d3add", "sighting_of_ref": "indicator--92d692e6-4c34-487e-9fd5-293305b89863", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1ad8b6b-92a9-4584-86e7-6bad5e6c6227", "sighting_of_ref": "indicator--42a25910-b5f5-4bec-b1c1-128866db58c2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5f46944-ce7f-4bc9-8367-08db8308200a", "sighting_of_ref": "indicator--4af04995-ca18-4143-9b12-f8aac2be791f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--571710a4-39b4-483a-8a42-e39928ef00c3", "sighting_of_ref": "indicator--7f25d5a8-4788-4a48-b682-2178a9d3d3fd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58f822ce-3434-4a6b-82e2-9ede977fc9dd", "sighting_of_ref": "indicator--95b78072-f638-4c03-bc9c-9aa8e103f795", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b13049b-9a3a-4c57-953b-d72693e79782", "sighting_of_ref": "indicator--cc256fa4-5d3c-4402-aa66-168741e162c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7bbd92b-f96a-454f-822e-04c1a8a13bb9", "sighting_of_ref": "indicator--27a91fe4-051a-4715-9797-ccacbf125d4b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2aec6fed-842b-49c1-9519-889a102fea22", "sighting_of_ref": "indicator--600fb6c4-554c-41a6-92e1-acc5e3e22e36", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--743bed29-b43f-411b-ae44-ce2df5361773", "sighting_of_ref": "indicator--a49b3f0f-1171-4e28-a248-47b83755f21e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05b6b8c4-a67d-4636-8008-1db58d714b9b", "sighting_of_ref": "indicator--0147634d-f05a-4128-896d-fae07078f552", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82493b84-d7d2-49f6-9f78-7da72602b51b", "sighting_of_ref": "indicator--e5e70f27-2bec-4bbc-8293-461e02477c24", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db894a10-8cc6-49d2-a49e-3a561a97a9b7", "sighting_of_ref": "indicator--9edd3ace-e36b-4043-8e3b-6c6a0dc3f7fd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23696212-3c48-467b-90df-a6774bd7aa6b", "sighting_of_ref": "indicator--86067fac-2835-48a3-9fe2-2f186fafab83", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80c61e5c-ec3b-4401-bd7d-7fa7d55cb8ea", "sighting_of_ref": "indicator--faedc0c2-f0d6-4c18-8111-1e8c075eeabc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed12b77c-b169-4d99-979d-73b38cf1631e", "sighting_of_ref": "indicator--5e7c7648-bbfa-478d-af89-e5b968cc9ef8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e751f4f4-2097-418f-b2f7-97fdc8eed3b4", "sighting_of_ref": "indicator--e27e57f1-9691-410c-b6e2-95dd55adebe3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a71f7e3-330d-4cec-8871-4e9be969bb71", "sighting_of_ref": "indicator--3cf41b06-2ed2-4aab-b92c-68f45c55a036", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--690d246a-cb36-4088-9449-9d2b719509a3", "sighting_of_ref": "indicator--c4e86977-c7eb-4afe-98d5-26db1be9a1dd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e036a79d-aeda-475f-9d9b-67b6fd6c48d1", "sighting_of_ref": "indicator--48341a15-fc42-43ad-8e01-54b16bed0e0a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acfad706-a71e-47cf-997f-a518cb7d0985", "sighting_of_ref": "indicator--104515f3-7cc1-4cf7-b02f-33ae2aae7e0d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f73e3cb8-519e-4d79-878e-086b16553a90", "sighting_of_ref": "indicator--cf33dcdb-dc28-479b-9ce8-e807492fec65", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20f09dc0-efc5-4fdc-b0d6-136671b7354c", "sighting_of_ref": "indicator--b289f759-9992-4f05-8780-ea0da6108eb8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4dd15cc-09e7-415c-8be4-4c6f7a613c7c", "sighting_of_ref": "indicator--c97ac65e-e9ba-4756-bc25-887ef200ebf0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98539662-6e1b-442c-93ee-d112a30986fd", "sighting_of_ref": "indicator--dd103efd-3fff-4711-ac06-baa1ec94e652", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2dabf63-a073-4e0a-aa87-c646d0411d25", "sighting_of_ref": "indicator--dd103efd-3fff-4711-ac06-baa1ec94e652", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45482cb7-169b-4c8d-87b3-382d38e09c27", "sighting_of_ref": "indicator--a1c0f838-0458-494c-a04b-14d778a6bb7e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b943b6a-c96b-4b3d-a339-ae7cd796f6e2", "sighting_of_ref": "indicator--740a0891-d828-4aa6-99bc-22ee92dbc241", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f894e4ec-c976-4952-bbeb-0b2ffdf90217", "sighting_of_ref": "indicator--06de6b95-0ef1-4d43-93f1-c8351badea53", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f7c262e-f18f-423d-8b20-3f8f1e883db9", "sighting_of_ref": "indicator--5130675c-1fc0-4227-91b9-2ac95ce58d28", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--525e4e44-5ad7-4fae-85cb-42a9b5bfbe3f", "sighting_of_ref": "indicator--6e65033f-1aeb-422e-8131-ee1001f7c0aa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--516d26b9-f3f2-4976-b94b-1e2143a66b4f", "sighting_of_ref": "indicator--1894bd24-c1f3-4def-b67c-3e98ebd890d5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c29c98a-a21b-4635-a84a-55ff2a3866d8", "sighting_of_ref": "indicator--b53a2076-52ea-45cb-821c-89bfa283974d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b58b61f9-2bc0-42ae-8171-aeb24e6ea751", "sighting_of_ref": "indicator--95ea6607-958c-4138-9965-66dd5f4fd92d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--836905be-0b7a-4458-b6dc-2560188a74eb", "sighting_of_ref": "indicator--083dee76-5c30-4af9-88e6-934251d09144", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2284cce5-1d28-4933-aeb6-446b60ee2e83", "sighting_of_ref": "indicator--83e977ba-d105-4b0f-81ec-98b20d8b40d4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10cbeeff-8d2e-458b-a2d2-22115221e74c", "sighting_of_ref": "indicator--0105c8db-6d70-4519-b9de-ea60aa993d67", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9aab91f3-476c-4fb4-b5a0-e65f2d3b35e7", "sighting_of_ref": "indicator--6367a983-da1f-42ee-98e3-46a986932210", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67718e2a-0274-4495-ac33-f116aa473285", "sighting_of_ref": "indicator--66763b97-7556-4d1b-8e38-4040570cdac3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d90298e-a606-4f93-90ec-748800362f0d", "sighting_of_ref": "indicator--ac8778b5-4436-4cd1-ab56-b06b9d0953ca", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6f17b1e-7797-4ca9-b2fa-bc52b44a1c03", "sighting_of_ref": "indicator--e062dad4-ca04-45c9-a04b-04fd0a1d8281", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef42a927-4c32-444d-bfeb-2fe4841bd49c", "sighting_of_ref": "indicator--65428ada-147c-4a04-9743-11c902f1a00c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5709478d-4ac0-46cd-bb91-59f23edf6be0", "sighting_of_ref": "indicator--65428ada-147c-4a04-9743-11c902f1a00c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fc356b2-0edd-480f-9748-e12803588eeb", "sighting_of_ref": "indicator--0f64617e-3988-449e-b6e6-a7c325a57637", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53d911d3-98ec-4c3c-9a43-f53d57c159a3", "sighting_of_ref": "indicator--0f64617e-3988-449e-b6e6-a7c325a57637", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69ed8e4e-da73-4825-847f-e9ab81d604c3", "sighting_of_ref": "indicator--adb55c2b-6429-4e2b-8c52-404d692980c1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6db5b024-20b4-4e85-ae16-8ca557f33a20", "sighting_of_ref": "indicator--7a57eb20-731a-4737-ac06-6e5010e222f1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--520a146c-a139-4ed3-99ef-3ff1601f9384", "sighting_of_ref": "indicator--7a57eb20-731a-4737-ac06-6e5010e222f1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c84537c3-c2c4-41df-b037-52a191ac74f8", "sighting_of_ref": "indicator--290316e7-d1c1-49a2-80f0-072b20189b2f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0115a5d3-2691-4fa1-b054-96841ea65732", "sighting_of_ref": "indicator--290316e7-d1c1-49a2-80f0-072b20189b2f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57ff8d7d-172e-40ad-b4cb-068ab31b7209", "sighting_of_ref": "indicator--44f11516-1d80-44e7-98e7-17e299d91b03", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e5c3a16-1c5b-48ee-a68a-2d8eadc46280", "sighting_of_ref": "indicator--44f11516-1d80-44e7-98e7-17e299d91b03", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4153eaf5-b7e5-4680-b002-065cd014172d", "sighting_of_ref": "indicator--cc3ff467-c293-412c-8530-6c466946bcc1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddd5a8eb-655d-47ae-900e-461b8d651092", "sighting_of_ref": "indicator--cc3ff467-c293-412c-8530-6c466946bcc1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61c72d6a-cd78-4ecd-ad07-3ce62a013777", "sighting_of_ref": "indicator--d8689ef3-8936-43ed-bb94-192ecce722e7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32910434-37ab-4313-85af-977857bd5f7a", "sighting_of_ref": "indicator--d8689ef3-8936-43ed-bb94-192ecce722e7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--980f0135-3e2c-4869-bcfd-4aeb0ac2aa50", "sighting_of_ref": "indicator--b2c9e43e-7daf-4144-8a12-6dcda19e977f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43873dae-c2b3-43cf-81e0-d509f7a13890", "sighting_of_ref": "indicator--b2c9e43e-7daf-4144-8a12-6dcda19e977f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf6f9525-9494-4993-a34d-cd73c3b771db", "sighting_of_ref": "indicator--17eecc50-eb3b-4906-88ba-e8a439f51472", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52f3045f-c3c8-4bba-9c3a-450dc4a0f453", "sighting_of_ref": "indicator--17eecc50-eb3b-4906-88ba-e8a439f51472", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d59713d-0a30-4221-a1a7-bf1f84cc8d40", "sighting_of_ref": "indicator--535d9907-4e41-47a6-86eb-2f00d2f01a4d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e90ab79f-eaee-4e3c-9f77-4e6c73da797b", "sighting_of_ref": "indicator--535d9907-4e41-47a6-86eb-2f00d2f01a4d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61b3c3c9-9105-4143-8710-9e400d3ff28f", "sighting_of_ref": "indicator--e22f1e59-19c0-4bc3-82f1-0f1ed3ad830c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b1c7fe5-42be-4a1f-a7a8-b346125e1936", "sighting_of_ref": "indicator--e22f1e59-19c0-4bc3-82f1-0f1ed3ad830c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--633fc4a8-42e8-4fe7-9a70-bba94b926205", "sighting_of_ref": "indicator--5d4449fa-f687-4d04-8e4f-5f15939f42ab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7898423-4271-427b-b2ab-baad63ef8b2e", "sighting_of_ref": "indicator--5d4449fa-f687-4d04-8e4f-5f15939f42ab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbf71bd5-86e7-45d1-bf67-cb6544ef90e9", "sighting_of_ref": "indicator--0820e195-57c5-4412-bcea-29c468a60a81", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afe2d585-59cb-48a7-870e-dc96c8e9d2fd", "sighting_of_ref": "indicator--0820e195-57c5-4412-bcea-29c468a60a81", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cb93ca1-8cbc-4723-b8ff-5514870fc961", "sighting_of_ref": "indicator--1c1b7814-d701-4a3e-8eeb-565b9af41d0d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1470af86-8863-4d80-a0aa-a74ad917528d", "sighting_of_ref": "indicator--1c1b7814-d701-4a3e-8eeb-565b9af41d0d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3312e1fb-fb27-4e41-8c95-e40217b861e8", "sighting_of_ref": "indicator--f651125e-0257-4c9d-9313-485d10dbccfa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29246448-9efd-4ab7-9aa8-26a56d4c4e64", "sighting_of_ref": "indicator--f651125e-0257-4c9d-9313-485d10dbccfa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75691b89-9832-4a9a-80ad-07fecfa1073b", "sighting_of_ref": "indicator--425ce0f4-a426-48c3-b39d-cd388a690aa8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4b38c18-0108-4bab-930f-fa577da5f29d", "sighting_of_ref": "indicator--9ebd67f3-0b8b-4ef5-a77d-f0a47b361c11", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--824e5e06-01dd-4df4-9d62-45b3f2d98c66", "sighting_of_ref": "indicator--3658c691-d3ca-451d-b230-eac80537de3e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--612c8bf7-01f1-41f5-b437-eb3e0787d77b", "sighting_of_ref": "indicator--5ee9af2b-78d2-413a-b33a-500e1db3051b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2062201-b4a3-46ea-98ca-8c9be77f76b6", "sighting_of_ref": "indicator--68ff74e3-3dca-4900-a10c-fa515c48da77", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--086fd32f-f6e2-46b3-b75c-3f40a83dbe9b", "sighting_of_ref": "indicator--d4600061-367b-474e-986c-4f6a6f150985", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--561db8b6-e0f0-4ae4-a4db-dc88636aad28", "sighting_of_ref": "indicator--24afa028-97c1-49a4-b47a-a404f133ca67", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8aac9e78-f77c-4937-9cbd-2c4b3162e8e4", "sighting_of_ref": "indicator--e63c6d7e-80f7-4f18-9884-5fd92566217a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81fb0f6b-acd0-46d7-a8ee-7e0a42ce3dd4", "sighting_of_ref": "indicator--1458d0c4-ebd4-4a57-bb20-4259cd5fef35", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02ace950-d867-4e83-aea9-0474d081ffa9", "sighting_of_ref": "indicator--f341640f-1108-4043-b04f-f0eadc7837e2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8728a0b7-dd86-413a-8072-bf9f6ec6e3d3", "sighting_of_ref": "indicator--e1cb7306-4c7b-4441-9832-4fdcbf258a51", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--099d061d-1b88-4576-ad07-58c10326ecbd", "sighting_of_ref": "indicator--992a35de-6716-4d1c-a230-712a5c5d7a39", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6a609fd-fc19-48f2-aed3-1a392988066e", "sighting_of_ref": "indicator--868227ad-e0ef-47b9-b1c8-837b3ce34b8d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4655edbc-4feb-4ecd-be1d-83c5edf987f3", "sighting_of_ref": "indicator--44be29c1-d91e-4f8a-8ff8-00ea6591d462", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9154eb7e-3aa4-4f68-8541-409580d2b05f", "sighting_of_ref": "indicator--43f4aad0-e98e-42b9-9a6a-28f7079e9dca", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1d298ca-6e0d-4d6e-a951-86bc4c183020", "sighting_of_ref": "indicator--e6804255-b145-43b6-9f4a-29bb0bd5d538", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--045e9daa-53f7-48a8-a2dc-c880ed1c53fc", "sighting_of_ref": "indicator--d88a7807-f9f9-4b41-aafd-bb9e1c5eafa0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2097e42b-dab8-4f2e-97d7-dba194b660a9", "sighting_of_ref": "indicator--f3d26b20-396b-471d-a0df-e3b8d5e9e9ae", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da4221bb-8965-4f8a-a5c3-3fdb87934825", "sighting_of_ref": "indicator--fc1d338e-695c-4d38-a84c-81521f13c3f1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16923020-a06c-4bdd-ad61-5bbee3a0f916", "sighting_of_ref": "indicator--5b318b9f-ccda-4adf-a2b1-ff1ff4234921", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ea12b9e-c44d-449b-9259-68981e479be6", "sighting_of_ref": "indicator--764e061c-d86a-44ce-a05f-a6eadc4034b4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--042c4934-c477-420d-99de-36a657896af6", "sighting_of_ref": "indicator--f1355197-26ca-4044-8239-ac7f2f8d7e98", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1cc8e6f-b094-4abf-81e8-61195e19ee74", "sighting_of_ref": "indicator--f1355197-26ca-4044-8239-ac7f2f8d7e98", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a9bd4ed-9eb8-4d50-bbb8-9ee2added8ec", "sighting_of_ref": "indicator--5e0bd784-395d-4659-8a3e-38aec4de1702", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50b4d84e-0a95-46aa-b920-095efb790836", "sighting_of_ref": "indicator--aa28df33-d90f-40dc-a8ce-0b9eab40eddf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5428894-9d78-4e6a-ba0a-b691bb8c099f", "sighting_of_ref": "indicator--aa28df33-d90f-40dc-a8ce-0b9eab40eddf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e56c38b2-0b09-470b-8aad-5e29d2d99cfe", "sighting_of_ref": "indicator--58a84a97-6b21-4ab0-99eb-92d7c163f940", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79e406da-d419-4a5a-a83e-c303523ba729", "sighting_of_ref": "indicator--12b0d2f0-6641-4af3-b503-d4dfa1cf7944", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0369189-e3dc-4adb-81f7-e723f0c2e6bb", "sighting_of_ref": "indicator--7f53a056-28c0-4974-a734-dec01b03535c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a48f890-78a9-4089-ac6c-9480ca439b41", "sighting_of_ref": "indicator--cdbe88a6-45ff-47e1-b576-cebbe68e2769", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--538c74c7-0a84-4242-a8af-206847022ac6", "sighting_of_ref": "indicator--65778aed-e0c9-4271-899a-916718229a7e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b963bb2-9247-4074-a35f-f892c9afd707", "sighting_of_ref": "indicator--fa190f65-8e90-4680-8b80-de4c68362438", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3764e29f-2b85-4693-abd4-ff58c2f6d1ef", "sighting_of_ref": "indicator--2b166c06-ad09-4f5a-9969-88007748b49c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efc87a40-18f1-4cb9-9506-1403dd79dd6b", "sighting_of_ref": "indicator--2b166c06-ad09-4f5a-9969-88007748b49c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ca17b15-46a8-44ca-bc9a-75564af25a7a", "sighting_of_ref": "indicator--047f63c3-ac00-451a-bb2c-aa3781753f07", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34587370-7d8a-4962-b36f-cbf113c3ff2c", "sighting_of_ref": "indicator--047f63c3-ac00-451a-bb2c-aa3781753f07", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d285ac0a-28d9-46a6-b057-9dfe049b70f1", "sighting_of_ref": "indicator--d75ade97-8cc5-44c2-9d57-a7568320a261", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bc293a2-1acf-43ab-ac65-c6b7fd8284e9", "sighting_of_ref": "indicator--d75ade97-8cc5-44c2-9d57-a7568320a261", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8fabd02-58d4-4407-9ed7-d92eb3ccc0e7", "sighting_of_ref": "indicator--3b4de206-5417-44ec-ab9f-b59dd649c166", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--668b9ea3-f70f-45dc-8d25-bbda90479107", "sighting_of_ref": "indicator--3b4de206-5417-44ec-ab9f-b59dd649c166", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58c7d8b7-80f3-48f0-b929-e302f033a47d", "sighting_of_ref": "indicator--7e5597f2-6d50-407f-a87c-fec0d05629c8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b314308c-53cf-42d5-80b9-04540ad99ebe", "sighting_of_ref": "indicator--7e5597f2-6d50-407f-a87c-fec0d05629c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--daaa0fa5-c5e8-45e1-978e-5122ccb56696", "sighting_of_ref": "indicator--43c30b92-d087-4651-a21b-f40b3ba31135", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--453cd2a0-a2f5-439b-b2a1-8e541faa1b4a", "sighting_of_ref": "indicator--43c30b92-d087-4651-a21b-f40b3ba31135", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af9d0545-9883-40be-ba58-d5e6e1c1ecd8", "sighting_of_ref": "indicator--bc5759b7-4ab5-4e95-b6b1-27cf97bacec2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--539e8ea6-1188-48f7-ac9b-1fe69dda94b6", "sighting_of_ref": "indicator--3c28102e-a191-4547-8872-1f0f65f00f05", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1b3e26b-f6a4-46fd-9799-7c2970b268f4", "sighting_of_ref": "indicator--42b63d48-82cd-4c6d-ba70-59cb9178ee36", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--394a9c70-8618-4ff6-8291-40c98dad8427", "sighting_of_ref": "indicator--a91130ad-5dae-4cd9-9d97-50ec60dad360", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bc92d1f-863b-4654-8187-32b63352b010", "sighting_of_ref": "indicator--eec53d4a-b320-4ca1-94e8-e2b3b0dbb9ea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72b02744-d950-4445-a30e-68936d6cc3e6", "sighting_of_ref": "indicator--17b43622-d511-475e-80ec-e9fbf1bab96b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--904cf7cd-c3ac-4d15-b0fb-bae3f48f871b", "sighting_of_ref": "indicator--8e6fa2c5-fb69-4730-8b20-63bd2ea9e504", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02b5860d-c3cf-4b7d-9022-435350f05806", "sighting_of_ref": "indicator--1de358ee-74e8-4c17-9e6f-c7c53b4a57c0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34de4895-5a56-4aeb-a83c-d4dd173de630", "sighting_of_ref": "indicator--3955f4b4-16e4-44ec-a763-7a9b570f605f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef0e585b-c360-4ac7-8349-fb254a548747", "sighting_of_ref": "indicator--bc530873-fd3d-4145-a358-7a543ab8bf73", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48dd246a-393a-46ac-8ecd-6ad40a0c0105", "sighting_of_ref": "indicator--444b2b38-9a42-4ad3-a4ee-47d735fa8ff3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08de0df5-b136-4abb-8f32-97b68ee4b65e", "sighting_of_ref": "indicator--444b2b38-9a42-4ad3-a4ee-47d735fa8ff3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5005a595-257d-4f5c-83f4-7d354e2a9131", "sighting_of_ref": "indicator--dee6bfd9-215e-414e-89de-d2ca749ffc1c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44f73e7c-c63d-46b8-9b2d-dd990889d058", "sighting_of_ref": "indicator--7e9b3ec9-6445-4d3b-8899-bb137154c253", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccd99aba-e0e3-46c7-b5d6-110f592f11c8", "sighting_of_ref": "indicator--c9a69e72-ce7e-4a8d-a0df-c34d20ab0414", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca515356-68f3-4c4e-aa97-22d728b51fed", "sighting_of_ref": "indicator--b5e154df-3170-4935-ac9c-912e30792bbc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--315a6caa-86d5-4a4b-b5c1-beab4a655b31", "sighting_of_ref": "indicator--e9695f8f-5c03-4622-8ced-0771097dba82", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e786f04-b43b-44b8-a696-1b4ea8d63488", "sighting_of_ref": "indicator--635804ce-f45d-489c-86b3-323381e6d726", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1482f32-ed78-4ba3-abb1-171cbc3fc5b8", "sighting_of_ref": "indicator--13bcbd9c-b254-4669-8dc2-e0e5b2347c5b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--438cefa0-d823-4f17-8986-41a493f59d18", "sighting_of_ref": "indicator--3e0b3e56-2b4e-4067-a12d-48d807992a8e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41ee85e8-7a46-4d60-a017-93a1f766baa3", "sighting_of_ref": "indicator--a7601b26-7105-49bd-9927-0baaf7095472", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49a2d65f-7169-4db5-9a79-e944389d4f8f", "sighting_of_ref": "indicator--041d6645-c582-46f4-ae7d-ce2344ad759f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a27b99b4-635c-4c77-8fd1-78a6494254b5", "sighting_of_ref": "indicator--a090f0b0-b213-4e05-a430-9ed466ea6cba", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb9b7cc2-885c-42dd-b28a-d32b7ec5df1a", "sighting_of_ref": "indicator--eb6a5019-45c2-4d6f-8613-ca550480afab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b837ec94-d959-42a0-b58d-14177552d8bd", "sighting_of_ref": "indicator--aa892542-47ab-48bf-8057-5f489e415d19", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35d19665-e591-494a-8850-7e377a209761", "sighting_of_ref": "indicator--fbfeb81d-975d-42c6-8d47-e0c3bd6cad29", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36999a6a-6678-4281-89b0-01299f992638", "sighting_of_ref": "indicator--63cb8f54-469f-477f-a5a1-25d507b7de86", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--215dc2d4-7fd3-41d8-8529-ffd81d6476dc", "sighting_of_ref": "indicator--cf15d9ca-780b-49ab-a47b-fd2ca020ec8e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba3806ae-0190-45b9-ba89-2d09bc273cd6", "sighting_of_ref": "indicator--d1d654f5-0543-43b6-9b75-b09fae3aa72a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccf45f07-6c36-44f8-9e2c-bf0e967f98bf", "sighting_of_ref": "indicator--8fe0f5cc-a84e-420b-a980-21590db89269", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4559dded-a9b3-434c-9c0f-6d1bc6684e36", "sighting_of_ref": "indicator--509b608b-892c-48dd-b374-59ebdfb20d20", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--898cbf15-a429-45fb-b2c2-fcc2099100c6", "sighting_of_ref": "indicator--23bfad9e-4856-440f-b6fd-e05432892d5d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02122bdc-4d6d-41d6-9347-9d4b77f94e17", "sighting_of_ref": "indicator--6012b626-05b0-4ef5-a332-8f6830b0800d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--642243a1-3ce4-487c-aedc-09c7995cd1d4", "sighting_of_ref": "indicator--6012b626-05b0-4ef5-a332-8f6830b0800d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47ab5fd3-e46d-4452-8db6-598796897d84", "sighting_of_ref": "indicator--62cce82b-1de5-4524-96ab-0d4fe9e1ec76", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49768aa1-cb40-468d-b8b1-59e7e202c5ef", "sighting_of_ref": "indicator--2faef383-fbf5-4658-93f3-f3a1b7bc587a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--103937e7-ff08-465c-b1e3-0b3f32a6820f", "sighting_of_ref": "indicator--02238702-4402-47f6-8ce2-53d747020794", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42b2ed46-e027-4828-bf31-a984586d6f94", "sighting_of_ref": "indicator--06120843-2093-4ba9-84a0-7a383c16a671", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3070d3f1-abf3-4578-8ec5-d5dc11d15d9a", "sighting_of_ref": "indicator--5e5a443b-177c-4ce7-9c83-b7b7affa2e42", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--200539cc-7931-4f84-9770-be164ddea7b7", "sighting_of_ref": "indicator--d5d281b1-340f-4852-8940-10ed65d76f34", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa6498db-3447-464b-a0ca-0adddc64641f", "sighting_of_ref": "indicator--91c8e281-8c33-40c8-aac3-f4e180767524", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--486aee80-65da-4e01-8114-c9a8ead735d7", "sighting_of_ref": "indicator--7d5b9232-55d8-4b1e-a9a0-c197bbcebcbd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfe7d708-ec2a-4925-95f6-f903ee7cd123", "sighting_of_ref": "indicator--299fbdab-96e1-49a1-82a0-9b1825113e6d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d996b854-3e79-4a70-a000-05f6e05adb61", "sighting_of_ref": "indicator--e521783e-961a-4c1a-8ba4-2bcac5d06611", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10309226-8f33-4a46-bf26-ce2529e7b49a", "sighting_of_ref": "indicator--3d01f475-de96-4974-ab94-718546b6330d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--866bc729-f3a9-49d5-8726-96a48c14534c", "sighting_of_ref": "indicator--3d01f475-de96-4974-ab94-718546b6330d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18f2cd91-c743-406d-a72e-15f7f4e09082", "sighting_of_ref": "indicator--9d9d19d2-7bb3-4941-85b8-7b1a3d9d5374", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3b8488c-f41f-41ef-a04c-7fc9142317a7", "sighting_of_ref": "indicator--9d9d19d2-7bb3-4941-85b8-7b1a3d9d5374", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24b91b80-2d11-48ff-aa4f-80c386c926ed", "sighting_of_ref": "indicator--307eb99e-2468-421b-961c-b027440baae8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1edcf25-f50b-4392-b0f0-517845c452d3", "sighting_of_ref": "indicator--307eb99e-2468-421b-961c-b027440baae8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75b4649b-caf7-4dc7-a5c5-ef7ec33297ec", "sighting_of_ref": "indicator--caeb65c9-bd36-4200-8c9f-080bb293086e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bfbfa34-d934-45f3-b0f3-d13e30405049", "sighting_of_ref": "indicator--caeb65c9-bd36-4200-8c9f-080bb293086e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2c67018-bd97-4012-a977-e24bcf7eb0b6", "sighting_of_ref": "indicator--4d6d3714-25ea-4ca4-aaad-62efb8abf99e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5ad16c4-5836-4b69-89aa-99374086c8d9", "sighting_of_ref": "indicator--4d6d3714-25ea-4ca4-aaad-62efb8abf99e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7c65289-449c-488d-a637-7d876259dca8", "sighting_of_ref": "indicator--4ebc11a9-6fab-463a-a2b6-0fc3c4db3cc0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--050bad1d-a162-4f8c-b62e-e4c87fa66719", "sighting_of_ref": "indicator--4ebc11a9-6fab-463a-a2b6-0fc3c4db3cc0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f67b6996-6916-4d21-b66e-f528f8107d5f", "sighting_of_ref": "indicator--5dee9420-ec0a-4a8b-891f-9a12a973458d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b71d964-e8c3-4175-8698-bc7b32d65906", "sighting_of_ref": "indicator--5dee9420-ec0a-4a8b-891f-9a12a973458d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--538e1e9c-df6f-448f-b8ca-35a968dc4df7", "sighting_of_ref": "indicator--24f8745f-c361-4bdf-86e7-e72e20e52ef7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11b76880-7750-4c09-9924-fc8e8fc265e1", "sighting_of_ref": "indicator--24f8745f-c361-4bdf-86e7-e72e20e52ef7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e14d81b-4bdf-40b5-836e-bd523fb26778", "sighting_of_ref": "indicator--62d70c7e-ad96-4a75-a79d-a25ea3343149", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f762468-a19c-4e46-9853-0ed763befc82", "sighting_of_ref": "indicator--62d70c7e-ad96-4a75-a79d-a25ea3343149", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ede164bb-716d-4a4a-a02d-05d09535b192", "sighting_of_ref": "indicator--30d04bcd-b7e9-4235-9fc8-cc341003ae0f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f399b497-4d04-4ee5-be80-ff94c0a56622", "sighting_of_ref": "indicator--8d13b1e6-c311-4109-b754-32df91438792", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43b7b3d5-88b6-4116-830b-48659dc0126a", "sighting_of_ref": "indicator--1d0291c9-23a7-48f6-8670-b079465af01e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6662e74e-a497-46bd-8d20-045278c9ba82", "sighting_of_ref": "indicator--8c804dbb-80d3-4857-a976-08dca34f32e3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6d098cd-dc77-4f42-9801-8dcb8acc2cae", "sighting_of_ref": "indicator--9e47f89a-6941-43c3-864c-7ca0db483623", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5be5a0f-90cc-4c23-9321-95cc68b0dbec", "sighting_of_ref": "indicator--85dd21ad-0aa1-4acf-8a71-a88523e73dd0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db8900f6-f8c5-4105-a0df-ff923e353978", "sighting_of_ref": "indicator--a1f4d030-d499-45d3-a092-022a1c7c358a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62f66457-84ea-45fe-8b00-271fc65f8db4", "sighting_of_ref": "indicator--81b9e0f6-6392-43b1-ac84-157fbfcb5aac", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb38cedd-f111-451a-a2c2-6d3a73bafe9b", "sighting_of_ref": "indicator--81b9e0f6-6392-43b1-ac84-157fbfcb5aac", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd383e94-7666-4df2-a562-0a336bf651f9", "sighting_of_ref": "indicator--1450e750-23c2-4be0-8e94-af82497ee09f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e5b6c10-a426-4dc2-bf0e-5a9b6482414e", "sighting_of_ref": "indicator--b5e277a8-5b5f-4261-9421-793f60e32265", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6ebcc1a-0bcc-41ea-a2b1-9f8665be5b6d", "sighting_of_ref": "indicator--6f361fdb-a80c-418c-8235-90a3e5df450a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--586d9740-3049-4e20-af27-94c66c3b6a1f", "sighting_of_ref": "indicator--5032c909-eaa0-4ce5-82b5-9d0c0f103e9c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41171f7a-a999-49fb-b013-963193d5baa7", "sighting_of_ref": "indicator--1792e65a-4759-40d4-aa76-c841c4e33ef5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36d59b71-f93b-43d1-8215-ff53be6f932a", "sighting_of_ref": "indicator--e836b1ac-dfd9-4544-8c49-2bfc9095535c", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b3d714b-e579-4486-9fa4-307ab7ef26b7", "sighting_of_ref": "indicator--b87ae073-db6e-42e9-9bad-0c4a4eb1b6b3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8ecfa58-cc1a-4b0d-832a-c83827fa20c9", "sighting_of_ref": "indicator--bbedaf7f-ad3c-4f49-8507-a1870def5c45", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59fcb0ae-91f7-4bed-bc52-2efde617e5be", "sighting_of_ref": "indicator--8b37dd1d-b0d8-41c6-a183-6979bb68e347", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1c469d3-3b68-4fc3-a0e3-b08fb40142f6", "sighting_of_ref": "indicator--7f4155bd-3d56-476f-8c48-c69b550d55e0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63e41b20-d2ec-4df8-9978-c5b050c22fb0", "sighting_of_ref": "indicator--73f29303-91f9-4b33-b2c3-28070e233a50", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87c7dcb4-b6f7-4ce8-9815-cab2b5e7ce3a", "sighting_of_ref": "indicator--cb73acc4-899f-4b46-959a-9550662e9a40", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f309f69d-38e9-448f-b4e6-31b899af9a54", "sighting_of_ref": "indicator--b908c881-8c91-42cb-985f-c6117862bee8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--822b1168-32e5-410e-9b8c-a89ee7d6408c", "sighting_of_ref": "indicator--daf2b221-933d-4b0e-afd3-e93ac08c9829", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--759a504c-c6d3-4ede-90ca-b6cb29db4ac2", "sighting_of_ref": "indicator--95a3682e-d507-4199-b9fb-612fd5d81e2f", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34310eac-8b96-44e2-b582-5044ecf866a7", "sighting_of_ref": "indicator--068282ec-9474-413e-ac5d-4276bc71a9fd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dafb8d27-1267-46cb-a8cf-f66949fb9855", "sighting_of_ref": "indicator--068282ec-9474-413e-ac5d-4276bc71a9fd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b048424-144c-4d21-bfd1-ba505e0fb966", "sighting_of_ref": "indicator--24a65e78-bc51-49c3-bd8b-810dd4262136", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fd2f053-205e-41d7-b61d-c60e23e14b58", "sighting_of_ref": "indicator--73fbc049-7cd3-4eb8-8e73-0a35242628df", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e3cf762-d694-4636-be20-9778ee70519d", "sighting_of_ref": "indicator--e6589eb9-82aa-4592-ae01-5060f5f40af4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f62b85cd-d688-42ea-9265-01a2eebfe3e1", "sighting_of_ref": "indicator--d598580b-7232-49f7-a983-9a02041efafe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d846040-9008-49dd-a5f9-d49d54343517", "sighting_of_ref": "indicator--65648332-2c1b-44f1-8cc1-f372ba226d38", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a082d001-9a2c-4042-b6e5-058af74b933f", "sighting_of_ref": "indicator--ce898d50-778b-488d-bdc1-332b03b836df", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a35d4b33-c248-48d8-b6f9-6b263e4e8567", "sighting_of_ref": "indicator--ce898d50-778b-488d-bdc1-332b03b836df", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ed237e4-228d-4fd1-bafa-9eb9db89aacd", "sighting_of_ref": "indicator--e1c4ea1a-6c20-48b7-a4c3-649de3a5986b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a12b620e-e499-4442-a57b-05f52bdae657", "sighting_of_ref": "indicator--69f3697f-8406-430c-8442-46049dc8c08e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80f71941-c89c-440f-a5be-3b8e06220f00", "sighting_of_ref": "indicator--8da3c7e1-e82e-4dde-b676-b626a3bfffb5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa24e61e-9c12-4304-8fa6-2a4da901d466", "sighting_of_ref": "indicator--3c94bb3f-11af-484d-8349-06eaff3e5743", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b15cb143-c951-4785-a016-273b73f22b0a", "sighting_of_ref": "indicator--3c94bb3f-11af-484d-8349-06eaff3e5743", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--558eb1f1-34d0-40ba-9d6a-f48ad661dfe8", "sighting_of_ref": "indicator--ddc0eec9-08e7-4ec7-a374-3c5e53cb5d21", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be57d57a-5e83-45bd-b413-91ac800e1ac9", "sighting_of_ref": "indicator--ddc0eec9-08e7-4ec7-a374-3c5e53cb5d21", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc9db928-23ba-4a0e-937a-9e160ceced84", "sighting_of_ref": "indicator--fdd764ba-f9c3-4f74-b87c-727ba1f9fac7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e26b365-38af-4dfc-93cf-91031c107d42", "sighting_of_ref": "indicator--fdd764ba-f9c3-4f74-b87c-727ba1f9fac7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d805768f-710e-4ddb-b7b3-2d03a9a3de20", "sighting_of_ref": "indicator--9942d426-4a9f-4bd6-b892-3038b72f905e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53978b44-4ade-48ef-830b-3517825f9f86", "sighting_of_ref": "indicator--de2dbd2c-f333-4e43-9fd2-1d219787b5ef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c54ad5c-2068-4214-a377-dcf534ecb3ba", "sighting_of_ref": "indicator--56e9c832-0c19-4e17-9c46-fb99b51dc33b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4bd4525-0eec-4a67-81e8-ff5aa6fab478", "sighting_of_ref": "indicator--134c71d2-baa6-4f52-b491-659df9e2beb8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70bc727f-0073-4a5c-8c8f-2e00ca584363", "sighting_of_ref": "indicator--5bb16c74-a164-44d9-9b5c-d36ec93726c3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59fcfcd3-7fb4-4310-80ca-71317aac33a9", "sighting_of_ref": "indicator--5bb16c74-a164-44d9-9b5c-d36ec93726c3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6600979-3394-4d52-9b85-d7f68612de78", "sighting_of_ref": "indicator--9c0adbd3-3335-4286-ae90-c6e42a8ca514", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b748216-186b-4fe4-aa8c-c19c17672a0d", "sighting_of_ref": "indicator--af3eb932-30e9-4506-a7ce-fc1211358097", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53548363-664f-46c9-ae2a-44ce6305eb9a", "sighting_of_ref": "indicator--d6fe3b1c-38e0-4769-8295-93e98b6ae1f1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c221202-1848-4456-86b6-754fbd7cae65", "sighting_of_ref": "indicator--9172b2e3-141a-4e41-bf37-06790ad5965c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55aa5890-a775-4bc8-834c-439c7f54fe57", "sighting_of_ref": "indicator--16fe5614-55a3-40df-8181-234c184b5a5d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cf01d99-bcb7-4475-b7e0-70bf2981a034", "sighting_of_ref": "indicator--16fe5614-55a3-40df-8181-234c184b5a5d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--846a7a78-dba0-478e-b2bc-1ac56275582b", "sighting_of_ref": "indicator--d7ee0919-89ed-4c0d-b76e-221747b67380", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de46fcb4-5ed5-45e2-bde9-ffc1a0381e2b", "sighting_of_ref": "indicator--95fbf89b-9330-4bf0-acc5-674c40dff340", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--286bbcd8-4311-4879-a1ba-5ccd0a6e647c", "sighting_of_ref": "indicator--18c379b7-7d05-4db3-945c-6bcbeaa56671", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd62be9a-c580-4412-9a89-7a9a1455de39", "sighting_of_ref": "indicator--34ffc11d-6de6-4936-a618-e07b3c959627", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdc56ec4-2bea-49a9-afff-52f75bfc7f5b", "sighting_of_ref": "indicator--a7d6240a-2e04-45c0-b90c-5303ef1fcd39", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de97cd3c-0022-49b5-8ea6-a7fd42347932", "sighting_of_ref": "indicator--741b0ac4-e9f3-43a0-92ea-666e8984d1ea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--819b07e7-be41-4f2b-b70f-55ab6e9896cd", "sighting_of_ref": "indicator--24e07570-b5f8-427d-9a75-a69eef53f74c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--807f21cc-4a08-4971-85a5-0aaa46cdb910", "sighting_of_ref": "indicator--2741b0fc-25e6-406c-bf59-af25f568bde4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90678261-f520-4d5a-bee0-4dcf73e27991", "sighting_of_ref": "indicator--fbf2e689-e6fe-48ab-9bfd-64d950351d29", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7b4caef-d4d7-406d-a59a-53bf6020be37", "sighting_of_ref": "indicator--18dc0b74-db47-4311-b27a-2714193bca3b", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc0e3b89-c4eb-4f4b-9453-73285beb608d", "sighting_of_ref": "indicator--fbdc432d-92bd-4699-a679-74d8598b8319", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa05b61d-9e6f-42a1-85c5-72bf5b78680e", "sighting_of_ref": "indicator--acd3cdb4-9c09-4061-8493-a97422bb870e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4e788c1-a567-4718-ac33-57e3d451888f", "sighting_of_ref": "indicator--f1890f51-a096-45d5-b4ea-c2642814e213", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a5192b4-6b02-4a58-8a83-b1f60be841d9", "sighting_of_ref": "indicator--18ac5cf8-9ae0-45cc-a83a-eb4fdc10ebea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f66f3ba8-509f-46a4-a228-404e3dea4762", "sighting_of_ref": "indicator--eeb39816-39f3-41a2-9da1-b59eb40f9f0e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ac71f4d-96fb-4a04-832a-85cbf1ca57d2", "sighting_of_ref": "indicator--bb5636ac-6fb8-4305-b964-9dec486d18de", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c181b96-15c4-4869-8382-6ded2bfb0357", "sighting_of_ref": "indicator--543565b4-f758-4671-98cd-8b263094bbc2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a747a58c-0a70-4e6a-93c1-b2029938f156", "sighting_of_ref": "indicator--3864a342-2948-4f1e-9257-e89bc757af80", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--638f7491-940d-46e1-a0bc-6c038958ee2f", "sighting_of_ref": "indicator--e8a445fc-58f5-4c75-ad80-e2bdeaeae3ab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad506999-cf5e-4a4d-bcb6-a20d44994362", "sighting_of_ref": "indicator--352e6ece-6308-4c14-96ee-03eb2e6e06a4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4f97116-3812-44a9-a6d2-ddf5cf9625bd", "sighting_of_ref": "indicator--f5ee5511-b020-4170-baaf-17905a593e49", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7e6d76d-ba53-4c9a-a6d1-15ff0f64edd6", "sighting_of_ref": "indicator--f5ee5511-b020-4170-baaf-17905a593e49", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b617ecc-1e53-4123-854d-9626fe991223", "sighting_of_ref": "indicator--2c700b15-89c5-4bf2-bed6-ab2abb07857b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a20c5b58-0ace-41ce-9abb-a7736b5ccf20", "sighting_of_ref": "indicator--cd76d2a1-a05d-49b9-b791-b22b5d12e603", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f965279a-f05c-4282-ac7e-8278bb6fe0be", "sighting_of_ref": "indicator--fb1814be-47a8-432f-977d-11d580a6fd21", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c9e4faf-4978-43bf-a395-4c66853651e2", "sighting_of_ref": "indicator--04886890-0da9-41fa-a97d-e76d20da3485", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8c1147d-9df7-4051-9175-4a71680af0f6", "sighting_of_ref": "indicator--50957ee0-a935-4780-9f0f-77de4eb6a512", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fccdf1bc-bdc6-47e3-8a01-6234febae6a7", "sighting_of_ref": "indicator--e24d3a61-9ea7-41bf-b550-db419d4a24b5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--259e0bf9-9049-4437-acad-696097e4b8bd", "sighting_of_ref": "indicator--f714473b-9b7f-410b-ba68-9453a225f94e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc9280d6-e3d7-450f-af7f-4984f6a6d783", "sighting_of_ref": "indicator--6c0e8c4c-c9f4-483c-a6ca-9ae031b6cfb3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb922177-a1f9-4c94-8578-2d407271b25b", "sighting_of_ref": "indicator--1d611ef0-7b51-437f-a2bf-e36f60c9fcf4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23fa3c44-ac00-415f-a1b5-12852aea913c", "sighting_of_ref": "indicator--3d495cf8-899e-4791-8c82-057cf417794b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6151afc3-ea37-4de2-aaed-de6ea94e8f31", "sighting_of_ref": "indicator--00e83af5-d0aa-405e-8811-cff80f9153e2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcf82748-e956-484b-a588-298f2aa68a45", "sighting_of_ref": "indicator--af7ac68b-f518-4bfb-91de-b552456ebf45", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96f083f9-17f8-4f62-a915-618a1f523c1d", "sighting_of_ref": "indicator--8b74ebd9-967b-4dcf-87e8-337850a517d9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--297664d9-d6c1-4bcf-b83b-f7015e154628", "sighting_of_ref": "indicator--56480c78-9dd1-41c7-b873-a952bce5ed46", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7a8dd3d-664e-4c7a-b4b3-70390a53b87f", "sighting_of_ref": "indicator--843ba34b-2516-4979-96fc-cc76acb4cab4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a79e8e5e-c4b1-40f1-909d-71c895ca400d", "sighting_of_ref": "indicator--88393773-a23e-4f8d-b2e8-fa4015b04620", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--192b460e-99db-44c6-8819-a9d3bf3f9967", "sighting_of_ref": "indicator--e7f2ceb1-6363-4489-b5e9-e85b33905f7b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28398d0d-f3d3-4365-903e-3a2a5dcf2341", "sighting_of_ref": "indicator--4fb34a91-d108-4c2b-bf66-161d4da1037f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ba09505-ef9d-45b5-8368-fb98da531787", "sighting_of_ref": "indicator--5302231a-c8a7-47b9-a528-a47fd0f60948", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80472696-472b-4d82-9270-4285f028e2a3", "sighting_of_ref": "indicator--144b861c-8304-4d69-848f-90649906f270", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aba3c75-f307-4aaf-9289-014f260f8c5d", "sighting_of_ref": "indicator--733cd3fe-b6ff-4259-a02a-ac6eabe36f64", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8186358e-2d2f-4967-9862-5d7f8f25592f", "sighting_of_ref": "indicator--8c3615c3-658c-489b-ae57-8f9f5398a3da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dce7c6c1-8f36-4040-8ba4-3cbff0b80490", "sighting_of_ref": "indicator--2f29e731-bb03-4591-a674-d47e1f6993c0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--436d161e-668b-428b-b6ee-5836dd9f1911", "sighting_of_ref": "indicator--0f1a001f-8c4a-46b0-857c-da22572ef756", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d4e3192-6f45-4492-98e7-f9e1cdca4371", "sighting_of_ref": "indicator--8d9ae5be-5436-4e64-a517-05d26c85628c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39d436f7-15d7-4769-a9af-c81ec6ca5d94", "sighting_of_ref": "indicator--8d9ae5be-5436-4e64-a517-05d26c85628c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44853316-06b4-4633-a122-b1b5fcff307a", "sighting_of_ref": "indicator--b29eb1d0-b18a-4f1c-88d9-5b4705e85522", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93ba8a2b-5a2a-47c0-866a-1f450ccc9525", "sighting_of_ref": "indicator--b29eb1d0-b18a-4f1c-88d9-5b4705e85522", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d6ef0ce-dc8d-4255-8b58-cd8becf0f083", "sighting_of_ref": "indicator--b3d2d5d8-260b-4d9b-b683-0e455b4bcada", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63147f2b-112e-4cfd-8ec7-28b3b2781138", "sighting_of_ref": "indicator--b3d2d5d8-260b-4d9b-b683-0e455b4bcada", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e32a8cb2-db08-4329-a858-9b8d6ad91864", "sighting_of_ref": "indicator--d2616f57-09b0-4524-9464-c661130a707f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1450ec6d-a67d-49cc-8751-0d187b1f2375", "sighting_of_ref": "indicator--b29aaf3c-da24-491f-bc89-11259318d8d2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51fc7484-96db-4d2f-bf6b-352a5ba3e129", "sighting_of_ref": "indicator--b29aaf3c-da24-491f-bc89-11259318d8d2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc0f07a9-bd75-4055-ab8c-5f3ff3bf25b8", "sighting_of_ref": "indicator--f3ff3f03-cc32-4510-8678-dd1af945fcb2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3ec5fb8-432e-46f7-9ce8-b7bf788fd9c8", "sighting_of_ref": "indicator--f3ff3f03-cc32-4510-8678-dd1af945fcb2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd910572-53a8-4dc0-bc23-975399e4dfaf", "sighting_of_ref": "indicator--82c1d8d5-49c0-4506-8ff8-577e9e9e8085", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8862cbbe-5a47-498e-aaa3-f50d86dab8fa", "sighting_of_ref": "indicator--82c1d8d5-49c0-4506-8ff8-577e9e9e8085", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb72d5d4-318e-49af-ae35-fbaa48bdb0ca", "sighting_of_ref": "indicator--054dce34-1e6e-47a9-a2e9-84b7bc5e8925", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0feac6c1-d743-476b-855d-a39800dc826a", "sighting_of_ref": "indicator--054dce34-1e6e-47a9-a2e9-84b7bc5e8925", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0ce3f52-28d3-4bd6-8d8f-f0921782b6ac", "sighting_of_ref": "indicator--b080ed81-f717-4058-b11e-5e9b4c93a9fa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5342c4a1-c4af-454a-8d89-e08799f9bba0", "sighting_of_ref": "indicator--b080ed81-f717-4058-b11e-5e9b4c93a9fa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fac28ef3-e429-45f6-a683-1f6dc385f092", "sighting_of_ref": "indicator--c17fc2fe-34b8-4eae-9254-ee85e573f346", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea34067a-731d-442e-98f7-fb38edff36dc", "sighting_of_ref": "indicator--c17fc2fe-34b8-4eae-9254-ee85e573f346", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a75d249-b0de-47ea-be7b-d4251c1ff044", "sighting_of_ref": "indicator--ccc8959b-cd73-4f90-845d-6f49ca25dbec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff8d0c31-1847-4f2b-8192-43e83edd83a6", "sighting_of_ref": "indicator--5e88584c-b70c-413e-ac06-2bcdb4465b1c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb73b2d2-1baf-4428-b17d-c1ab7edc3a99", "sighting_of_ref": "indicator--5e88584c-b70c-413e-ac06-2bcdb4465b1c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c9a7f18-e75f-446d-8aa6-70e31eaf88e0", "sighting_of_ref": "indicator--9676e76c-4aaa-4d84-9595-7d115e71c188", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67566b37-c8da-4252-8d33-b87e22b6d7b0", "sighting_of_ref": "indicator--9676e76c-4aaa-4d84-9595-7d115e71c188", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c909676d-9125-4fa3-aa12-2c64e850028a", "sighting_of_ref": "indicator--86b06ac2-fb62-4eac-9153-0ab4c5cb34de", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3c811d3-7465-4909-b23c-eeffb734738d", "sighting_of_ref": "indicator--86b06ac2-fb62-4eac-9153-0ab4c5cb34de", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05a5b897-c698-4cc9-be8a-025a6278312c", "sighting_of_ref": "indicator--63ba60d6-11de-4a18-9334-215a6915a2a6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--468e9cd2-e302-45b1-8826-0ec43dbc0151", "sighting_of_ref": "indicator--63ba60d6-11de-4a18-9334-215a6915a2a6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7401e2e-2106-4ec8-b4ef-fb5bd72431f0", "sighting_of_ref": "indicator--f4b4e096-843c-4a26-a034-affe4be40a21", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4556313c-0d2f-4b51-99c7-a9c15ff4321c", "sighting_of_ref": "indicator--f4b4e096-843c-4a26-a034-affe4be40a21", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--981d6da2-8c6b-4224-b778-85faddffaaca", "sighting_of_ref": "indicator--e7870714-985e-49a6-bf04-db63a071051a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cf813ff-353f-423a-a088-8525dac2c58c", "sighting_of_ref": "indicator--a1ec367c-19cc-40ea-8146-c44b95900825", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--344c138a-4192-4f4b-8e30-b09e360aff05", "sighting_of_ref": "indicator--c3fd1b2a-aff8-484b-b3bc-de794f479dc4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1452564c-4eab-4f11-bd75-73d7b3a558ba", "sighting_of_ref": "indicator--c3fd1b2a-aff8-484b-b3bc-de794f479dc4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f52f73af-7b39-4789-b0cc-7549853768fa", "sighting_of_ref": "indicator--2e2e18f3-0ee9-4e29-be9c-40c40d08fb8c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09402264-bc85-4205-97f1-8390d736756d", "sighting_of_ref": "indicator--2e2e18f3-0ee9-4e29-be9c-40c40d08fb8c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44b4fe45-fbe5-49cc-8cdb-52a1dbad584d", "sighting_of_ref": "indicator--84329481-7360-4cb5-a457-d7ee343573f8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d8a4fec-c2ed-441c-ad90-91c22e2dec33", "sighting_of_ref": "indicator--84329481-7360-4cb5-a457-d7ee343573f8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a200ce65-4eb7-4d76-84ea-91b7f9c8065c", "sighting_of_ref": "indicator--8b04710d-ebd5-4e07-a3be-ada246c83117", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3829f390-001f-4cee-b3d1-04b4d9e38d3a", "sighting_of_ref": "indicator--8b04710d-ebd5-4e07-a3be-ada246c83117", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4ff7af1-6cac-480b-97c0-f18c56f88d6e", "sighting_of_ref": "indicator--800c9a2a-d9e4-41c1-9dea-e39a93a4d65c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a2db42f-182f-41a2-90d6-96e184232428", "sighting_of_ref": "indicator--800c9a2a-d9e4-41c1-9dea-e39a93a4d65c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--122483e8-78d3-4e2f-86b3-a59dc72daaba", "sighting_of_ref": "indicator--e15a6a6f-f52f-4bb8-a183-87ad904780fe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6dc45d1-a2c0-4e91-bb03-e548efce8606", "sighting_of_ref": "indicator--e15a6a6f-f52f-4bb8-a183-87ad904780fe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--545e0fe4-e8c4-4e27-b4c6-0b2812191192", "sighting_of_ref": "indicator--71b15925-d62d-4ba3-b53e-40a9ebfd817e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--747ddc08-921e-4656-8d53-8ff6ef0f64f5", "sighting_of_ref": "indicator--71b15925-d62d-4ba3-b53e-40a9ebfd817e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1b64e4a-5595-4390-a685-db540b2efb85", "sighting_of_ref": "indicator--ee65fde8-ef8b-450f-bbbb-7b28d4cdd6f9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8406710-c1e2-4651-8f3e-851f12d3c462", "sighting_of_ref": "indicator--ee65fde8-ef8b-450f-bbbb-7b28d4cdd6f9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60182dd2-8911-4817-a8e3-d70a2910bacb", "sighting_of_ref": "indicator--f7173953-58f6-434a-a354-25b993207a95", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf83dfb5-52df-41e2-8698-95d5213e4f39", "sighting_of_ref": "indicator--f7173953-58f6-434a-a354-25b993207a95", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38090424-120c-4932-8c09-2cb5f6358797", "sighting_of_ref": "indicator--46607c79-5123-4199-a11e-b86730dc0a6c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--114b3284-d156-4e05-93a8-13eb5b901ff3", "sighting_of_ref": "indicator--46607c79-5123-4199-a11e-b86730dc0a6c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f22ce9d-ef82-47d5-82b1-06bc6d973101", "sighting_of_ref": "indicator--21ddc680-dbd0-4bf2-8f8f-2a3eeb7cc0db", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea5ab7be-58da-4bad-a94c-db165ceec1c5", "sighting_of_ref": "indicator--4a4b46c6-5c39-4997-9a67-42edd0abf6be", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4c42b24-343c-4810-a9dd-0e009b633a7a", "sighting_of_ref": "indicator--8c39d1c2-b2ed-4628-b798-3d6a09804ac2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ad4ca0e-7de9-470e-bfaf-b8999717e865", "sighting_of_ref": "indicator--8c39d1c2-b2ed-4628-b798-3d6a09804ac2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5a4b546-704b-459b-b763-23d309741898", "sighting_of_ref": "indicator--85231ed6-d45f-47d3-b7c6-f1c69148a4fc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70d3d228-ae59-4c9b-89cc-ea84f6a1e6b8", "sighting_of_ref": "indicator--85231ed6-d45f-47d3-b7c6-f1c69148a4fc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7af4c67e-8616-4136-920a-0e7955a52a1b", "sighting_of_ref": "indicator--8c9a8d81-c115-4d03-9e3b-1e03e273781a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e424a10-173f-4f8a-845e-97de8d1e7921", "sighting_of_ref": "indicator--8c9a8d81-c115-4d03-9e3b-1e03e273781a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b056471-148e-4635-ae4d-1be223be9b28", "sighting_of_ref": "indicator--d3bf757a-b0ca-4be4-8137-cfc05ba6abc9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e494ccab-46b8-413c-84b3-09359f355d91", "sighting_of_ref": "indicator--d3bf757a-b0ca-4be4-8137-cfc05ba6abc9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89f0b7b4-fb93-4e83-920d-3ef9d94084b7", "sighting_of_ref": "indicator--f0c3ad4d-80ba-4942-bed2-8890bb0f0d08", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd6fca17-51ca-4f82-99ae-23157db49cb3", "sighting_of_ref": "indicator--f0c3ad4d-80ba-4942-bed2-8890bb0f0d08", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2124ce3b-d937-4a6d-9a46-018c16715511", "sighting_of_ref": "indicator--561ec482-8d50-446a-88cb-f3772ab36654", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c2883f9-9629-4069-b881-ff98b9e89b4c", "sighting_of_ref": "indicator--7fa59a78-e3e4-40c9-b860-77d6d3aeee08", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67a9928e-a071-4358-850e-438342fb4896", "sighting_of_ref": "indicator--7fa59a78-e3e4-40c9-b860-77d6d3aeee08", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdd73b38-9b43-4020-a7b8-ff3de69964b2", "sighting_of_ref": "indicator--7b47fb3a-e49e-4ead-aba2-325cda116136", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--693f9a12-a955-40fd-adc1-b591de9c9523", "sighting_of_ref": "indicator--7b47fb3a-e49e-4ead-aba2-325cda116136", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb57e413-f4b9-41bc-8532-07b1b9a8ea1e", "sighting_of_ref": "indicator--de4cf733-f214-4ed2-8e1e-c5742e98368b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e97b65a1-2607-4fc2-9418-ab6841634e1c", "sighting_of_ref": "indicator--de4cf733-f214-4ed2-8e1e-c5742e98368b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df1db55b-dbda-4275-a734-1efd51142326", "sighting_of_ref": "indicator--9c613b54-1c66-4850-aaa9-49bc41490dfe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6ec14d6-0437-440e-8a7f-411f68d7204f", "sighting_of_ref": "indicator--9c613b54-1c66-4850-aaa9-49bc41490dfe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34774184-e8e5-4a9f-9891-1985ffd44767", "sighting_of_ref": "indicator--09a0424a-4103-4d1a-8d27-239590da5c04", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a225c628-ef0d-4675-bb71-41a7d4a87f01", "sighting_of_ref": "indicator--51c3e08c-53c0-416a-b948-21850613cffa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5939c520-6d62-49cc-83b7-cc8b9b368555", "sighting_of_ref": "indicator--51c3e08c-53c0-416a-b948-21850613cffa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d4ed86d-4fef-4a9a-976b-74a23bd5d086", "sighting_of_ref": "indicator--8ad2aabd-a235-4c9e-b9af-45377f1bc25b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebec988e-ab25-466e-9b2a-ed1a270ef53f", "sighting_of_ref": "indicator--42e2b04e-3ea7-4ea8-85b4-0535bb872ce5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--602c37c5-373a-4295-8493-e4dbc43af195", "sighting_of_ref": "indicator--7f36b711-9ca3-45dd-8293-586cb01d37a5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dffe9e96-2dbc-4293-8603-749fe2489982", "sighting_of_ref": "indicator--93591d44-e006-4573-8016-ac1a87927ace", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da22174c-cc3b-44c0-abfc-d6ce310fc2c4", "sighting_of_ref": "indicator--93591d44-e006-4573-8016-ac1a87927ace", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dd733ee-77bb-4cec-b91c-6df299176c81", "sighting_of_ref": "indicator--c4c1a45e-0296-425f-a957-a22f2589fa17", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27ea7d74-347a-44a8-a039-32c65c62079b", "sighting_of_ref": "indicator--c4c1a45e-0296-425f-a957-a22f2589fa17", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8d66b94-5e1f-4121-a249-77e03ab2efc3", "sighting_of_ref": "indicator--91570670-d045-4189-9e18-4f8e90a7cd1e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--684f528a-238c-4359-8bc2-1c0b1b8da90e", "sighting_of_ref": "indicator--1e740174-4a88-4cc2-affa-14ffcb53280b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e65d548d-d6c9-4cb3-b066-6f6b5266fc02", "sighting_of_ref": "indicator--28cd6de9-6332-481d-8aa8-cd7b95756340", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--430c62e9-a413-4e7d-a969-295bdaa8ec3a", "sighting_of_ref": "indicator--5969bbd2-1a02-4f5e-9949-c4042f6a8e1d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fce5eaf-03d9-49ff-b6f9-b00e0b3d7b70", "sighting_of_ref": "indicator--5969bbd2-1a02-4f5e-9949-c4042f6a8e1d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1148415c-4d1e-4276-8479-212a06b02947", "sighting_of_ref": "indicator--213e5713-2a1b-4d99-a33d-d41581392453", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab18be00-1db4-47d3-b79e-5e7452ef9787", "sighting_of_ref": "indicator--213e5713-2a1b-4d99-a33d-d41581392453", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--661feb8a-4b69-4ee8-81f2-a0e19c19a5f6", "sighting_of_ref": "indicator--fdf2584a-8884-47ea-ad6b-fbe146bc58d9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6f0f96c-397b-4581-abd3-5e244a04b9f8", "sighting_of_ref": "indicator--fdf2584a-8884-47ea-ad6b-fbe146bc58d9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c8048a0-ee59-4165-be59-6b571224e94f", "sighting_of_ref": "indicator--f410fdae-55d4-4238-b070-7e8422dd3599", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f933aa7b-3d1b-4c1e-92d2-652c779cc36e", "sighting_of_ref": "indicator--f410fdae-55d4-4238-b070-7e8422dd3599", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--696734f5-be73-4d3b-b9ea-23aa8d8555f2", "sighting_of_ref": "indicator--71c4a6d1-9d91-4d50-821c-c75f34223dee", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27eb694d-59a1-4de9-bd75-dece39d91f5c", "sighting_of_ref": "indicator--71c4a6d1-9d91-4d50-821c-c75f34223dee", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90989b5a-85dc-4e55-a541-ba2e51963d9d", "sighting_of_ref": "indicator--4b76f494-2695-4e53-9d48-74d771c9bc5f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f391b4a-b853-4284-8413-ffab09ca06b4", "sighting_of_ref": "indicator--4b76f494-2695-4e53-9d48-74d771c9bc5f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ded443e0-a090-4276-b70c-ac40c5574f78", "sighting_of_ref": "indicator--d63c7682-9cf5-4675-8cb1-328397271a26", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe61d3a2-ff97-4fbd-aff1-8d5a7f35c2c9", "sighting_of_ref": "indicator--d63c7682-9cf5-4675-8cb1-328397271a26", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--595d2b7a-11af-4dcd-bf1b-51631d319043", "sighting_of_ref": "indicator--c68f234e-6b28-4e0f-af81-bd27a6888c8f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a316810-3b3a-4358-9844-9b649ab6c8e8", "sighting_of_ref": "indicator--c68f234e-6b28-4e0f-af81-bd27a6888c8f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--184d7ce8-995a-4e2a-ab6d-a9429f1dc19d", "sighting_of_ref": "indicator--df6664d5-f463-4a27-8430-bfdf00965d07", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16dbd871-3f92-4c05-aaf5-bcc736d947e4", "sighting_of_ref": "indicator--df6664d5-f463-4a27-8430-bfdf00965d07", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dc5d030-6881-47ff-9acb-8fb36fb8df9c", "sighting_of_ref": "indicator--eff3eb8e-ff75-4cf1-9bae-5bab7d6a88e8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95cb19ce-7912-4638-88aa-2303928cde34", "sighting_of_ref": "indicator--ddd0a797-4eba-4dc2-bdbd-3f6cd6d012fe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d960001-fb43-4cda-8017-52ef53add5d2", "sighting_of_ref": "indicator--ddd0a797-4eba-4dc2-bdbd-3f6cd6d012fe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d6148d2-54e7-4c0f-ba24-cf0bed685321", "sighting_of_ref": "indicator--17d0dc1f-f47c-4d3d-a000-7336aecf2c88", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69283c58-d667-423e-a60f-c3182adbcb59", "sighting_of_ref": "indicator--17d0dc1f-f47c-4d3d-a000-7336aecf2c88", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ed425f9-4190-4c25-aeec-051080134fae", "sighting_of_ref": "indicator--49f3e517-60b2-4527-b03e-8461e7b0b19e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ef71edf-9981-4d71-a6f6-eee1b2bc3fac", "sighting_of_ref": "indicator--49f3e517-60b2-4527-b03e-8461e7b0b19e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd02fb1b-0e1d-4add-8c4e-ef74ee0d1117", "sighting_of_ref": "indicator--90434f8d-bab4-4942-93c3-537aaa4a91da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a8e80fe-140a-4fbe-bc3a-f37b1b0be34c", "sighting_of_ref": "indicator--90434f8d-bab4-4942-93c3-537aaa4a91da", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ed0834e-ebb7-406c-a517-8695628c655a", "sighting_of_ref": "indicator--f37c6779-243a-46bd-bb8f-425349587035", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab04af8e-64fe-489d-8716-f39b0c0944dc", "sighting_of_ref": "indicator--551d2f5f-5d0a-47b3-9ee0-418d011af169", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30d1b688-acff-42d8-95de-664d86948e4b", "sighting_of_ref": "indicator--ca4f79e9-e82b-4366-9c5b-9fcafb65165f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d23dcaf-4af2-419f-a167-572b78635ae0", "sighting_of_ref": "indicator--d64989bd-ceb3-4311-bc98-a3ddfb266513", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cf68a14-3b59-4a36-a4f4-1e8f0e881c15", "sighting_of_ref": "indicator--d1df2639-13b5-4be7-9d0e-4b088b6e98da", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b04ab32a-4455-4873-be35-177ca5b7037b", "sighting_of_ref": "indicator--e8a55b21-c70f-4425-a81b-dc376fae3374", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84b25357-18f2-44f8-9333-8ecb4c508d1b", "sighting_of_ref": "indicator--e8a55b21-c70f-4425-a81b-dc376fae3374", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4968b1fc-908c-4d7c-941d-b47a8f845ef2", "sighting_of_ref": "indicator--8f0bb9ee-112a-4464-9e3d-077b79475c0c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fd67e23-12d4-4054-91ae-d8dedaec4284", "sighting_of_ref": "indicator--c612f276-a587-4ed8-99a6-9e40662ed7b7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f27d8e33-e2cf-4d7d-a767-3bb24b441f3e", "sighting_of_ref": "indicator--f847af97-6c9e-4cfe-b027-69f330e525da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef0a1f3f-0660-49f1-8dac-ee6ff9ae84ae", "sighting_of_ref": "indicator--f847af97-6c9e-4cfe-b027-69f330e525da", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4fb11a1-1a6c-4724-829b-43112540915f", "sighting_of_ref": "indicator--5d86dafa-3a04-41a7-99bd-88ed33866315", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c43072d8-4529-4222-a840-f59a7dbb390d", "sighting_of_ref": "indicator--c5f281a3-5bc7-4249-ba31-6d9216234332", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2f9318f-2f2a-4ccf-96bc-b9e884a06281", "sighting_of_ref": "indicator--c5f281a3-5bc7-4249-ba31-6d9216234332", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33d45f57-dc42-4749-9ddd-32eb7699aedd", "sighting_of_ref": "indicator--70ee617e-060b-4ec3-98a7-b79008f2870c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c929f5ad-33d0-4fdf-af29-8faec6f9fc5a", "sighting_of_ref": "indicator--c152f709-1fa9-46bd-9b63-11de869db05b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfa65697-ce24-4393-8978-55d089daf7b4", "sighting_of_ref": "indicator--c152f709-1fa9-46bd-9b63-11de869db05b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef62eadf-443e-406c-9d29-d15b3ab61272", "sighting_of_ref": "indicator--9482703d-4f1c-44ee-97eb-7e45f6ba3763", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa4f2458-f033-4ec6-84d3-e9838b2ac445", "sighting_of_ref": "indicator--6dabc6a3-a010-4162-8f77-cfe6ace07b63", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c1437e0-c645-463d-b17f-305f12f4e6bd", "sighting_of_ref": "indicator--6dabc6a3-a010-4162-8f77-cfe6ace07b63", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed7253d8-ca9f-4114-861b-0f8e18784dbe", "sighting_of_ref": "indicator--7930b2ba-bd06-4efb-b50d-0c637f53dccb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5c65c3b-8831-4dc0-b5df-6932ba2c8df2", "sighting_of_ref": "indicator--7930b2ba-bd06-4efb-b50d-0c637f53dccb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7358db3-31c1-4cbc-af4e-500cde7173b2", "sighting_of_ref": "indicator--7d2a8337-aa3b-41d7-8391-e5f3cb8ae4c8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3d7a9d4-ee62-42ec-a256-e3352e9518a2", "sighting_of_ref": "indicator--7d2a8337-aa3b-41d7-8391-e5f3cb8ae4c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c943a445-0ffa-457c-b692-4619ed04bc7d", "sighting_of_ref": "indicator--294b9531-d1c0-4fab-854e-c53e81d796ec", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39f0b328-ee44-4e93-b738-a0eabf181f1b", "sighting_of_ref": "indicator--95d5486d-5c93-40c0-9baa-63e3ae2d3d2b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3144c708-9bbc-49b2-b632-733ee7d90f25", "sighting_of_ref": "indicator--8ca8f358-eca8-4e83-8c1d-42f3a63fcb8e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--731f3e44-5951-4bcf-8828-421e755c75f7", "sighting_of_ref": "indicator--8ca8f358-eca8-4e83-8c1d-42f3a63fcb8e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62b0d121-960f-4408-8dd4-ecd0801afc9f", "sighting_of_ref": "indicator--659af032-5ab3-4255-ab7a-9c68266d3284", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13bc5cfe-fa84-496d-af72-329668be481f", "sighting_of_ref": "indicator--659af032-5ab3-4255-ab7a-9c68266d3284", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3727f67f-aed4-4046-a144-fd7c54525598", "sighting_of_ref": "indicator--1a7ccdf9-b537-4a8f-bf01-2df9b8809ce3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98e7da83-bd6b-43b5-9889-1c7f02ee5dcd", "sighting_of_ref": "indicator--1a7ccdf9-b537-4a8f-bf01-2df9b8809ce3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b08b0e6f-c1b0-46b0-bd48-fcf7311c86c8", "sighting_of_ref": "indicator--52c40fde-ab7d-4f38-81a4-b8efb63340ac", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db11bad7-fceb-4cb6-90a6-abbc6d6cbcd8", "sighting_of_ref": "indicator--52c40fde-ab7d-4f38-81a4-b8efb63340ac", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1ecbcba-8f1b-4522-b259-255eee5c0287", "sighting_of_ref": "indicator--bac7f4ec-2b84-4062-ad50-8de6495651c6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e1800bf-415e-4750-927a-4f5762b9dc8d", "sighting_of_ref": "indicator--bac7f4ec-2b84-4062-ad50-8de6495651c6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a47c4f1d-ea37-4934-b1dd-2f16a513da8f", "sighting_of_ref": "indicator--406fd8ff-9244-4cba-838b-e1bd0caa7dfc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2096c53-bd2f-4899-9690-2fc415666f9a", "sighting_of_ref": "indicator--406fd8ff-9244-4cba-838b-e1bd0caa7dfc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ef44a9e-9c05-4d17-8903-5c239186dabd", "sighting_of_ref": "indicator--4ac5e0b1-a637-4418-b401-2c46a89dde21", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7075baae-69ab-4881-973d-72477f561080", "sighting_of_ref": "indicator--4ac5e0b1-a637-4418-b401-2c46a89dde21", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e96708a4-b849-4cf5-a222-a8b11c48e4d7", "sighting_of_ref": "indicator--5733449d-0e63-449e-a212-50956940393c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60163edf-46f8-4bb5-8861-03d4f0b7410b", "sighting_of_ref": "indicator--5733449d-0e63-449e-a212-50956940393c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f67edd01-879f-4d20-bcc8-5649d6c69fc5", "sighting_of_ref": "indicator--b4443b80-8c5a-49ec-b112-5f2c2a4d3fbd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c28530b-bc3f-424f-91bc-184640385ae2", "sighting_of_ref": "indicator--b4443b80-8c5a-49ec-b112-5f2c2a4d3fbd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09f83d41-e670-49c1-be0c-7892a5c8b88e", "sighting_of_ref": "indicator--3306762a-907c-46af-8af9-957ea3909b28", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--165978c5-0231-4fc9-8f83-d39aaf0a4c16", "sighting_of_ref": "indicator--3306762a-907c-46af-8af9-957ea3909b28", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7aaa1f98-d43f-47fc-81d4-c4bda31ed91f", "sighting_of_ref": "indicator--e26132c5-ee36-4362-97d8-a9a9daa34348", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72d608fa-2eaa-4200-9419-68cb075205a7", "sighting_of_ref": "indicator--e26132c5-ee36-4362-97d8-a9a9daa34348", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa0a2562-d501-4dd6-a11d-2742aaa66e29", "sighting_of_ref": "indicator--7b221372-450c-4ce0-8b70-8d06db1a42c4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe534280-8fd9-4d1f-98d7-24706908db7e", "sighting_of_ref": "indicator--7b221372-450c-4ce0-8b70-8d06db1a42c4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9372cabb-7379-44a3-adbf-d99720e81941", "sighting_of_ref": "indicator--d7c62f1d-d8cc-41f0-baa5-a39232c901c1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7958a6d-ff93-489d-9fcc-52f19ecb875a", "sighting_of_ref": "indicator--e00dabff-f56a-4c75-9dfc-b9c525355c9f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad6ba3aa-1511-4492-a7c6-6ccfa0fb7514", "sighting_of_ref": "indicator--a58c10e7-3b59-4b07-ba61-2fc8f61ef829", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dbd0592-018e-49a6-a6a8-82694ea43f9e", "sighting_of_ref": "indicator--a58c10e7-3b59-4b07-ba61-2fc8f61ef829", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38a76903-308f-4d59-bbd2-c7cb08bcec55", "sighting_of_ref": "indicator--db72d14f-6074-439a-9481-c2f3ebce91ca", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f3a65d6-7ca9-40f9-b412-6783c657fa1e", "sighting_of_ref": "indicator--db72d14f-6074-439a-9481-c2f3ebce91ca", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1475d5df-6010-4986-a7f6-b71763d7b217", "sighting_of_ref": "indicator--440ff1b9-8ed9-47df-8a37-3a97a8e1edb8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bf65424-b4e6-4a32-b6a9-6a72114868fb", "sighting_of_ref": "indicator--30673c98-b119-4e63-8829-0dc42ea217e4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21f82e36-f6aa-4cdc-bb76-e3e515cd6007", "sighting_of_ref": "indicator--b06defd6-d5f6-4126-b426-6c7ae359166f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f4ca103-d824-43b4-9592-6055d8b0ad2c", "sighting_of_ref": "indicator--b145a29d-d618-47cf-9f18-5fc70d90ea90", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--253f2bff-ce4f-4c0f-96a0-4767f266107f", "sighting_of_ref": "indicator--b145a29d-d618-47cf-9f18-5fc70d90ea90", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00b28751-9dd8-406e-9a32-6fc481714134", "sighting_of_ref": "indicator--c459d319-1526-4e6c-891f-5e66be6af232", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7f98544-a3b2-426d-908b-68f666f5179d", "sighting_of_ref": "indicator--0e3dc31e-1e67-4e56-9e53-0139280a5295", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6835a3cd-9f27-4bfe-ac57-e900e7920077", "sighting_of_ref": "indicator--f6412df0-656e-4a0a-aea6-939771a41ef7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2aa945aa-9d57-4771-93b6-30ad5b2fa634", "sighting_of_ref": "indicator--3a70c695-92f4-4e49-ba25-b67d15e9bd6c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55f03ad7-572c-4e39-af73-5b3a1b299cf1", "sighting_of_ref": "indicator--792b210a-98a2-4371-a05c-d2990cb0a225", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2540395-e507-4c57-8c67-d0f7cf82fda0", "sighting_of_ref": "indicator--02746d1d-f4b7-4686-a735-b7864fe3e82d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d7c1205-db2b-4250-be84-e07c57cbe181", "sighting_of_ref": "indicator--c6d1d05f-4ae2-49b8-ad8a-24a737c1dae5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--422aac61-0412-4a03-9302-7b9d4dd7bcd2", "sighting_of_ref": "indicator--3c9f4a19-468a-4821-b80e-62f47fa73d43", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94f9ec51-18ed-440f-86b9-300e4dd968cb", "sighting_of_ref": "indicator--268d86e4-52fd-4d0d-8a08-331985b8e659", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbad993d-0c73-4d88-87f2-691904fcb212", "sighting_of_ref": "indicator--9f560e71-e4f3-4f69-a9e5-3a4c32972749", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5abd6b39-c743-4f14-b902-86d1bb31e582", "sighting_of_ref": "indicator--108f0a77-f610-4ddd-bb32-0cca4b6dbd07", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f53e6e8-3fb1-44c1-8c21-35c6d4d72676", "sighting_of_ref": "indicator--07de38a2-bbce-4d60-9e79-d95d04395887", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9b1911e-baa5-47d3-9ef6-c919e5a39c80", "sighting_of_ref": "indicator--f19e05af-5feb-4742-bd2b-3d75290dcd39", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3e3bb66-f353-4cac-9a54-4f0ae26fc32c", "sighting_of_ref": "indicator--230f625e-6589-469a-914f-cdc578283d88", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8fce8dd-8578-4aaa-bd91-364f10cc4652", "sighting_of_ref": "indicator--64105af0-a38b-4307-9267-649bf5f1eba4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24e81bc1-b312-429b-8e62-0a2d55ea08b8", "sighting_of_ref": "indicator--0eb49970-02e2-49e1-a160-2801a4f836b5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c259c95-4c5f-42b4-9024-e520c0884bdf", "sighting_of_ref": "indicator--49df7bd9-ac59-4b85-94b1-c6e7f335e55d", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cf46c19-ad67-45e5-bcef-a9c976ed11a1", "sighting_of_ref": "indicator--49df7bd9-ac59-4b85-94b1-c6e7f335e55d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d81a2dca-719c-4da9-8b9f-a989cf5f956e", "sighting_of_ref": "indicator--4ebd8986-fba9-4d21-b6cb-1c4b8f8a8f93", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5e35735-2a10-44c6-8576-4d6e45d10064", "sighting_of_ref": "indicator--d85aba27-3e74-45cb-a096-5cd62e8a9b09", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06a770fc-f2cc-4b67-b32b-380b7676df7f", "sighting_of_ref": "indicator--0857316d-c4d6-4e0a-aecf-33cf3a3abe56", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb4acd8e-f0fd-43f8-a623-cf37b5025b14", "sighting_of_ref": "indicator--ce66ea9e-6665-4c2f-810c-5dd2fd68d20a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37e9ca81-daee-4166-8c58-5a1943c7c67f", "sighting_of_ref": "indicator--ce66ea9e-6665-4c2f-810c-5dd2fd68d20a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2b5bf0b-48e2-4c7f-8e83-fed58c77d248", "sighting_of_ref": "indicator--e50a0a30-2c5d-44fe-b5fb-7d6326deddee", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52a9a692-58eb-4678-b8f3-a985fc3fbfdd", "sighting_of_ref": "indicator--ad5be84f-3472-49e2-a75c-0ad9fcf30f62", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66cd7688-09ed-4f9f-81ef-a3d18fcf7fce", "sighting_of_ref": "indicator--46bc1231-3305-4d40-9960-cd744ec3116a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cb0b9ca-05d7-443e-9452-d2fc74c91bb5", "sighting_of_ref": "indicator--4742c2fa-c854-42f8-ab8a-8a6beef4060a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad2a5575-4070-4a03-8fff-bf7ce33822c5", "sighting_of_ref": "indicator--8ad8a2e0-009e-4bd0-b0b0-75bd8f35006f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f183574-f1fb-4943-b6be-6ced5d6798f9", "sighting_of_ref": "indicator--4b9cbe30-2cf8-4a8a-becf-615a7525b756", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--517c1b32-ca23-4899-ab4d-db3e7df9234a", "sighting_of_ref": "indicator--9b69959f-d946-4b72-9629-6b46092aacd8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbda7b84-5b62-4cab-a126-62bfc88c1914", "sighting_of_ref": "indicator--223d16a9-6957-438d-8606-cba38e19b400", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2673473e-0fcd-4e00-b088-bdfc6b79e2d0", "sighting_of_ref": "indicator--a72915d5-0493-44a1-8b46-fa09a33a1f65", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9584f0f7-a372-4a79-ae63-54999e94c3f4", "sighting_of_ref": "indicator--49d369fb-bc6c-41dc-8f61-1fd213ed7355", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4b59dea-d4bc-4b68-b426-38773d4830ec", "sighting_of_ref": "indicator--28fb6095-3855-4214-a94c-8e7c9dd585f8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f3ac85d-b65f-4259-9be8-09a54419d41b", "sighting_of_ref": "indicator--f3396ac8-b133-4d60-a9bd-6d8b5cd94233", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d2a5656-c0dc-4594-88cb-99fb18fcc33d", "sighting_of_ref": "indicator--334265d9-403d-4745-ad1e-bdcea0b55e6d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e37752d-d6f1-46a2-ac06-9ee1d515e04c", "sighting_of_ref": "indicator--690c1154-44a1-4a33-b488-e89953e9ca62", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--241dd7af-e956-4699-b861-648d0d4fedee", "sighting_of_ref": "indicator--690c1154-44a1-4a33-b488-e89953e9ca62", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9308f199-bb1e-4e77-b9df-e8797da9b24a", "sighting_of_ref": "indicator--ff0099dc-cbe4-46ba-8203-433e5e3df96c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d0ec1bd-96e4-4b20-9e09-e0025bf5fbd8", "sighting_of_ref": "indicator--ff0099dc-cbe4-46ba-8203-433e5e3df96c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbd6112c-97b5-4647-ab56-bca84a209f56", "sighting_of_ref": "indicator--9eb4d7df-2182-4a71-85b6-9cbf6e67e493", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--684bc805-7e81-4719-8b96-4dcabf796e52", "sighting_of_ref": "indicator--65f1b4ad-63d2-43a8-bf95-e11a31aa1466", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1eec6700-5847-45ab-b778-83b8b1ca8d28", "sighting_of_ref": "indicator--65f1b4ad-63d2-43a8-bf95-e11a31aa1466", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff4c9c00-115a-4e70-8020-1b9796d716e8", "sighting_of_ref": "indicator--184ebf05-b8db-44ab-b5c2-bf9492d54ca7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa87b94d-504a-467c-9407-f92ddbb33055", "sighting_of_ref": "indicator--d15de891-9b26-47d0-a7df-ea7e32e92fe3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd6acfe9-57fd-404e-a460-c6057db8155c", "sighting_of_ref": "indicator--d15de891-9b26-47d0-a7df-ea7e32e92fe3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d8177dc-ad21-4a53-b238-9b69cdb110aa", "sighting_of_ref": "indicator--0d7de91e-fd6c-4e83-8a1a-77cefd24931a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--029c8c99-a287-48fe-b2ea-0216c772ef65", "sighting_of_ref": "indicator--0d7de91e-fd6c-4e83-8a1a-77cefd24931a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a6b86f7-6a11-4c72-b867-87017adf9f52", "sighting_of_ref": "indicator--65334fdb-b4fd-4e1f-9786-8d5afa406465", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87269062-c764-4622-9b19-c5ca762d3bc3", "sighting_of_ref": "indicator--b704bc28-059b-45a7-921d-f3b0561c1dd3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52acc58c-e1f4-4d34-baae-2ea9581501d6", "sighting_of_ref": "indicator--b704bc28-059b-45a7-921d-f3b0561c1dd3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cdcee84-65b9-4b70-8552-8e923c21be98", "sighting_of_ref": "indicator--2d31ecb1-892f-40b2-bb98-fdcaad446bde", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3486080-a9b4-498f-a09d-abd3763b2bc6", "sighting_of_ref": "indicator--2d31ecb1-892f-40b2-bb98-fdcaad446bde", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--011328ea-0bc1-4d60-90b6-a2aaa4fbfda3", "sighting_of_ref": "indicator--ac81f810-058d-4b17-814b-456b28500596", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99d13c91-758f-46e4-ae28-f27e36f3eeae", "sighting_of_ref": "indicator--b0158f92-da69-41e8-84c4-1e619b07d668", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6895af72-b29a-4539-bf9f-a19d4974edd6", "sighting_of_ref": "indicator--b0158f92-da69-41e8-84c4-1e619b07d668", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--257dadc3-1b48-4462-9908-7c1519dc73b8", "sighting_of_ref": "indicator--60ff074c-204b-405d-8a50-f09e6b0bd907", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfb5dfe5-0c8e-440b-ae57-6c596140802c", "sighting_of_ref": "indicator--0d3a1864-9380-4035-a0fd-776b6c678ea1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--212248ad-f400-44ec-aad5-3f98f787547b", "sighting_of_ref": "indicator--1b561519-c177-4c99-ab30-9decc3ebfa13", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e0fcd41-5dc1-47eb-ae53-c3b22efbb586", "sighting_of_ref": "indicator--1b561519-c177-4c99-ab30-9decc3ebfa13", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--644f1133-c5f8-4d0c-bdd2-49912e7814c7", "sighting_of_ref": "indicator--a6c8751f-231a-4f9a-9cf8-68db8a6c760a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa2b95f2-9241-4a4d-a7f2-418a6c52c123", "sighting_of_ref": "indicator--a6c8751f-231a-4f9a-9cf8-68db8a6c760a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21346cba-44b9-4c9f-839c-14ae2b1f263a", "sighting_of_ref": "indicator--611f8528-020e-4a6c-9803-8daf9ad010f4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5004b8d-1dba-4c5a-8dbb-218b0491904c", "sighting_of_ref": "indicator--611f8528-020e-4a6c-9803-8daf9ad010f4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b22f07fe-6ff2-4e20-92cf-a78a68ce47f8", "sighting_of_ref": "indicator--ded0f75f-9bab-4da0-ba69-9fd972f42ba4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db558e0e-62d5-4491-8356-85372ea4bed1", "sighting_of_ref": "indicator--ded0f75f-9bab-4da0-ba69-9fd972f42ba4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa1b58b3-8ed8-46f8-b595-245acb9f0606", "sighting_of_ref": "indicator--9a79fcc1-92c3-45ea-bc6f-7dce1079bc4c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b883c600-3bd2-46e9-bdc9-c9e4e539b3dd", "sighting_of_ref": "indicator--9a79fcc1-92c3-45ea-bc6f-7dce1079bc4c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3ff66c8-065d-4d88-89a5-6a02d3103239", "sighting_of_ref": "indicator--56d89400-6f64-4e4c-965a-83b1ea89e10c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6959987-e48b-44ed-84b9-befc5ff026af", "sighting_of_ref": "indicator--56d89400-6f64-4e4c-965a-83b1ea89e10c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d15c0f86-ba11-447c-bdcc-d8b3338c68e0", "sighting_of_ref": "indicator--493ceabe-11ca-47ee-ba1b-22330277b1be", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54320b80-b751-48ca-98b1-da3fcbc06225", "sighting_of_ref": "indicator--493ceabe-11ca-47ee-ba1b-22330277b1be", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f44fdd9e-3a58-4ef4-97bb-1f80f007a490", "sighting_of_ref": "indicator--f03e94c1-ed4a-42ad-9a67-5b99d91964c1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6184666f-8ddd-4335-9bea-b5b14079c126", "sighting_of_ref": "indicator--f03e94c1-ed4a-42ad-9a67-5b99d91964c1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8439f7be-c557-451a-b949-ea2d82063e5c", "sighting_of_ref": "indicator--1ba4ac9a-ffc6-4dfd-9ef4-8c9e909a1ee0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--338f5de4-fe8b-40ab-a808-6b9d07164322", "sighting_of_ref": "indicator--1ba4ac9a-ffc6-4dfd-9ef4-8c9e909a1ee0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55e44890-83c9-4438-b572-73108dd3b0bc", "sighting_of_ref": "indicator--bffc4eb4-809c-4adb-8c51-062c9148c005", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efbfd646-c500-4584-b0ac-b885dc1e580c", "sighting_of_ref": "indicator--bffc4eb4-809c-4adb-8c51-062c9148c005", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4115bab-79b0-409a-bbe5-b6d76439c2b3", "sighting_of_ref": "indicator--972675fc-10ed-4041-b978-5f15a3551a5b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2ee0b16-d5d9-48c4-8f51-e7776b92752a", "sighting_of_ref": "indicator--972675fc-10ed-4041-b978-5f15a3551a5b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9de3622d-061a-48af-9184-43b8c0241605", "sighting_of_ref": "indicator--fa6968c7-936a-4052-ab1d-2688465479a2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00953693-9342-439e-951f-a4fb4ab55fab", "sighting_of_ref": "indicator--fa6968c7-936a-4052-ab1d-2688465479a2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b11295ff-d1d9-48ca-b21a-d2f849f115fc", "sighting_of_ref": "indicator--5bfbd4a1-a478-40f4-9d69-0157f3f23a41", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70406c9a-d3c1-4324-aa82-4a7e71e8d91f", "sighting_of_ref": "indicator--5904d93a-8f77-4afd-85f1-528770c4d78a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3504b96-ebed-4db1-8ac1-316917a0bb56", "sighting_of_ref": "indicator--5904d93a-8f77-4afd-85f1-528770c4d78a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c5fc6f8-b1d9-4a9b-ad56-c82fecea4a0b", "sighting_of_ref": "indicator--a7dedd35-3359-4ca6-ab49-f90a43877aac", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b35e96c-ab4c-4de6-a548-9b9562d9bf2c", "sighting_of_ref": "indicator--a7dedd35-3359-4ca6-ab49-f90a43877aac", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6862171e-6839-4531-9a33-07a9722811ea", "sighting_of_ref": "indicator--d9cc2854-d4b3-4469-91b2-833e46805b5f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c534dcc-5743-46e9-ba11-937490b87a1e", "sighting_of_ref": "indicator--d9cc2854-d4b3-4469-91b2-833e46805b5f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e59f1084-923a-42e1-b6e6-b931bf6d7ab8", "sighting_of_ref": "indicator--9c6aa25d-4f47-4839-9264-3892971dd40c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d68b716-7355-4cfb-854e-b774e5f6ae17", "sighting_of_ref": "indicator--81dbe1a1-036f-431a-954e-6da19843ab18", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95a8a4d6-0c09-4622-8897-a261df4d547b", "sighting_of_ref": "indicator--81dbe1a1-036f-431a-954e-6da19843ab18", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1020c383-a697-4b47-879f-e09b2774976c", "sighting_of_ref": "indicator--d03d25ea-143d-456e-bd91-6695d104592e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a2c8a03-9ada-46b5-8393-f2a50efdc782", "sighting_of_ref": "indicator--d03d25ea-143d-456e-bd91-6695d104592e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8268c94a-6940-4e1e-9766-74778a3a9794", "sighting_of_ref": "indicator--70b12105-cb6c-4499-b085-750f5073f081", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fc6c4e3-ab6e-49d8-beac-12a4f3bf935a", "sighting_of_ref": "indicator--70b12105-cb6c-4499-b085-750f5073f081", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e45bab3-2a6e-438e-8b60-e1c7d18547da", "sighting_of_ref": "indicator--e84a171b-5f6c-4922-aea3-c4e6166552f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2ee3678-0795-41b0-a2d8-cd7e747eb57a", "sighting_of_ref": "indicator--e84a171b-5f6c-4922-aea3-c4e6166552f0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d9b6355-8c95-4b7b-8bce-5db5405c142b", "sighting_of_ref": "indicator--47cd9f1b-e182-4349-989f-22929adf66f4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faee0ff0-a819-4d89-bd99-bd15b06527a9", "sighting_of_ref": "indicator--47cd9f1b-e182-4349-989f-22929adf66f4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afe44d06-907f-4f6b-a428-78d0c98bbafb", "sighting_of_ref": "indicator--c173e7e4-ca71-45a3-b11a-213dc1fff5ad", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bdfc7a8-8588-459f-9956-bfb6ad845b3f", "sighting_of_ref": "indicator--c173e7e4-ca71-45a3-b11a-213dc1fff5ad", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d36e8de-c42b-4160-b3dd-20d9080a7755", "sighting_of_ref": "indicator--cbad5474-8499-4c56-a37f-a16645ad7a6a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25e5618e-34ca-4fca-b137-308333ad56f1", "sighting_of_ref": "indicator--cbad5474-8499-4c56-a37f-a16645ad7a6a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c14bcd99-5039-462b-8616-7de494a59818", "sighting_of_ref": "indicator--bcfd380b-7966-455a-bce3-a85c3925ec63", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69333e6e-4829-4179-8027-aa91ec0fa41e", "sighting_of_ref": "indicator--bcfd380b-7966-455a-bce3-a85c3925ec63", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--045a88dd-db70-4573-997d-eeeab9b4fd9e", "sighting_of_ref": "indicator--91aad627-2ffa-4b96-bc09-a29332bf701b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c94e8223-3645-4812-a73b-987733659e5f", "sighting_of_ref": "indicator--91aad627-2ffa-4b96-bc09-a29332bf701b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89253b5d-7055-42a8-9f92-76927cb30d33", "sighting_of_ref": "indicator--28052656-1ac4-46f3-922c-28a813238520", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbcdd70f-9ba3-4d7f-bb3b-b1a2ca4fd254", "sighting_of_ref": "indicator--423d27ca-90f2-4365-a392-aa2a051dca47", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de33d389-5a02-4868-ae5f-dd39e17ed307", "sighting_of_ref": "indicator--d975ec25-9224-4261-99fe-003620466208", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58dd9b1b-215c-449f-8125-f34127a31902", "sighting_of_ref": "indicator--b5c8f402-3b9e-4a04-a8fb-09c477a53cf5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b0d8430-13c7-4d0d-b200-f0560b623bf4", "sighting_of_ref": "indicator--01f3b363-2612-4f7a-95ce-a09504828492", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00e433ce-c562-4a4c-809a-7402e9f961bc", "sighting_of_ref": "indicator--db6123b7-1af9-43ca-9d08-67137c8b5995", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4855424e-f203-415d-a3a2-4c7b9001a18e", "sighting_of_ref": "indicator--9a84a96e-f97c-4e3b-ab38-781455fc0a1f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a50f87c0-291c-4576-9b07-242ed4b3004a", "sighting_of_ref": "indicator--3f279dae-d39b-4932-94cd-9bd964a50c51", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--022ea6d5-e2f7-4aab-82b1-0643c9e1ee38", "sighting_of_ref": "indicator--46376e09-03e9-48a8-a88f-a766bd996146", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09a24c3f-2650-43ad-96c2-229d69ffe40a", "sighting_of_ref": "indicator--ac00b767-77f1-43e3-9e3f-5602762f23e5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a66e604-da38-448b-895e-201a352e5082", "sighting_of_ref": "indicator--20dbcfda-7dab-41cb-9703-b8aa26fc7721", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83e9da5f-0325-4e00-b00c-f8a509c36c5c", "sighting_of_ref": "indicator--fa5d8550-47ab-400d-a259-d2932bdf8ea2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01a42b6f-6999-4701-9020-89e41ac735a9", "sighting_of_ref": "indicator--f1307713-6ec8-44be-b25d-40f7a39412d8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2121bc33-14a8-42fa-a10f-487b1148b907", "sighting_of_ref": "indicator--f7af380f-e456-4709-ba8e-5b0e6f5dce4d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cacf9452-5e49-49ec-90ec-c43c9deab9c5", "sighting_of_ref": "indicator--a8c6cdc8-55f7-44ac-ac58-c3b118564d98", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47de5478-c33d-457c-b20b-b433a4d5821d", "sighting_of_ref": "indicator--37e3a1e5-c6e0-468d-81fd-c2944d9993e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39f3d49e-5f3f-403f-b413-4581d86cd29a", "sighting_of_ref": "indicator--2c925ad7-d728-4c72-8b84-5b8e35e4e63b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a5f5db0-26a5-43c9-87ed-622d822ff4ca", "sighting_of_ref": "indicator--6de2c175-25c5-4cab-82c9-fe0d5a1b17e8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a265e67f-fb86-4478-83d6-9eda3a72e79b", "sighting_of_ref": "indicator--4fef4969-178b-457e-9186-7bfb374fd0f2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14a41a5e-6247-473e-99b8-21b32454727d", "sighting_of_ref": "indicator--4fef4969-178b-457e-9186-7bfb374fd0f2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--299c207c-2a8e-4d9b-944c-e3ed2197c776", "sighting_of_ref": "indicator--9c86fac2-87e1-4958-9a8a-05109e3af3ba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fa98ac1-89d9-430d-9a80-310500b3ebd7", "sighting_of_ref": "indicator--d0e704ec-6130-4735-bb45-fa684693934c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--361be1c2-84c1-4eb5-91e0-1a6c838e5992", "sighting_of_ref": "indicator--85514a4b-125d-45ab-a818-15a445a09d47", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c7d2888-c901-434b-97c1-d6aa51965de2", "sighting_of_ref": "indicator--be2e6558-d4cd-4da8-8a4e-fc71a66c34ea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0017f7a4-f279-4ade-83c2-31ab3c8ea9b2", "sighting_of_ref": "indicator--9b9f8cae-7738-4775-9ad7-a4cb0a80ba24", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ed2946d-d8e1-4332-95f0-8d2a1d92d01c", "sighting_of_ref": "indicator--89e5c806-662a-4e44-be5d-10883d1ff051", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37d43928-3129-49c3-839a-8ddd7b968c80", "sighting_of_ref": "indicator--ef826369-bff3-44ca-96f3-8d16c0aa50a4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8570622-45df-48c8-8cb9-2acf6818cbbc", "sighting_of_ref": "indicator--371e0e56-1287-4981-8462-b08fdee89ec0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35a1b260-66eb-465f-8413-8547ab2b4aaa", "sighting_of_ref": "indicator--55b04b06-2f77-496f-9384-26c966bb10b2", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52989dea-dd3b-4109-be20-79fe89480372", "sighting_of_ref": "indicator--bae5c66d-8740-4e75-a310-ded173971f71", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7e441c6-3cde-4040-ac49-7a96f3b3e66d", "sighting_of_ref": "indicator--dbae5095-68a8-48bc-acb4-526709e4e5c6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd025ba8-7381-4a0c-95f1-3e07411a93a1", "sighting_of_ref": "indicator--c0f8b345-b76a-4b01-812f-f46735f6b56d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b57fda1-21a6-48d6-98fe-884a035cf7d5", "sighting_of_ref": "indicator--2a090531-81b8-40cf-bfb8-8902540bb83a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ad56282-985a-4aca-a4b1-685b0fd41210", "sighting_of_ref": "indicator--a6c4244b-8354-4cbb-902f-b91d85cb1167", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d899dbe-483d-419c-ac59-9d2442cc0b9a", "sighting_of_ref": "indicator--2730b544-3ebf-4102-9fe2-46e85c9f95f8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce0bd490-8409-44bf-b3b9-df1f09438686", "sighting_of_ref": "indicator--7f91f589-4ad7-4fcc-b1ad-8033028a1d51", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebe0d70d-85b8-449a-b7b9-d4b82a4ad835", "sighting_of_ref": "indicator--ca84e477-2698-409d-a857-59c93671e498", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e67d453-61fd-4a51-bd00-be1ce911f084", "sighting_of_ref": "indicator--85a8aa38-e500-4f79-9ec1-4f41aa78e0d7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b19317bd-fd63-4d25-a284-b96f133f4bc1", "sighting_of_ref": "indicator--56752d41-6d5b-426d-a1ca-ffe2450e01b1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0cdef02-b803-408d-9aa5-835a2deaea6f", "sighting_of_ref": "indicator--53cf13b2-0271-42ee-9914-206dbef82670", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08a6b171-40e1-42b6-9f91-071c6baa1946", "sighting_of_ref": "indicator--53cf13b2-0271-42ee-9914-206dbef82670", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0fc2c5a-e760-419b-8dd6-124fa3a55ff6", "sighting_of_ref": "indicator--5811774d-bcbd-4104-92d4-d02a9905b831", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c52c548-3540-4a7b-905f-54b9f13d8a76", "sighting_of_ref": "indicator--5811774d-bcbd-4104-92d4-d02a9905b831", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48acf028-2c0b-4a49-bc4a-e738186cf547", "sighting_of_ref": "indicator--282e8a53-7a9c-41f8-b46a-8aff171c7f82", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a9aaff8-c94c-4058-ae51-4a2078fc6802", "sighting_of_ref": "indicator--d06ca8d4-6d71-4353-b8c6-ed1a0f5650dd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32fee6c4-6079-4af1-8077-a313ef615489", "sighting_of_ref": "indicator--3ad8cfdd-6069-4bb6-a400-c3024a4e3fe6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c22501b2-33da-4caa-8c77-a2afde8cc94b", "sighting_of_ref": "indicator--80c548ba-dfbd-40f2-963a-d7e3640c68c7", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0302d903-a7c5-467d-9f15-2121ccc97144", "sighting_of_ref": "indicator--72339dca-db78-47bc-9ab4-d5cd207eb2db", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ce59528-5041-468f-b492-84a866c22bd7", "sighting_of_ref": "indicator--bc6179a6-6b88-4264-992a-f68f2689a6bc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--817a6fc2-ba67-4666-b65c-960eba660cba", "sighting_of_ref": "indicator--6e3bb636-b0e3-47de-b543-73b81f98856a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9d0c636-2909-4775-b9f8-73596924b309", "sighting_of_ref": "indicator--59c61a1c-6938-45c9-9278-e3971e1fb21f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15c3285a-11fc-4ab2-893e-077d44406f27", "sighting_of_ref": "indicator--59c61a1c-6938-45c9-9278-e3971e1fb21f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1dc2b29-45dd-4caa-a323-9126d832259e", "sighting_of_ref": "indicator--fe49cfbd-8d5c-4176-a2b5-68be61e96df0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5f3bc2e-16e6-4507-afb5-767872eb8db8", "sighting_of_ref": "indicator--0ee68c2c-0fb9-435f-81ee-c500b92c7354", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0d5d939-4a91-45da-9125-e4d26f1e553b", "sighting_of_ref": "indicator--c6d20a0e-82bb-4386-ac61-260c43bdfdaa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c05bc24-8ad3-4e28-a194-2180d624e65d", "sighting_of_ref": "indicator--c6d20a0e-82bb-4386-ac61-260c43bdfdaa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06082b66-37b9-473f-acb9-86b56adec3cc", "sighting_of_ref": "indicator--94a7e8c2-4158-417b-b107-bb341ac9dc09", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b141301-7b63-469e-a621-f662e132af15", "sighting_of_ref": "indicator--94a7e8c2-4158-417b-b107-bb341ac9dc09", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc120677-a231-458b-8335-97b2239ec659", "sighting_of_ref": "indicator--5814bb36-d77d-4f84-8d50-02862407c879", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1db43359-891d-4d8d-8630-c09bf5da12c2", "sighting_of_ref": "indicator--d48c98bd-fd74-4748-b41e-fffefd16064a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28adad9c-58ad-4ae2-9bf3-1ebf9037c41a", "sighting_of_ref": "indicator--42e9e78d-ec63-4ae0-8d50-4ab3740de003", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd07ed07-bf8c-4d80-8436-28491cab57d3", "sighting_of_ref": "indicator--168c1b26-e1de-4a8d-85ca-d84dfdc1a840", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51d57800-1a0f-494d-993e-4c1ff07b2e27", "sighting_of_ref": "indicator--90b60c51-f7a6-4fe4-bbef-0a799fcc4397", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71aecf13-3655-4e63-be37-97568ea45f02", "sighting_of_ref": "indicator--90b60c51-f7a6-4fe4-bbef-0a799fcc4397", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0308c1c4-5ffa-4e22-beeb-fd1c7c8076a3", "sighting_of_ref": "indicator--35d47203-bf7d-48e2-8825-39fabe1176ad", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fe856e0-5c1d-4a71-bfea-c31a1646ed58", "sighting_of_ref": "indicator--f907a3b5-16ae-4e61-bc27-b9413b23e334", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b34cc4d8-2e65-4bc5-9652-7f8b5c8fd98a", "sighting_of_ref": "indicator--8330e99f-0234-4e13-b63b-0646afcb8939", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74076d50-ae66-45e4-943e-d43a28d477fc", "sighting_of_ref": "indicator--822f8a5d-af65-4d19-9d38-d7477db84f89", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78e0999a-cf74-428d-8904-25f19adf7660", "sighting_of_ref": "indicator--2119ffc2-ec26-40b6-abea-7c05a7169612", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42abc175-233d-4c72-906d-2e42d968872e", "sighting_of_ref": "indicator--2119ffc2-ec26-40b6-abea-7c05a7169612", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8228417-230b-45a5-94fd-ceb4079846a8", "sighting_of_ref": "indicator--cea7d869-9b7e-4146-92ca-12b3eb69a043", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05dfec62-c3f3-4279-8819-1e10b258abe3", "sighting_of_ref": "indicator--ef782791-e1eb-46db-9a40-e4a8a6a0573a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b2da771-fe1c-441a-be37-91c368c61ef8", "sighting_of_ref": "indicator--81708565-9608-42ee-8fc1-76a5591ac906", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14b2e60c-dce1-4f45-ba44-204d26293cc8", "sighting_of_ref": "indicator--51be558c-9f38-4357-a809-4e8b0204e00d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a92fbd17-beaa-438f-9a6d-60a9e973f3b4", "sighting_of_ref": "indicator--14cc8582-8a41-4400-8532-6116d308c960", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f6fee16-b1fe-4897-9837-af5eeb0cb296", "sighting_of_ref": "indicator--a2ae7995-2931-45c3-9ef2-4ed11117872a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d44f1b7a-6187-4c38-b201-f8bfce43de70", "sighting_of_ref": "indicator--097e20d6-fdee-457f-8242-fd160317afec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8f22159-2111-4513-9df8-a26dca7ce280", "sighting_of_ref": "indicator--92f3b7e1-05c0-4af5-8e8c-b9b81e8a3cc5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f82b082-3eca-4bcf-a75e-e8b4767f6e3e", "sighting_of_ref": "indicator--5482fe9b-d706-4f5a-9282-3f79f54e788b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c5ed0c3-7c3c-4586-a520-0191db64c421", "sighting_of_ref": "indicator--5482fe9b-d706-4f5a-9282-3f79f54e788b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e67c4762-d04d-4294-95a8-e78a3aa5b1ee", "sighting_of_ref": "indicator--2eed9a58-1c7e-4491-81a2-4402612c5411", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d84f296-85c7-448c-8b83-4eebe79c5b58", "sighting_of_ref": "indicator--05979a5a-353f-4af0-bcf7-99bc222d5f6a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea18c44f-dc0f-4b09-96e6-8444a27ccb55", "sighting_of_ref": "indicator--05979a5a-353f-4af0-bcf7-99bc222d5f6a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a8e61dd-34c2-4fd7-bcb3-70fdf5e77838", "sighting_of_ref": "indicator--b63d7099-b695-4eac-94ac-0ecaacc4b53e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e68058bb-c96a-4005-a7a0-00250df5896d", "sighting_of_ref": "indicator--ef8a88e2-0868-4ce3-892a-3bf9a5ac81ee", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--890bdd10-77e6-4381-9cd7-120c8f1e10b8", "sighting_of_ref": "indicator--15d40b66-bd65-4c2b-a5e4-91845d5a702e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bac8ea2a-ade3-433e-94ee-9f9f3d8f6548", "sighting_of_ref": "indicator--15d40b66-bd65-4c2b-a5e4-91845d5a702e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f58067f-a9c4-4463-a648-1b163f0e4a76", "sighting_of_ref": "indicator--b1ea700f-9d09-4ce0-bacf-34bf98038c52", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9c8d5b4-f56f-4396-aab8-c13360a4477f", "sighting_of_ref": "indicator--b1ea700f-9d09-4ce0-bacf-34bf98038c52", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78b92dff-fee6-44d7-86fb-721d0fc626ab", "sighting_of_ref": "indicator--3f6e7de0-d0e3-41ec-b679-d8492f261ed5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--746e17fa-45b2-4783-9068-ad5e869d4ebe", "sighting_of_ref": "indicator--924df662-5098-4508-8d9a-31f72d2b0e59", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29a1b8c0-9b32-4a2f-bea8-0bf33c663e25", "sighting_of_ref": "indicator--924df662-5098-4508-8d9a-31f72d2b0e59", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8c164d2-6a24-4251-8b9c-0c0b3fe3bb41", "sighting_of_ref": "indicator--3c13c948-cbb8-44ae-8fc3-07e558c3f6f9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4fbd846-f8bf-4ebb-9b3a-cf21eca1f913", "sighting_of_ref": "indicator--ba10b396-0e51-4eeb-a66a-dda2d5cbd25c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f662b1c3-140d-4e01-85b2-c50361e083b7", "sighting_of_ref": "indicator--c472324f-b0d2-4e33-9cdf-9b5da083e575", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3de3f0dd-c815-46c1-ad98-4498db343c1d", "sighting_of_ref": "indicator--c472324f-b0d2-4e33-9cdf-9b5da083e575", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92972c14-02a2-4624-b02d-efac4a69ed0a", "sighting_of_ref": "indicator--19daa64d-1108-4d8f-8c1a-fc8f7be51c0d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a945f383-5e4b-4009-951f-35303d0932f2", "sighting_of_ref": "indicator--66689be6-ad19-4fac-b8c8-bb5278ef0c19", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ef67945-b625-4e0e-8a9a-97c415312632", "sighting_of_ref": "indicator--26b52f89-78a3-4ad1-ae97-82db5477250c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14aadeac-0894-436f-983a-c1ef4d175e77", "sighting_of_ref": "indicator--8868859b-1382-4726-bde7-b1f3ac9c3bad", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--334784e8-4951-4098-9d75-0554c68a417f", "sighting_of_ref": "indicator--7e261195-fff0-4a98-9853-a3c4f8623b8a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2a71d94-a0d6-4673-85f6-da0dd4bcd7e3", "sighting_of_ref": "indicator--1931cd0a-4e40-4ee7-91f0-574687b9cc96", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--472841b6-9031-4dc3-998f-de4fb80b839d", "sighting_of_ref": "indicator--c0fe4caa-8c74-4fe7-bdb2-2cc7f998988a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b66fd932-8d8a-45af-bcaa-2ad75db679cb", "sighting_of_ref": "indicator--c0fe4caa-8c74-4fe7-bdb2-2cc7f998988a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6959a31e-7e98-40f2-b541-bf8417f7c9f5", "sighting_of_ref": "indicator--e96f2b62-bd25-4f49-b86f-567a842abc2e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46092ff8-5016-4348-8662-6c342c229f65", "sighting_of_ref": "indicator--e96f2b62-bd25-4f49-b86f-567a842abc2e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03157eb5-a4ed-4578-a999-7a80ff7f9af2", "sighting_of_ref": "indicator--530c6ad3-24dd-4dc8-906a-8f400eadae3f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--585a431e-5708-472a-a2c2-093de9966552", "sighting_of_ref": "indicator--e0c3f789-b62d-4dbb-8871-a25d21dc0b10", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec60f75e-ec62-484b-b580-d14bb0f35254", "sighting_of_ref": "indicator--a4b4d134-2afa-4fe2-a8ea-1372bcb6dd2e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--295edca0-c81c-4528-a938-c1ca36f14103", "sighting_of_ref": "indicator--02eb1df1-957e-4a60-ad17-7d5ef5897687", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0a570f7-187d-47ea-8c4c-383c9be4555c", "sighting_of_ref": "indicator--c2cd962b-f279-4ab5-948a-a9ab2a5e365b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa81c041-1403-4b68-975e-9ef7aa8c3eaf", "sighting_of_ref": "indicator--1cd008ce-5e4a-4d57-8338-c308983dedbb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d014b93-b130-43d9-af69-a1b662b86ac4", "sighting_of_ref": "indicator--caa3c736-f0d8-476e-9305-016616081380", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba4ed620-f0c5-4bbb-9d08-0edfdf5f5e49", "sighting_of_ref": "indicator--e0318597-4711-4ee6-8e85-e000c5b5b7fa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88dcfa0b-f40b-48f6-92e2-7bd1e79c4057", "sighting_of_ref": "indicator--92695514-e798-4c2b-b5d2-dc87c8742bc5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2191d18-7087-4c6a-bf9c-66c77b7e9f63", "sighting_of_ref": "indicator--2b7cca4d-4c08-4619-a81f-52ede8a9d7e3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c02afc2f-b63a-45aa-854e-48f93feb6246", "sighting_of_ref": "indicator--edac817d-57e3-43df-a64c-134f200bcec3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee2c9fc4-4a39-48b7-99b6-aaa24d64352b", "sighting_of_ref": "indicator--282e5fbb-8bbf-44c6-82da-d9c3ad694cd6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--428cc8bc-61d4-4ea8-8e9a-8cbb763497c3", "sighting_of_ref": "indicator--c679df31-a492-400f-a29f-f4d6fd7715e3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a2645be-ece4-4d24-a519-e0cda59f9e8d", "sighting_of_ref": "indicator--14517e31-d23d-4333-ae63-eb3d6076a0e6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3aff5438-349d-4920-9790-cd789d94f565", "sighting_of_ref": "indicator--d74db98f-635c-4dd3-a17f-b975026965fd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4353c4c4-12e4-4a7c-8adc-bb18e73e92a1", "sighting_of_ref": "indicator--1b738475-2f0f-4e97-9803-abcca88bf843", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c366ca3-fda1-465d-b54b-e7af930d24bd", "sighting_of_ref": "indicator--90014f3e-0838-4fdb-ac26-56347e45eb42", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5565063a-7d98-4c8a-bafc-f39549ca53fa", "sighting_of_ref": "indicator--ebb82183-f941-4b24-a5a5-23d10ae8f477", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfc67086-d84c-499e-87f9-9eec402c5b91", "sighting_of_ref": "indicator--1109e309-2663-4906-aad0-869130f10ee0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc9048ab-e605-4d59-ad24-59788b82fbe0", "sighting_of_ref": "indicator--0cb42a42-3084-4d68-bcdb-b92c37b69fbd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c3e8522-d36b-4276-ba8e-51dae76d0a0e", "sighting_of_ref": "indicator--09ad3e1a-5833-4c9b-bd08-7643da21e5ee", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcd066db-33ba-4e9b-86bb-e5b09e2eec2b", "sighting_of_ref": "indicator--9d6f5c3c-662c-45e9-b4b6-6cc7907ed8a7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9471bec0-d784-4226-bf5d-d26d05a9bd13", "sighting_of_ref": "indicator--7da04362-29e1-4b8a-bac8-afe7f87d3eb3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9157bfd3-36fd-4b91-bdc9-40ac913b229b", "sighting_of_ref": "indicator--e2913811-066a-46ec-bd3f-971d6de863cf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4716aa18-0097-4982-a24f-493bc3e87225", "sighting_of_ref": "indicator--27e8ac53-9759-4bc7-83c3-2c5e95f248ec", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb311d07-38b9-424e-8dea-8c7cdf6a3283", "sighting_of_ref": "indicator--8c0dba3c-f5a6-4127-96a8-c2b4fc1a1091", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81951960-1ac9-4073-a319-cbc12d607a1e", "sighting_of_ref": "indicator--949c7f05-4697-438c-af7c-c18002743bae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd2b12c6-2805-4c91-ad02-e7b56dd6b30b", "sighting_of_ref": "indicator--8c39cab6-3884-4881-b7b0-8a905a4eeaa8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27e933b7-89f4-4288-a5a1-f727e2cd2e7d", "sighting_of_ref": "indicator--d481b7fa-e785-455a-802a-54bcc567db33", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35c5415f-8ee0-47f4-bc51-1e9f335b4057", "sighting_of_ref": "indicator--95e30906-d29e-4a0e-bacf-7f995f7b4c40", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebb073e3-0d06-49af-8534-6b69fa3331d9", "sighting_of_ref": "indicator--1ef2ee1d-462b-49a7-8cb5-e526741da182", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40b37a2b-a28e-4d5a-99fb-3354e154d179", "sighting_of_ref": "indicator--5946a455-21d5-43c2-884b-5277c8fe7de2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3d6d4da-5bdd-42b4-8f4e-ecf1b41fe3f1", "sighting_of_ref": "indicator--f0347ad5-ddba-4e5a-8ea3-08f2c83310f1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5d91053-bd43-46f9-8f07-8725057c4812", "sighting_of_ref": "indicator--e05fc40c-a1b1-4fef-ab24-769cb8767e3c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88a79776-f64e-43c5-a6d8-306aa87542fe", "sighting_of_ref": "indicator--22ae8155-0885-4bee-9e59-18c88af26bd1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--034ae550-d637-416e-a51d-0d7dc356dc66", "sighting_of_ref": "indicator--98c43d8c-7587-4a19-a56f-b0bec5b8fd93", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80e5ade3-864f-4ce9-8c97-99574c14b921", "sighting_of_ref": "indicator--a73c363e-2127-4b28-a5bd-6f2505a14a71", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--457df114-7771-4dd9-913d-c3df1ee6878c", "sighting_of_ref": "indicator--a8b9f0ec-cb0b-4b12-88b1-bfc3002c9b04", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08cf70aa-b19e-4b93-851b-b48200f47d3f", "sighting_of_ref": "indicator--b88754a1-734d-4946-b441-6033f3f762f9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f457f97-7fd6-4378-81e0-db6a3137a5e5", "sighting_of_ref": "indicator--3dee4c57-3263-420f-9574-b53df6ff65d3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a90b4ecc-57e3-4cf6-b9e5-d6b0f2401b31", "sighting_of_ref": "indicator--f8059670-24c9-478d-b06d-11094e3fe150", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f779bb4d-0e9e-456c-a3c0-52694c171cb6", "sighting_of_ref": "indicator--d0c40226-6b54-4f07-9f89-2c3f15d765c0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13ad2605-bfd8-419a-bb84-2e6ddac926f4", "sighting_of_ref": "indicator--ffff65a6-5296-4704-8f8b-c45fae1b060b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac8df27d-75ef-4962-8356-0f39018db5cf", "sighting_of_ref": "indicator--c3cea895-88dc-419d-8275-e051eeda1366", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eade8ecd-d412-4872-a880-0b420899efa5", "sighting_of_ref": "indicator--4b6d2952-64d6-4e90-aa7b-8425dfad623a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff247e4a-502f-4049-a477-7768ae5410d6", "sighting_of_ref": "indicator--c66b398a-a24b-40d4-bf95-85050dbd8cd5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2697818-9add-4b9a-8eb0-b69c46a5f240", "sighting_of_ref": "indicator--f50a1fac-0b87-44a9-8ec8-5eabd5641f6f", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d46c435f-ae5e-4502-b295-0e4c28144575", "sighting_of_ref": "indicator--4ac69c05-9205-4eda-94b1-2f2db33a4da3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30bc2a82-eb76-4793-a4dd-bf79c9f7771e", "sighting_of_ref": "indicator--3da67fb1-3446-4821-9427-0e24766e46fc", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da5d375b-3bac-4804-bf8b-0b5cc1dff6ee", "sighting_of_ref": "indicator--3da67fb1-3446-4821-9427-0e24766e46fc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a94d479e-a75e-48e9-8040-34df683f37cc", "sighting_of_ref": "indicator--1c1828e2-d153-403b-9d3f-ba93457859ca", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86e78d2a-be9a-45e9-a71a-4ac384c1be62", "sighting_of_ref": "indicator--040069ea-f5b2-4d3e-969b-cad0152eca3a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f38d4ec-0a28-40e2-83dc-c787d0eb52cf", "sighting_of_ref": "indicator--8f8cf486-8d56-4587-9916-1fe2991c40ac", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b159c67-d564-443e-8b95-78591040f1a1", "sighting_of_ref": "indicator--4dfea04b-9dcd-432f-94ba-626db7869ef8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d78adf97-1672-4a28-bc1c-4fcf8ca31e4f", "sighting_of_ref": "indicator--afd66128-3925-48da-99c2-2c9e8e7da06f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6ef8476-32c3-4337-985d-5bd6f5b3f6aa", "sighting_of_ref": "indicator--dcf6d496-8f2d-4d4b-9733-19c56c0f5302", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5dc0cb4-1a5f-4ccc-8fc7-9094739b84e7", "sighting_of_ref": "indicator--2b5b6fcd-3944-49b4-9915-24cf84aebabb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb2b4719-b01c-466a-9541-fa22a2ceb189", "sighting_of_ref": "indicator--f2296059-8365-4e76-af85-f83367fa4367", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a3b1bf5-2ef6-485b-8eac-2577f5aac255", "sighting_of_ref": "indicator--70060145-1297-4e30-8881-11008780115c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2238e3cd-e2b2-47af-ad5f-c3e4d53fc3e4", "sighting_of_ref": "indicator--799ffbda-51ad-43a9-9b13-981ef14e4ba1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f876f19e-4c59-46c9-a9cc-b7eb24d5c609", "sighting_of_ref": "indicator--911e1455-4609-42cd-bd3f-acf3d63319df", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20928bab-b0da-4b8e-a57a-2025ea183ea6", "sighting_of_ref": "indicator--91c9b8a8-e246-4e41-833a-5869b339f947", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d20a4526-feb9-4598-89ad-5848a1dae935", "sighting_of_ref": "indicator--54043726-1317-443e-abc5-10b96b30674f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4041d0e-dba0-445d-817c-0cf292a5e2b8", "sighting_of_ref": "indicator--7cc61e11-f39a-47c7-abcb-af570c748353", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c66f8c53-ae12-47cd-9785-a661a072d2c4", "sighting_of_ref": "indicator--88e4947f-8312-413e-8892-54579aff41a9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6643e86f-ff8c-4bf9-a0a3-059ca3b4d071", "sighting_of_ref": "indicator--27ea3cb5-b018-42a8-902e-8cc52a5637aa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cfaf8ba-6b3f-47ad-b853-6bca199f9d56", "sighting_of_ref": "indicator--28ee998e-be65-450e-a4f9-7706455a6197", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff56d786-392a-4a2c-9e18-7c69999dc574", "sighting_of_ref": "indicator--7ec6cf66-6345-4d70-bfc5-5671f4449839", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a218223c-4dc6-459f-bfa3-58e021951baa", "sighting_of_ref": "indicator--ad015269-e3c6-4ee6-8fa8-5dd39507fb7a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c11e03a-fabb-4991-ba23-6492bec075da", "sighting_of_ref": "indicator--88916d39-9374-424f-9f1e-055319a059f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--708ceff5-d340-4f64-b959-3184ba17edd4", "sighting_of_ref": "indicator--2cc9b1c3-815b-4781-ae74-b9c906bcaca6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f01d8ea9-8922-4ec3-bfa5-bd521864c251", "sighting_of_ref": "indicator--4829021d-9efa-496e-a47a-6e2fc0b42087", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1372aa3f-2582-410c-aa34-d0c960576606", "sighting_of_ref": "indicator--eb04189a-3b64-47c5-b412-c173bd86fab3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff544d22-50c7-48e6-b264-9c97fff6b5f5", "sighting_of_ref": "indicator--af79abcc-9e33-4146-ab01-f4523334a92d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b33ca616-0f88-4f82-8de4-34ccb0965aa6", "sighting_of_ref": "indicator--420eb0e4-181a-4699-bab6-7dacd8e19e6a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76bed1db-c718-44ee-a911-6a6b2e1e5021", "sighting_of_ref": "indicator--420eb0e4-181a-4699-bab6-7dacd8e19e6a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e877ffba-4f31-4f6c-85ac-f0ba50236676", "sighting_of_ref": "indicator--3b20e29d-2fd9-4b88-b1aa-98e179979881", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b12b4cc3-7caf-4b5b-b66d-6997b3f866b7", "sighting_of_ref": "indicator--3b20e29d-2fd9-4b88-b1aa-98e179979881", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5308c427-c692-451b-9c4f-cf84dab730c3", "sighting_of_ref": "indicator--bc9ef361-4448-4c1f-ad46-9f6ece1ff10e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d612305-67f1-4e8e-8663-fbf4e04c4f7e", "sighting_of_ref": "indicator--c1f97597-d17d-4259-9498-8416b5c101d6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d1ac3db-c811-4416-b789-5eb70e58f01f", "sighting_of_ref": "indicator--2db4acd0-89dd-480a-83f1-8907ffe41306", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b75b4fc8-9abc-4e41-8b37-5435c0cb2e6b", "sighting_of_ref": "indicator--baba5194-9435-43dd-ae2a-59302886f2e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe7fa447-81d7-4e1f-a0aa-08ee2b45ba90", "sighting_of_ref": "indicator--db823444-5966-4544-8154-c6b25489756c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee3a5cfe-c4a5-4317-8028-091c09e70bd1", "sighting_of_ref": "indicator--a8c12b9a-688b-4733-8bb3-a663cf4ca8c9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c32ddaa-7feb-429f-8375-be683e8e9552", "sighting_of_ref": "indicator--c55b4906-ddbb-4d6f-b484-d408aa50b2b2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9739763-8737-4827-8d0b-86ae3e2432ae", "sighting_of_ref": "indicator--efc14f47-dd2e-4dc5-a999-058fa8bf2b56", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--981a23d9-ebd8-4507-86d2-556810765663", "sighting_of_ref": "indicator--33cdc35d-2157-4ac8-8542-e50c5110522f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd7b0ee6-889e-4a2e-944a-2e9f3e8f9632", "sighting_of_ref": "indicator--0bc19283-5fc5-4ed9-93b5-49140c3ea76f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--801b85f5-d484-4177-8d2c-7aff1078d3c4", "sighting_of_ref": "indicator--11df45f3-55d8-4074-89b2-708f20ebd78f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5db990dc-a357-4e3d-b3c5-4f1fe33e251e", "sighting_of_ref": "indicator--400c139f-c2ce-49f0-8721-28e2d3389de6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e78e736a-2cba-46f0-bf7e-f02da20299dc", "sighting_of_ref": "indicator--400c139f-c2ce-49f0-8721-28e2d3389de6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8736bb30-4d64-42c0-a0ae-3797d3f6aac8", "sighting_of_ref": "indicator--93947275-4dcb-4c07-92cb-2ff83f865299", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3b214d8-7400-4a5b-b588-0b071cb31e89", "sighting_of_ref": "indicator--93947275-4dcb-4c07-92cb-2ff83f865299", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df0f851e-8539-4668-9fc6-01c1ac168d59", "sighting_of_ref": "indicator--c466226f-a2e4-46b6-8ea5-6cf8536beb18", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64878441-a264-4a67-9d0b-ad23ae7dd999", "sighting_of_ref": "indicator--078a2169-de4b-4d27-8f2a-a6694a1c10d6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6179409e-4f8b-4973-8db8-ef522856f706", "sighting_of_ref": "indicator--e5a8ce5d-8c1a-4285-92d5-25c7e3117096", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e9cc04c-9c24-4380-9e75-3a0a2d11168e", "sighting_of_ref": "indicator--e5a8ce5d-8c1a-4285-92d5-25c7e3117096", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9a619b2-8325-4fe6-8efa-d146b13786c9", "sighting_of_ref": "indicator--f7626707-8581-4e03-8c33-1837686b0b59", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--562dc75c-b885-421d-ad76-5c279b6af717", "sighting_of_ref": "indicator--a3b988b4-f8fa-453a-b9bf-96039386672b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d84dc51-a2f9-46e5-a49c-347d019fe6e1", "sighting_of_ref": "indicator--962e83c7-28e6-4d85-bd42-8de7206dfb21", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9cdfa1f-2925-4c81-afdc-579f7b538a43", "sighting_of_ref": "indicator--34445589-d5ce-44d8-8667-0990c1cf6389", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdee6e03-5c32-4a57-bc8a-c3a122dbc471", "sighting_of_ref": "indicator--baeba5de-fb18-40d3-bf44-a74abe9a83cf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0d62518-d799-4bf3-89ae-50f1a5010911", "sighting_of_ref": "indicator--ddaf6281-47cb-47fe-8ea9-bc43134eac9e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c085b350-c168-4c79-b112-57b8f8afea30", "sighting_of_ref": "indicator--292b3aeb-fc0f-487f-83e8-9d866cced8c4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cfba5df-3eee-4fb8-9f75-dc6bb55aa95c", "sighting_of_ref": "indicator--292b3aeb-fc0f-487f-83e8-9d866cced8c4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9210179a-f0b9-4d26-b1ce-2aa92cba9458", "sighting_of_ref": "indicator--3be47d5f-9345-4449-9e06-2490fb80cd22", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87059496-ab17-40d8-96eb-e9d2746a313a", "sighting_of_ref": "indicator--dd093d83-5c69-4a8e-8d67-3183bd22b62d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca4f2a50-d6c6-4737-ac50-b273377e0516", "sighting_of_ref": "indicator--dd9fdf6d-a710-47a5-8628-b993b1b65f58", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdf1dddb-c5ce-4d12-b8c9-87ebdbbaf1a3", "sighting_of_ref": "indicator--c8720b1c-e9a7-41fa-b7da-a5c5f171cc5b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c72fd2c0-e41f-4818-8bd9-b2a97c98925d", "sighting_of_ref": "indicator--d18a80c6-4037-413c-911e-d715773abf5b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1532619c-ac48-4db3-bbeb-7b2369c5c71c", "sighting_of_ref": "indicator--712b5772-f9ef-451e-b126-2916f66ceab0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86605f35-21ad-4a5e-aecd-0ef6a276d149", "sighting_of_ref": "indicator--6b637e38-80aa-4324-bdf8-a18d2ca914a3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60ca11c4-88ff-40f5-9181-d2d18e232c0b", "sighting_of_ref": "indicator--6b637e38-80aa-4324-bdf8-a18d2ca914a3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c427fb47-0c5d-4461-88b8-1ac930b5e5cc", "sighting_of_ref": "indicator--875d1151-bd95-4737-9d1c-7eca72835571", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b0d0530-1320-4f68-abe7-afe37d20733c", "sighting_of_ref": "indicator--fcb9a17d-926d-400f-be93-1d5e01c2a946", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87767861-7cbb-4d81-b8cf-6d25dd0cc289", "sighting_of_ref": "indicator--19e80ed1-8f40-4a8e-9d11-e215decf0da8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c56c482-175f-41a9-abc4-6258656dcd21", "sighting_of_ref": "indicator--5007ebbb-56e9-4ca7-b3b6-6a4402952c7b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42de6270-cda7-4ad6-9b45-d14f2c91ac9b", "sighting_of_ref": "indicator--f1f395af-dee2-4436-9d1e-1c7504f4e1b2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1be55c5-7b3e-475a-a3bc-68e845f9997c", "sighting_of_ref": "indicator--0122c3fb-2309-4fda-b460-0516bc00a3bf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0eb8896d-26f8-483a-ae61-c36e62053197", "sighting_of_ref": "indicator--5048c45f-a9f6-4ed0-8da7-133ef3192294", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edb39807-5c18-4a89-82a3-58cdac670a9c", "sighting_of_ref": "indicator--e3b2c564-635c-4bf0-abe1-f3372c5fa129", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cec2c5ce-269e-41dd-bb28-205ed0bc4d07", "sighting_of_ref": "indicator--e3b2c564-635c-4bf0-abe1-f3372c5fa129", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2ccb028-2a38-4ab3-a12f-7c8a71f8ecbf", "sighting_of_ref": "indicator--d9484a11-f8eb-4d61-b1b8-2280f370c25c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acec3697-7bfe-4ad0-a14c-b4755bad728d", "sighting_of_ref": "indicator--d9484a11-f8eb-4d61-b1b8-2280f370c25c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ca5bb64-6daf-429d-b57f-11d5ac98d676", "sighting_of_ref": "indicator--dfca52d7-c0f0-4367-b318-627df5fc693b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14a6ffaa-0413-4587-9113-0788fa510282", "sighting_of_ref": "indicator--dfca52d7-c0f0-4367-b318-627df5fc693b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92891693-93e8-4ae9-8cb7-6e7249c6e812", "sighting_of_ref": "indicator--40d4a01a-77ef-49a6-b2d1-2f3f94c2348c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30d0a75b-60ba-497f-9c6b-ba9306597b40", "sighting_of_ref": "indicator--43c0c1eb-7272-453b-8363-d2fceec50082", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05b333f9-6d08-4330-abf3-29ec2ae17c34", "sighting_of_ref": "indicator--43c0c1eb-7272-453b-8363-d2fceec50082", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c61ff8a-3894-4c12-96c1-cfdf8c7add9d", "sighting_of_ref": "indicator--673ada47-c154-4424-85ff-7eccf0addddf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05d4937a-b28a-4b08-850e-e86321a42cd8", "sighting_of_ref": "indicator--61b667eb-cd42-4486-b1e7-a7595ff2f711", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--854b4f89-6a74-4d41-b9a0-aeeea27b5767", "sighting_of_ref": "indicator--17f333b1-f11b-4fdc-9020-c565ac72b1c5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8661c0b9-169e-462d-8be5-21e5a2f0b24f", "sighting_of_ref": "indicator--29e36fef-f5c0-46d9-8383-2fbe0eba5ce8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd17e1a7-0f51-4b2b-99c5-a0e99eec30c3", "sighting_of_ref": "indicator--6a8b9f07-7aef-40ba-99ce-ae14b8bcd8e5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e446df6-db75-49db-ae13-d1822ac106f7", "sighting_of_ref": "indicator--6a8b9f07-7aef-40ba-99ce-ae14b8bcd8e5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--494915f6-95e8-4fc8-851b-b6556d5dd2f7", "sighting_of_ref": "indicator--41d9a60f-587b-4f73-8da3-ad9297cd56f1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4377631-27fa-4de1-9791-7b72e217238a", "sighting_of_ref": "indicator--41d9a60f-587b-4f73-8da3-ad9297cd56f1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83983c5f-63ad-4c9a-b71e-072a29e93c1d", "sighting_of_ref": "indicator--4f1024e6-4dd9-432a-af80-6bf558339bca", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45cd5c5b-9e37-46de-9a20-07047d459ba2", "sighting_of_ref": "indicator--99bc783c-69ea-4720-ab0d-417d6bae3fc1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e001d9f-9c05-4b3c-9988-b483daebcca8", "sighting_of_ref": "indicator--c7b5e0ab-3ab0-4b55-96a6-75a002a6f39a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3575d70b-dd5c-45b2-94ae-d39ec11dbd6d", "sighting_of_ref": "indicator--785eabe2-1af7-41f1-ab1f-b3088f1b6972", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34b1dde4-c220-433b-aee8-0d4ea595c83b", "sighting_of_ref": "indicator--785eabe2-1af7-41f1-ab1f-b3088f1b6972", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e451f7b-d6d8-4bb4-8edd-bc4c95360f0f", "sighting_of_ref": "indicator--521bdbdb-5c8e-49d7-a434-1ff9771591a2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e77b81f-3dc8-437e-b65c-6092618da049", "sighting_of_ref": "indicator--6232c151-89e0-41f4-80be-aa182bc5f63a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4aeee2b5-6aaa-4e07-bb42-69fa9c005de1", "sighting_of_ref": "indicator--96fa6178-38e6-474b-8504-23115193c5c0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76f141be-9604-4600-bbfc-9c3e5679b12a", "sighting_of_ref": "indicator--877c2425-f4f6-4874-b985-6fa08bbc37e8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cec7a1f-61c8-4e8e-ac2c-9d0c7d2e693a", "sighting_of_ref": "indicator--2bea6e8a-e58a-4bec-8f6c-2407f92148a7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc6eb98a-f557-449c-9bce-f2d6801e69a2", "sighting_of_ref": "indicator--62cedc43-1d22-4aa8-a300-b5101903c08b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3792f454-1dd7-4613-809f-bbffa7cb9f46", "sighting_of_ref": "indicator--c1dd8fb2-1350-43ab-b0e4-2a0c1289a3e3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--574c8fa1-43f9-4fa5-8919-20f69b4d17b1", "sighting_of_ref": "indicator--89cd56e4-bb98-4118-a1fd-cf757080f964", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6616a8d6-39e0-4e8c-a19d-ac2cf48c355e", "sighting_of_ref": "indicator--89cd56e4-bb98-4118-a1fd-cf757080f964", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbcfad23-b9fb-4a53-95b1-e2c6e5f8c623", "sighting_of_ref": "indicator--7cd0570e-575c-40d9-86f0-cab91564b37e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbfbc298-097f-49c9-a2f9-79f301dff511", "sighting_of_ref": "indicator--7cd0570e-575c-40d9-86f0-cab91564b37e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbb1348d-4967-4b05-a46a-e20ec90f3702", "sighting_of_ref": "indicator--625c3df6-97c7-4933-a94b-01df4d94c397", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ab8821e-bfc0-4afd-98f5-6ff0dc5a9d9c", "sighting_of_ref": "indicator--72d3c4da-fc5a-48e4-98b8-b626712cae1b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76af6d31-70f9-4000-8d06-2b71a9600a4d", "sighting_of_ref": "indicator--72d3c4da-fc5a-48e4-98b8-b626712cae1b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29910313-4341-43ea-8023-15063f8d2d52", "sighting_of_ref": "indicator--ba3d79a4-8e6c-4457-83a0-a15aacf91b57", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff9701bf-6f02-4995-8194-96f29006b315", "sighting_of_ref": "indicator--ba3d79a4-8e6c-4457-83a0-a15aacf91b57", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--992d8f86-68ae-429e-aeab-fdfc39239246", "sighting_of_ref": "indicator--209bdbd6-bc95-412c-895f-21d391ceb490", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e4b98bb-515b-42cd-b9ab-476b2da7ba51", "sighting_of_ref": "indicator--209bdbd6-bc95-412c-895f-21d391ceb490", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cec69f8-5fbd-40f2-aeef-e1476f3aab4d", "sighting_of_ref": "indicator--b49ba6e0-aed2-44b6-a6c6-7024279d7476", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19200433-392a-4882-9d50-77756ccd4812", "sighting_of_ref": "indicator--736c7584-0a64-4850-8bb0-3a5e20c7fa34", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--451a606d-07ee-4cc7-863e-b5f1d768025d", "sighting_of_ref": "indicator--fed3409c-3464-4000-98c7-5f6f48b1473d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a2e6bbe-c7c2-492f-8e30-522862543e85", "sighting_of_ref": "indicator--56971d21-cdb8-43e6-8043-67901d60fa3a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7f6d189-6d69-4510-8cfa-178041644db8", "sighting_of_ref": "indicator--5368f1e2-b78b-4409-8a39-e92ef019a6e2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca76b0cc-090d-4b6f-ae86-bb3c0b6892bd", "sighting_of_ref": "indicator--8473efcb-033f-449d-9be3-bbda346b89fc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f381f1f0-700b-469b-ad2d-8be305def48c", "sighting_of_ref": "indicator--389b231a-5cd0-4cc0-a82f-5878d4dbfa4b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03ea381f-ffd8-4462-a061-ed2b09893126", "sighting_of_ref": "indicator--a13182e7-bef1-4ed3-bb4e-3848887fbda0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c798c81-a7b4-4f6f-b41e-863973f297de", "sighting_of_ref": "indicator--0dcec47c-1d48-49de-8be4-43dd5300d151", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90168637-acfe-42ce-b9d4-94db0d219e0a", "sighting_of_ref": "indicator--46ea9f0c-597f-46a1-aa46-8e39f90a09ff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--965796af-585e-4656-b327-2f3c4b80bdf2", "sighting_of_ref": "indicator--8e1b907f-fea8-404b-bd0c-52fa75e0f386", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c6edc69-3c72-4ba7-a285-90d58b67743c", "sighting_of_ref": "indicator--5df7d0af-6cee-45d5-92a3-fd4a78834ce2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fc9f22b-8613-4913-a8f3-2a2a6ecab396", "sighting_of_ref": "indicator--8a7dec72-5fa1-4696-852e-43846170b8dd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc12e039-6d77-4110-ab39-e1125c2dc65b", "sighting_of_ref": "indicator--8a7dec72-5fa1-4696-852e-43846170b8dd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c65cfa1c-e0dd-4d5e-817e-afb10c2cd2ba", "sighting_of_ref": "indicator--ac17d8a1-68d4-4cb3-9416-7b55ff3dfef5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da0dff4c-7e79-44aa-9ced-2f4b16e4a624", "sighting_of_ref": "indicator--168428c1-7796-4930-baab-b28a8f43b0df", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d3a90a5-f6c2-4e87-acb6-c6caaedb7143", "sighting_of_ref": "indicator--168428c1-7796-4930-baab-b28a8f43b0df", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8764b726-efa1-4f8f-b69e-94add0416b77", "sighting_of_ref": "indicator--33f3bc8e-f3e4-453a-a2f9-230325d0f062", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d356cbde-5fdd-4504-9380-028cc4d48def", "sighting_of_ref": "indicator--3859b636-61ca-4461-bd62-e6cbe61fa47c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7065fd78-edfc-4b68-a99e-76f3b07f38cc", "sighting_of_ref": "indicator--7aaa5ca6-da44-4a2c-a1ee-31a83db61f5c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--738c050c-a972-4a22-bcb1-4053b68fe05f", "sighting_of_ref": "indicator--b7aa7e89-39da-4739-ae86-76f02b9fe9e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dcd5f7e-abfe-43a1-8e68-7fdb087b9a7e", "sighting_of_ref": "indicator--a76f54fc-b491-403f-bbdd-a34209383c70", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dacf10b-4f99-4664-8d71-9550ab608515", "sighting_of_ref": "indicator--2ff6006a-ae7d-4c92-853d-e808c3432127", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7164bbcb-085a-4100-88db-8d1bf58510c7", "sighting_of_ref": "indicator--780a5d09-85ff-488a-8e2c-5c19816bb097", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ea12f25-3dea-4492-990d-ed9cb2b29bf4", "sighting_of_ref": "indicator--9b566de6-ffbc-4718-a208-422e72ccbf54", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--592f16c6-0280-43e0-a042-9b6c9f7527bf", "sighting_of_ref": "indicator--9c9809d4-4874-4e2e-aa68-9882e2381a63", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fffbafef-2224-42dd-a33b-fa316266f2e9", "sighting_of_ref": "indicator--66a493dc-942f-422a-99d3-4b33f6f40394", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b68ac41e-fd1b-4170-8eab-cf2871a7483e", "sighting_of_ref": "indicator--ade55e4b-8d56-4d45-8dd1-9abb5652c4d4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8319c853-e622-4576-a26f-e44af3d0f6fe", "sighting_of_ref": "indicator--820d8f43-56bf-4c57-9122-8b2890b1b434", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--030a7e20-c0a8-4d56-9163-8fdc53795b2b", "sighting_of_ref": "indicator--c0004a49-12e7-4f7a-b589-3e5e5f771c49", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2f4206f-0f23-43d5-8f37-5a41e9af9470", "sighting_of_ref": "indicator--496d6241-ab6e-4946-bd1f-0a7fe9b3a3f7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8707e804-96b4-4b4d-9cc1-7235fedcace7", "sighting_of_ref": "indicator--8139e5de-a306-47c5-9d4c-8d3a63cea2af", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e674cf56-7c5a-49f5-aef7-578e723ac9fc", "sighting_of_ref": "indicator--a3947ed2-3321-4123-8a9c-bfa1c35b1347", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbdb599a-754a-41d7-b194-1e51f6e613ee", "sighting_of_ref": "indicator--e9be5d87-ced0-48e0-b51a-2590a2c944be", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eca019df-f655-4f78-8d1c-4348c09c1074", "sighting_of_ref": "indicator--54d03b6c-6700-47ba-bb45-cf053170fc8b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e03b4405-2e88-424b-a15b-00f649942d67", "sighting_of_ref": "indicator--3348c11a-f61c-4116-9056-ade84942d3ca", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06a1fe50-9f18-4fe4-ab4c-e20038ff6378", "sighting_of_ref": "indicator--dba4395a-ce8b-46f2-9a0d-1f28186b8228", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5d448f9-3279-4121-8ab8-48261b222f66", "sighting_of_ref": "indicator--dba4395a-ce8b-46f2-9a0d-1f28186b8228", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03876dc0-e3a4-4440-ba77-e7c5318ba240", "sighting_of_ref": "indicator--73ab498c-e6b2-4f90-ad66-9948fc499ff1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05c4d8d8-89ff-4a4c-9dba-472874e91c95", "sighting_of_ref": "indicator--73ab498c-e6b2-4f90-ad66-9948fc499ff1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8722bd5-d87e-4aca-a938-358ead80aef2", "sighting_of_ref": "indicator--83a0b3fa-cdcf-4843-85ce-7c33737d702e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6455da70-2dc0-40bb-b2b0-a02e5ddc8225", "sighting_of_ref": "indicator--83a0b3fa-cdcf-4843-85ce-7c33737d702e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04220644-d125-4a12-998f-3a13cb17b4a3", "sighting_of_ref": "indicator--1bd906dd-cedd-4e68-a82a-054501f42a5f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a649c20e-732d-4bb0-8e31-cce74ca1f63d", "sighting_of_ref": "indicator--1bd906dd-cedd-4e68-a82a-054501f42a5f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--788de3b1-a209-45a6-b7d8-3aa5c1dca7e8", "sighting_of_ref": "indicator--2ca99b42-d1e0-4b6b-9f2d-daa6e2ebd851", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db2ae12c-b255-4f14-bf0c-efaf1471ff8a", "sighting_of_ref": "indicator--2ca99b42-d1e0-4b6b-9f2d-daa6e2ebd851", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81183f3c-899a-445a-a269-c5b924cecdf7", "sighting_of_ref": "indicator--6c141356-da4b-475e-91d2-694d3152c8cd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c480a899-dccb-4863-95ec-517a282592ab", "sighting_of_ref": "indicator--6c141356-da4b-475e-91d2-694d3152c8cd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a52878e7-cc7b-42b9-986a-ffd6296bd02b", "sighting_of_ref": "indicator--5692fd4f-9bd9-4670-a9f2-fe70f8754f0f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5d84d1e-781c-4486-81ae-ad344d1a0b31", "sighting_of_ref": "indicator--d2705b22-9e39-45c4-84b5-5f6ba2e0a32c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02ae1d54-930f-4e74-aa1f-9875bb33c060", "sighting_of_ref": "indicator--d2705b22-9e39-45c4-84b5-5f6ba2e0a32c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e20d5ffc-8e94-44b8-b721-d4f40e2dda1b", "sighting_of_ref": "indicator--9bb65cbe-ab73-4299-8dc6-659255634d31", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0b7609c-5a43-4d74-a6eb-25b3613e75ad", "sighting_of_ref": "indicator--9bb65cbe-ab73-4299-8dc6-659255634d31", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7383ed1-6d13-4b94-9b68-3b7772940e87", "sighting_of_ref": "indicator--e7209df2-f921-4a04-8e1b-9404a42506b1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--657e6092-dd09-4633-b6f5-3840771d5953", "sighting_of_ref": "indicator--acc9a955-4924-4866-86d5-29e7e8b0192c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5c44b81-d21a-4124-a48f-458ddfce1b73", "sighting_of_ref": "indicator--a4f31cc8-cfeb-4cad-ba6f-195b3145c944", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1efbf0b1-0a58-429d-a99b-2ed25c395e85", "sighting_of_ref": "indicator--7b2b82c3-a422-4dd2-9c63-076f92275310", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f4e5348-6293-4f84-b0e8-533b3a041087", "sighting_of_ref": "indicator--551a7315-1967-4720-868e-900c03ee933a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48cb6ba2-e907-441d-8b18-0f1220fa47e3", "sighting_of_ref": "indicator--4b0c5367-bd51-4aeb-9d60-93772a0454e5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e8a594f-c703-43f4-8c8c-407478e8e949", "sighting_of_ref": "indicator--8c71024b-7c3f-4281-a455-c6efd8a1df54", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c66e2e0-1e59-4092-8535-2f86afb86f4b", "sighting_of_ref": "indicator--53b5cf5c-bc9a-40bf-9613-fb721a16de53", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfb3ea63-0365-4ece-a694-ba9598ed87a6", "sighting_of_ref": "indicator--afe16a1a-0918-47b1-9cd3-c4c510d8ea65", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cdec8ad-3812-4a64-9dff-dbe6af30374a", "sighting_of_ref": "indicator--c8c9614a-1c5b-4308-a750-54d8d7ac9ad1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33687661-b6a2-44ed-a151-0ed85ab22d48", "sighting_of_ref": "indicator--c8c9614a-1c5b-4308-a750-54d8d7ac9ad1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4508f62-c098-49b8-9e20-94b427a2b7a3", "sighting_of_ref": "indicator--e748c3cf-4ac9-438e-9bf7-7816b83addeb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c8dcb00-f216-4a64-9c91-42db4d2fb894", "sighting_of_ref": "indicator--36c672b6-d99e-471e-91ef-1944ffaa61e4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2b61e25-3635-4c10-8fa1-60085dda3a5d", "sighting_of_ref": "indicator--fa8da125-f9ce-4b05-9fdb-d65627ed04f9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2506ec7-a34e-45b8-b61d-41a8859d3437", "sighting_of_ref": "indicator--94b9c2ea-0e61-4963-a17d-68a8e7e931b7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7834bb6-174c-4caa-b4df-eac4a291f30b", "sighting_of_ref": "indicator--b8c0eba9-589b-4791-b3e9-8229be26e389", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07b3b639-30a2-46c1-94a1-f12f8e96cdf9", "sighting_of_ref": "indicator--b8c0eba9-589b-4791-b3e9-8229be26e389", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abbe66a5-df1a-45a2-96e9-a52d83f39918", "sighting_of_ref": "indicator--d9411f59-7df6-4617-bc2e-95cea5b74cd3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd2b0656-2e97-4616-8b74-9ee5e6f8ea93", "sighting_of_ref": "indicator--16b57535-7cc1-4666-8876-00df62120541", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27d5a70d-2406-41e0-ab75-4bfaf471180f", "sighting_of_ref": "indicator--16b57535-7cc1-4666-8876-00df62120541", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b445a89a-d813-459f-9109-276e367a9edc", "sighting_of_ref": "indicator--fe4556a1-70b3-42d3-8562-7ea2e6ada9ec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2057d82-0c5d-4780-825a-e6908b6f51f9", "sighting_of_ref": "indicator--fe4556a1-70b3-42d3-8562-7ea2e6ada9ec", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--528e1f23-6189-4793-8e7f-8394bdc8bf6d", "sighting_of_ref": "indicator--8a5d09fb-ed29-41a8-99f9-9c95ae922594", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ed75caa-d12e-402f-8133-2456203ff85b", "sighting_of_ref": "indicator--8a5d09fb-ed29-41a8-99f9-9c95ae922594", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ec6016a-ac12-49d7-9aaf-1274d6c7bc01", "sighting_of_ref": "indicator--34826c2e-7fa0-416d-abb4-06fef488605e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--582730f2-f789-42a0-b2a9-c0e00229af28", "sighting_of_ref": "indicator--34826c2e-7fa0-416d-abb4-06fef488605e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5642794-bb88-44aa-9f29-2960c5e16269", "sighting_of_ref": "indicator--ec77a980-def8-45f0-825b-9f57b02ff15c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d30b8dc-71f4-4d04-bd23-8fe3b38f3705", "sighting_of_ref": "indicator--748088c5-8bdb-4e1c-bc9c-8c2d11507dae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad3fa177-0fae-4d2a-9c13-fed4137d626d", "sighting_of_ref": "indicator--748088c5-8bdb-4e1c-bc9c-8c2d11507dae", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be772da1-9998-4374-8de3-ac10d0082924", "sighting_of_ref": "indicator--89ddec98-a0e9-4d1d-9cc6-cb591d97d51d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a75e924-7355-41d0-8e81-f0ad77908de2", "sighting_of_ref": "indicator--89ddec98-a0e9-4d1d-9cc6-cb591d97d51d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6e5b3bd-c32f-4918-9cbc-5971bb11392c", "sighting_of_ref": "indicator--47939b94-bced-48af-b58d-e3e20f95669e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--657bbe5e-252e-46d3-8308-a6b1fb5d9be2", "sighting_of_ref": "indicator--e3276205-ed0c-49d3-9be1-98cf3cd2730a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--479321ca-471c-40ab-8239-03ef4cb4fb1d", "sighting_of_ref": "indicator--e3276205-ed0c-49d3-9be1-98cf3cd2730a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97493b53-3b32-43e0-b243-0e205bda79e9", "sighting_of_ref": "indicator--7f31e550-e67e-4959-a258-67c0d6225572", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1de679fc-13cc-4b33-b6a9-0bff8c8047f9", "sighting_of_ref": "indicator--dfa6f319-7a6d-487c-b044-4f3c6b7ebfd7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47901dc4-6e5c-4bdd-8aaf-29f95ab380ea", "sighting_of_ref": "indicator--a3663c37-1b88-421f-8138-34a512d3bb25", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4b821f9-2f19-41cd-98e1-4bb45446b00b", "sighting_of_ref": "indicator--a3663c37-1b88-421f-8138-34a512d3bb25", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09c6574f-5736-4800-8dfc-1f99fcc823ba", "sighting_of_ref": "indicator--c414e04b-eab7-420e-8e57-1a07386c8fd5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4f19fdd-4c8c-4491-8b2d-16ec244e4c63", "sighting_of_ref": "indicator--c414e04b-eab7-420e-8e57-1a07386c8fd5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0f69ba8-2336-4fb1-ac86-5a0d37fa4dc9", "sighting_of_ref": "indicator--80793286-8da9-4f19-910c-f604500baa8a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67242575-2e79-4bac-bab0-b1d4e9c17e39", "sighting_of_ref": "indicator--8a7ca859-6024-4958-adc3-b6c5eac9a5f5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bea459e2-baa1-460f-9ddb-b303999e0a82", "sighting_of_ref": "indicator--7c984d20-8dc3-41dc-8d01-10452b7fec1e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5644ec62-8691-42db-9780-9f9e6f0d68ff", "sighting_of_ref": "indicator--0fae45c8-980c-4c1b-960f-564156846708", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff5cd2de-bf84-4222-b9c1-a811737b7829", "sighting_of_ref": "indicator--10d9de03-700e-4d1e-bdfa-3bda9b75a6f1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--642148bf-cec4-4413-8a61-168b3dba44f7", "sighting_of_ref": "indicator--10d9de03-700e-4d1e-bdfa-3bda9b75a6f1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0de287b-92b8-48b6-9ff5-b67fdfb84d93", "sighting_of_ref": "indicator--90086d2d-c405-4895-b6af-41ab1c7f4a73", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cf38b16-e1ad-4191-b68a-3d0743f6b241", "sighting_of_ref": "indicator--eaa8f68e-421b-4294-abe1-a13e0eed7b41", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1fa42d2-40c7-4341-abc5-3084717f0757", "sighting_of_ref": "indicator--18182321-f3d6-47b3-a24b-1994eb4a1d75", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99815331-c6b1-40be-a24c-e275fff45abc", "sighting_of_ref": "indicator--48490de1-9ebe-4126-a989-aa9f77f4237c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff7576d7-fe95-4bf8-8a7b-ccd4a90387b4", "sighting_of_ref": "indicator--48490de1-9ebe-4126-a989-aa9f77f4237c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fed9aaa0-7e28-4d29-b334-06b1a38b1627", "sighting_of_ref": "indicator--af5584ef-28ea-4fa9-ba50-c776cc574897", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--860fd45a-4236-4d29-8e02-f77c817a34c6", "sighting_of_ref": "indicator--af5584ef-28ea-4fa9-ba50-c776cc574897", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd1f2561-b66a-41f1-b395-fcf8ad9c93a6", "sighting_of_ref": "indicator--3dc13ed5-290b-4aef-bd69-c380f9b9820d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c5ece18-bc5e-4192-b596-70a3a16c836b", "sighting_of_ref": "indicator--3dc13ed5-290b-4aef-bd69-c380f9b9820d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e61d0159-c373-4355-afc0-0cc9e5e3f200", "sighting_of_ref": "indicator--482ad5df-e425-460c-bc5a-0b69d83ff315", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96f4ffd0-51b0-40f7-9f4c-b15b55f35fc6", "sighting_of_ref": "indicator--6f7f0b3a-51c6-41f7-926d-8a2d727bb477", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--985e79fe-da04-4a4d-8361-344c6fb7432a", "sighting_of_ref": "indicator--6f7f0b3a-51c6-41f7-926d-8a2d727bb477", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71a31911-bf10-45d5-98c5-a7ce11be9822", "sighting_of_ref": "indicator--6dab903b-bbed-409e-a9ef-61b51c1020e2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5c9974c-58c2-40cd-8891-9a099269b83e", "sighting_of_ref": "indicator--f680b09a-e77a-4e6f-afb5-18c2c669cd7f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd0f2a68-221a-4371-826a-bce89686cbdc", "sighting_of_ref": "indicator--a61da758-b59c-4c74-8c02-7d3e08aef9b6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94e295ff-09c9-49b2-aa4e-da0c79499a5f", "sighting_of_ref": "indicator--8485dff1-cffd-462f-a095-6427de039817", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b6e2d4d-5835-4294-928d-aa4b4a2c01ad", "sighting_of_ref": "indicator--a021eb48-7b69-436b-9b93-a7bd8a8a208f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1ea5b56-f26d-433e-8e5a-d51febffee20", "sighting_of_ref": "indicator--a021eb48-7b69-436b-9b93-a7bd8a8a208f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2018373e-7171-435d-a7eb-214bfa105d2e", "sighting_of_ref": "indicator--491ed1c7-313e-4003-a1f5-8c93c21184fa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc415489-40f9-4f5c-8453-08f93ff4c2a7", "sighting_of_ref": "indicator--491ed1c7-313e-4003-a1f5-8c93c21184fa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--add958b1-c0ac-4c03-bf04-9af1cab6eb50", "sighting_of_ref": "indicator--580fc3ef-d1ee-4a40-8884-d0b7a81beb52", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6089dea5-fa68-4a6e-8191-92838b22538b", "sighting_of_ref": "indicator--580fc3ef-d1ee-4a40-8884-d0b7a81beb52", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45cdadf9-62e1-494e-afc4-614ab109ce28", "sighting_of_ref": "indicator--c12b8d8c-274c-4d2a-ae5b-e9b4dbc6c6dc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a0c662f-94b7-4dff-9d36-c3c01a1dd9df", "sighting_of_ref": "indicator--89f90f58-c818-4309-8e5a-56fe46e1d0ce", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6520538e-009d-47a0-83b6-9ad19d7511e8", "sighting_of_ref": "indicator--309a906b-52f2-40fb-82ac-a3b3c0d702e2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ee89919-469b-4d0e-ac93-a8463a935bce", "sighting_of_ref": "indicator--309a906b-52f2-40fb-82ac-a3b3c0d702e2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a5b7b69-b1c0-48cb-97c7-f3e0726cc6b0", "sighting_of_ref": "indicator--28f7e181-24a5-4d0e-86dd-fd539551135f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e70b1dd-fac6-4adb-b9cd-d447eb3f9145", "sighting_of_ref": "indicator--10e41ad1-ba1b-4478-85cb-5e14b531a279", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3f17d3e-4aad-4480-af62-cd048b89478a", "sighting_of_ref": "indicator--10e41ad1-ba1b-4478-85cb-5e14b531a279", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36a8473a-2e6a-45df-8b88-02fea880f506", "sighting_of_ref": "indicator--d1d2af77-e37f-4418-9c53-82cfdd35eb0d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77dd6e58-13b3-4143-adcb-8a266d78151c", "sighting_of_ref": "indicator--d1d2af77-e37f-4418-9c53-82cfdd35eb0d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3416547-7708-457a-98dd-0a3b6e6c3da3", "sighting_of_ref": "indicator--225625d2-3011-4902-a6da-3c93d57d84b5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e47ca46a-2bef-4a8d-94b8-706726ca613d", "sighting_of_ref": "indicator--225625d2-3011-4902-a6da-3c93d57d84b5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21dc0541-a12a-4c03-a981-ee0b84a98d98", "sighting_of_ref": "indicator--c401b5a6-0414-430d-b0ee-ac3ee8310c32", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc161cc4-f8b7-45ca-82d6-47fd52ee6f00", "sighting_of_ref": "indicator--c401b5a6-0414-430d-b0ee-ac3ee8310c32", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69611a07-b091-4dd2-9a78-d61587ac9442", "sighting_of_ref": "indicator--407bcdfa-4df2-4854-bd72-3350ba4c52dc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e06d37e-1b5c-4fae-ab1f-995f969d07e0", "sighting_of_ref": "indicator--05ab759e-a829-4d0f-a4fa-98b65181c0b2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebc42ae6-d1ac-4615-88d0-e0cb531e4ede", "sighting_of_ref": "indicator--97d2cfa3-a661-413d-b126-a521279ef9b8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6c5862e-b98f-4a8b-98d9-97700571326e", "sighting_of_ref": "indicator--2359edd7-8509-47fe-a0a8-db35a4c34710", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c66322a3-f064-4860-99b5-ed649674770a", "sighting_of_ref": "indicator--064ad19c-12b7-4029-a253-35d813cc097e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0383de80-ee57-4442-a098-16a81acddf52", "sighting_of_ref": "indicator--9d72437a-4858-42d3-a2bb-e938ec688f72", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a020f43-b576-4a9d-8f4c-3c97a7130c38", "sighting_of_ref": "indicator--9d72437a-4858-42d3-a2bb-e938ec688f72", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ff3a551-ad86-43af-aada-915e5c0edded", "sighting_of_ref": "indicator--1d920d2a-f93a-4ef3-a57b-800227104638", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--455104ec-6379-46c0-a1f6-3528468773cc", "sighting_of_ref": "indicator--789ef89b-8cc7-4bbf-b8c1-bc16a4a844ab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a767a1a8-e63c-448b-8b2c-145128e8bbb2", "sighting_of_ref": "indicator--789ef89b-8cc7-4bbf-b8c1-bc16a4a844ab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aca594f3-d040-4dcd-83a3-7bd4a179c667", "sighting_of_ref": "indicator--6fb7c557-ae97-4f9f-9776-727afb524001", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c451628a-0243-42cf-92eb-5809be8ee97c", "sighting_of_ref": "indicator--6fb7c557-ae97-4f9f-9776-727afb524001", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--544f8304-3469-4546-831d-e3a6ea234c67", "sighting_of_ref": "indicator--d6d4b43d-a8e1-4abb-97cd-88a6db780faa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8127e63d-37e0-4476-b394-95a53064e172", "sighting_of_ref": "indicator--d6d4b43d-a8e1-4abb-97cd-88a6db780faa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12911bdb-7f2f-4bd7-94b3-d13e01475585", "sighting_of_ref": "indicator--b6c025c7-7696-4171-abc2-3e297fee48db", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c80a751-002a-406b-8286-34ff391f61cb", "sighting_of_ref": "indicator--b6c025c7-7696-4171-abc2-3e297fee48db", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d56167e-a758-498e-91c7-6872a483a203", "sighting_of_ref": "indicator--9bdf8476-b469-45e5-8cbd-bf448187aa15", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6c69c6b-506c-4782-84d8-0e71c60d6239", "sighting_of_ref": "indicator--db2d76f9-1882-4a19-aa62-198cd647a754", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6a7ddfa-06a9-44e4-94f6-0d2b7144652b", "sighting_of_ref": "indicator--75bb0e25-737a-4be7-9206-eefd5dcd5a9f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dfe5a46-2e07-40e6-abb0-8d94eae92684", "sighting_of_ref": "indicator--7032b772-dd33-437c-aa90-c9f6ec1f6cce", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ec239e2-8e0b-4242-871d-e431d6e201d1", "sighting_of_ref": "indicator--7032b772-dd33-437c-aa90-c9f6ec1f6cce", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81ee20b2-e80d-46c0-82fa-4093f8fd2927", "sighting_of_ref": "indicator--942d0a6f-a306-4ee3-a9fb-1668ce2aa166", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4217cec-a88b-4d95-a8a8-3556d4180432", "sighting_of_ref": "indicator--942d0a6f-a306-4ee3-a9fb-1668ce2aa166", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4340e8dc-34f1-4045-b338-45c3456ebbe6", "sighting_of_ref": "indicator--25be9273-4968-4cc1-9fcf-73e643d40b96", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6849572-f10d-49a6-a516-d0a2fec635e4", "sighting_of_ref": "indicator--25be9273-4968-4cc1-9fcf-73e643d40b96", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--167ef911-cc00-44d9-9183-59cac2a3c5af", "sighting_of_ref": "indicator--66f84d14-4786-48b6-a31a-45af770524c0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47ef5533-2452-4f38-aeb4-4e306576454d", "sighting_of_ref": "indicator--14236f47-66d6-4480-9556-234e57ab48f5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72a68e02-8ff7-4873-b4d1-0d5b92ad24aa", "sighting_of_ref": "indicator--c41abcbd-287c-455b-9486-271697663008", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce8bcf9d-f136-424c-bb42-00f885262a13", "sighting_of_ref": "indicator--db702473-b9ee-4133-bebc-19b1ed15e99d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bb3fc76-74d8-4241-82c2-ed475e896f15", "sighting_of_ref": "indicator--8438a265-e521-4cc8-a1d8-8f85fd765c62", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6f6f0df-709b-4a5e-b906-59a333c25b96", "sighting_of_ref": "indicator--82b1393a-c58d-454f-90de-e2be19077f94", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--056929fb-1648-4601-a69b-3bbb92b1e7a6", "sighting_of_ref": "indicator--59ae8b50-c57f-433c-907b-cefd924fac3c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5774a4ee-9b60-486c-b4ec-f0b711e985ec", "sighting_of_ref": "indicator--a78e0646-b032-4c98-ba3d-0e61b2c7e932", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12ca411e-abad-4fb4-abe8-2ee72dbf61f4", "sighting_of_ref": "indicator--77398b6a-6917-4df3-823d-02a143a58e7b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2999c9ca-7ed9-4b4f-bfef-5a772ebb040d", "sighting_of_ref": "indicator--1481c7f6-6c1d-4cc7-9d47-7d5b49ac434b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64d431cb-fdea-4183-a28b-4ccd6a0b9239", "sighting_of_ref": "indicator--483fb61f-6727-42c4-98c5-51ae7955437f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5de6a22c-19a1-4951-8b4d-af5649239a8f", "sighting_of_ref": "indicator--00af43e2-2861-41d1-a3a8-e6bb6f1cba58", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ca1c1b3-351c-4dc7-9d5e-5e851b45c3e5", "sighting_of_ref": "indicator--1af346e2-b0ab-44be-b426-109f06ecfca8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c950375-c98a-4043-99e2-5441bf9eeff3", "sighting_of_ref": "indicator--6590d8c6-4c1e-4f43-bd9f-b5ce408d6b15", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--407f4a1f-3f67-4fb5-947d-a52978296f1e", "sighting_of_ref": "indicator--9d80569a-16c6-42a7-9ae9-672ff6bbc86f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9e0672a-cdbf-439f-a00d-7987598d4f38", "sighting_of_ref": "indicator--d6d608f4-4634-4f33-80a9-50aac9a9bccf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a882dc9-bc52-40f3-b256-cf5c1dce885a", "sighting_of_ref": "indicator--6d2c33ce-1c71-4aff-bee6-8821eb4d4e3f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--701ce4a9-25f6-4c98-821c-e30f0a345749", "sighting_of_ref": "indicator--76deb6ad-7713-4341-b736-ba67914079e1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8ebc156-e23b-47e7-9ff7-d12b2cd50956", "sighting_of_ref": "indicator--31474467-7575-427e-a49a-1617fc16d6bd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--460dd4b6-55b9-4f08-8c3b-6d0a23a921d2", "sighting_of_ref": "indicator--d756aaa8-610d-4e2b-b8ac-8b365a7c8ac0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c8d0410-a801-430f-a294-db637ac093b7", "sighting_of_ref": "indicator--0153f05a-4813-489b-8f63-63f1f0f53419", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0af419fc-ac96-450e-8914-c44500f5496f", "sighting_of_ref": "indicator--aa1150ba-f223-4d84-830f-7925018accab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12c22b3b-4adb-4f7f-ab1c-d9d99d309bf6", "sighting_of_ref": "indicator--93e17408-ea9b-45d9-b4e4-955c4a95806f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20ef05f2-d0c8-412b-a398-5d54b85a7d6b", "sighting_of_ref": "indicator--e89fc2be-583c-4338-a0f7-f77c2f71559e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea76ddd8-cc1c-47e6-8e43-6adf847c226f", "sighting_of_ref": "indicator--3ddfd618-907e-4c54-b56b-b470564b8ee0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae3a637c-5353-48cf-84af-db1aa07d29dc", "sighting_of_ref": "indicator--00d9b80b-3b59-4b38-aca8-c4355ea9014a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--645257e6-5906-40c5-9ca3-b3b872ff09f2", "sighting_of_ref": "indicator--7f44e2ab-b572-4710-a05e-170bf5de317d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93fa8de2-1ea8-4913-b67d-2d8147d1b40e", "sighting_of_ref": "indicator--422ed697-fdbf-4747-9746-26109fb587bc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2814746-fd40-4ccc-9636-362d9915a726", "sighting_of_ref": "indicator--422ed697-fdbf-4747-9746-26109fb587bc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37e2e14a-7529-4a56-b30a-63e83787b1cf", "sighting_of_ref": "indicator--d30de378-f592-445a-a250-07d6fddec1a1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5492fda9-5dbb-45fc-9aba-f47396ec5855", "sighting_of_ref": "indicator--138bd8c2-2267-486c-9719-a99df5cd0758", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3929a06f-81af-48d9-8ea6-a53f29bea99e", "sighting_of_ref": "indicator--ffda48cd-9a3a-421c-9c7c-2b0e3998e616", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e080d140-88f2-431c-8a26-4bc7f1516232", "sighting_of_ref": "indicator--ffda48cd-9a3a-421c-9c7c-2b0e3998e616", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28591566-8f5b-4fa0-862e-b7a94e2d6a69", "sighting_of_ref": "indicator--b0b2f9b3-be17-4573-a99b-65d1d1700374", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86c34ab7-4fc3-4c32-9f4f-c40e0881e4d4", "sighting_of_ref": "indicator--beb00c16-9cd7-46e9-bc23-f9697e008381", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a3c91a6-d225-4c9a-9173-1588c1d2c9a3", "sighting_of_ref": "indicator--7a033ebc-1f37-4818-8d2b-d19ab0daddd3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67332028-6e66-48d4-8bd7-15e18b883c66", "sighting_of_ref": "indicator--7a033ebc-1f37-4818-8d2b-d19ab0daddd3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3e49f07-941e-469d-a169-adee0f1f75b0", "sighting_of_ref": "indicator--09191da5-1266-45f1-b2c1-2e45ff089abe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5d5464b-4e6f-4dae-bbd2-499a62160585", "sighting_of_ref": "indicator--09191da5-1266-45f1-b2c1-2e45ff089abe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4fdf866-25b6-49ae-bfcb-3633cda0086d", "sighting_of_ref": "indicator--d856dca3-caa0-4bcd-abfc-62a74a84194b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97f8a2b6-3305-4acd-a959-ac811465aae5", "sighting_of_ref": "indicator--d856dca3-caa0-4bcd-abfc-62a74a84194b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfcb0f5d-3640-41e8-b73e-26dc73d3d388", "sighting_of_ref": "indicator--738eb2f0-d140-4000-af75-27b6b5a364d8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33b5b11d-c950-40d9-a9ad-d982a8f658e2", "sighting_of_ref": "indicator--63201a26-ee46-435a-98d5-d560d66087d3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b099dea4-1b59-4c82-8aa3-8de73cf80a71", "sighting_of_ref": "indicator--882cdf3e-0abe-4ae2-801f-14272b5228af", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05e96f78-3bd1-4c52-a9b2-130e5727390d", "sighting_of_ref": "indicator--4ae81507-8606-45a3-8aaf-c3710efd8b11", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e028275-95c8-4a8c-81cc-f524f788184d", "sighting_of_ref": "indicator--2840c69f-180d-4771-afbd-fca814885799", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c796ed8-c0be-4513-b252-34461d0d17c0", "sighting_of_ref": "indicator--b91b1327-94d7-4b83-aa51-1336bc4b3efd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1a1149b-f5f4-44ae-adc4-b984022dd9ce", "sighting_of_ref": "indicator--ca4b227e-9fd3-44ff-9533-f6a9578881ef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bf121bd-a238-4720-b266-dae4e60da9ea", "sighting_of_ref": "indicator--494ecf78-bed2-4668-88cc-38cae347d41e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b909ec1b-8e9e-4eb1-8f95-51c9c2420f66", "sighting_of_ref": "indicator--5cec3175-efe1-4487-bbde-f5a96434f3ca", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa083df5-3823-4a5a-9344-8288a832f0b2", "sighting_of_ref": "indicator--a98878e4-6409-4b14-ad10-9d5a19054bf8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5eef65af-ef6f-4876-8a88-2a84a6781c22", "sighting_of_ref": "indicator--7b5cafbc-594c-4961-9037-e729a9c02fa8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--405b6050-3805-435d-bdf9-e783802a0c16", "sighting_of_ref": "indicator--1f00d57b-1738-4ed6-be16-35d4894b9765", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2ed14d7-df1c-4353-8397-7961e13dcd09", "sighting_of_ref": "indicator--5d0a457d-f2ee-4b42-a1d9-8112b4f34b08", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28853bd9-db69-41e4-8c1b-7f4c9c3215fb", "sighting_of_ref": "indicator--3fa4455d-032d-4005-99a7-8b6dcb1aae17", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cf554f4-2351-4d03-bff7-501518a29950", "sighting_of_ref": "indicator--af65ac99-490c-4f82-943c-9fc4ef698a77", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3252cb5f-c72d-4c8a-9e14-a9f42a42f95b", "sighting_of_ref": "indicator--85c8bced-2f10-4b3b-a634-003937d78323", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--411d7a14-e663-4927-b3d7-b46be7948c07", "sighting_of_ref": "indicator--4615906b-6ad5-4ff7-a80d-c415f595debe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b974842-cd46-4648-8719-8604b7a9a465", "sighting_of_ref": "indicator--537e987f-77bf-4904-a9cd-c902534cbdd7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46ec33f9-c89e-42d3-b22f-e361f92c1fba", "sighting_of_ref": "indicator--aa1457d3-9ea0-4f16-9ae9-7921b9411368", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d74f7929-99c8-49e6-8ec0-47b34fb819f9", "sighting_of_ref": "indicator--f038feba-746a-4231-b61e-5e607566925e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--067b617f-57d4-4965-a430-24e3b4cd7aec", "sighting_of_ref": "indicator--9d8b6132-2f6b-4c83-913e-b7810a693d02", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c085995-7751-409f-85bf-9fbb69abe98e", "sighting_of_ref": "indicator--9d8b6132-2f6b-4c83-913e-b7810a693d02", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06a26fb8-98bd-479f-985e-1e0f0ad44608", "sighting_of_ref": "indicator--36aba620-0342-4843-a29b-335223af910c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0496c178-a6ea-435b-85e7-edeb84584ef8", "sighting_of_ref": "indicator--48093d2a-bf19-42f6-b5ae-3c9a0d056e62", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddb3c8cf-5d2f-4286-887b-70066f61df8c", "sighting_of_ref": "indicator--2f1f9c65-d4dc-4942-b3c0-ed7b3af0a247", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f894e011-be6c-46fc-a342-360aa0dc6dc7", "sighting_of_ref": "indicator--2f1f9c65-d4dc-4942-b3c0-ed7b3af0a247", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83adac75-7f33-40b6-a174-bdcd2de768ba", "sighting_of_ref": "indicator--257993a9-992a-478e-8c8e-d6f8e0e44183", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ad29e41-665b-4e48-a116-c3274c47f596", "sighting_of_ref": "indicator--e84e87a2-2d16-4ae0-8e2c-36c1c7fcb178", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--417d074d-3ed4-466c-9289-b42768265ceb", "sighting_of_ref": "indicator--516b291f-36b6-4d70-93c4-05567f57f2c7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9870265d-7d0b-4b9a-b70e-8f583bb43280", "sighting_of_ref": "indicator--e029283b-1f2c-4d2c-9646-8b8c9b57eac8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b71beb50-ee2e-49d8-82db-07b8b11dd747", "sighting_of_ref": "indicator--9ecb4b21-1f29-4227-a88a-96d491b16468", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e54a3020-bcc1-42c2-971d-bf97ecd25a34", "sighting_of_ref": "indicator--1dec82d6-27a8-4b84-b828-e51c771aa6ee", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34b5f8d8-ff73-4e3d-8983-dbbb6a07e690", "sighting_of_ref": "indicator--7b49eded-b716-41a8-991f-90762492e509", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0c33e67-d773-4289-b481-903b8c24d829", "sighting_of_ref": "indicator--13512c04-ccfa-42fa-bf09-f240eb761dad", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01219138-e4b7-4ddc-ac6e-e37f5c0221c5", "sighting_of_ref": "indicator--1fabb9b1-858d-4af4-ae5d-3cc0f81129b4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb969064-f6fb-4860-8298-9cabc9b6c4c6", "sighting_of_ref": "indicator--9db0f33c-7416-48c3-ac98-4315150b32cd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c433c460-9bd3-424e-b167-b953c21b8209", "sighting_of_ref": "indicator--f5176777-5afa-4e26-a99a-33a60f850b3f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4920357a-678e-408d-8d5e-e3f57af2fcf7", "sighting_of_ref": "indicator--4fb59fc6-dc88-40e4-8098-3689c2bf6a40", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95324bf0-fa76-45e4-9aa5-a192d98a7f02", "sighting_of_ref": "indicator--e9257c1c-8475-4bf4-9b42-02ec18d4d4b9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11367e5a-645b-4235-8f77-949d18a7eac5", "sighting_of_ref": "indicator--065923c6-a02c-42ba-b6ce-3c562b46706e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3be8b9d5-5346-4aa0-bdcb-4fe7878c700f", "sighting_of_ref": "indicator--6234cc56-3a3c-4d04-95a9-41afd013654c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--343e090f-51ec-4e27-9e63-bf5c51b7ea8f", "sighting_of_ref": "indicator--fb362a15-717e-4d21-a519-d175b74eaf47", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8cff59e-7791-4313-b138-c78ce41aa402", "sighting_of_ref": "indicator--edeb17b4-010c-4a84-ad3e-250b5a01b7ce", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ec96fa7-93b3-4cd4-9832-7f7a833c866d", "sighting_of_ref": "indicator--5deadf70-62c5-4af2-bbfa-ba73a4599e8e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a811df6-a59e-47d7-8d06-f4cb73ea3048", "sighting_of_ref": "indicator--e68ed0ab-dbd9-42e6-9eff-b107ac9ae932", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80b50597-823c-4fba-bb3d-b8e5f9117892", "sighting_of_ref": "indicator--866f9544-9334-4f81-966f-3093198447a9", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5fd96ea-ff55-4838-910f-211687ec2c10", "sighting_of_ref": "indicator--2fa5ff54-85bb-4c1d-ad3f-ae55d7c2707b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10c53906-3c4d-4525-abc2-2169588654d8", "sighting_of_ref": "indicator--2fa5ff54-85bb-4c1d-ad3f-ae55d7c2707b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--712ed939-fc85-40ad-971e-f860e7f12cc8", "sighting_of_ref": "indicator--0d7f9695-424f-4002-9909-eacfe4a5b3ee", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57b04d67-c29f-4eaf-8cef-2859f1f0e6a1", "sighting_of_ref": "indicator--52d77063-b4c6-4e17-b6c4-5b9bc6c1bde5", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--366546c5-96cf-47e7-9eb2-a9a0ecb76401", "sighting_of_ref": "indicator--5a7dc600-0380-4664-a0a6-113bd6654731", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3736823a-ffd1-424a-a620-77a8c94ebbc8", "sighting_of_ref": "indicator--f9737666-cfe1-47b4-a472-d6e2b927ac2f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--568c6bb2-8016-48c0-aeac-512c53580dee", "sighting_of_ref": "indicator--54d03edc-99fb-4730-afa3-526af475d69b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6361a6a4-c420-4b3a-aa87-59d55aa91ac5", "sighting_of_ref": "indicator--7c14f7ec-508a-43b9-a080-d70f4f771517", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3175988-c28d-481a-9735-1b285449bb57", "sighting_of_ref": "indicator--672825fe-5bf7-41f1-98f7-6fc503512b1f", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbbbe15f-e26a-45df-be9e-7913125bf090", "sighting_of_ref": "indicator--7dc834d8-4e2a-47c3-a6ef-bf901f634873", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81f27261-b1eb-46e0-9cb6-e3e9899566ab", "sighting_of_ref": "indicator--99c99a01-af45-49cd-bf9f-6c8cda112cd8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--183ca026-4fea-4a83-a4f3-52822b55b4d6", "sighting_of_ref": "indicator--50a2aeab-e66d-409f-8a42-1eb10b718dd4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b22c60c1-df11-47d3-8d11-8db1698354e3", "sighting_of_ref": "indicator--81bab201-8c5b-4338-aa2c-d9cbde3888ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba930ed3-04c5-460e-8c51-97d381c40d8e", "sighting_of_ref": "indicator--81bab201-8c5b-4338-aa2c-d9cbde3888ed", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4989042b-4538-4660-b12a-e76d9894f59c", "sighting_of_ref": "indicator--4d6740da-cdbd-4103-b0ea-7f6084d29082", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--991e1da9-8192-4caa-b1e1-b90c08b82290", "sighting_of_ref": "indicator--39aa7187-fba1-45fd-b776-5b8919bb322d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cccecfe7-f5bf-4c28-86c4-9b107fc9952a", "sighting_of_ref": "indicator--2c7e121f-7f6b-49a9-a070-33bc2e25921d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--182a92d6-ab17-4220-8164-6946331cb940", "sighting_of_ref": "indicator--1eb73175-8a75-463d-ac82-318e153ddab7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff1a8867-ad11-43ef-b4bd-f1f3e352abb2", "sighting_of_ref": "indicator--2394d2ee-6b83-4025-94e6-d9bdb06eeed6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22b3d0ea-48e0-47eb-8f5b-3fe022bd4128", "sighting_of_ref": "indicator--bfd65fb7-90bc-4876-be25-13875a4b2edf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0a0f7b4-55be-4caa-a40a-a03a64a6fa60", "sighting_of_ref": "indicator--4eeb22d1-9732-4d08-804d-4bdf740d3574", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16392ddf-c75f-4cd8-9729-664e62544973", "sighting_of_ref": "indicator--36c4b76c-6c44-4765-a7f0-6f0559501cd3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cdffa89-aac0-44a6-b886-6ef07a0ceee9", "sighting_of_ref": "indicator--e2e000df-d497-4d95-8491-0e23f60c1e40", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b5c7831-af41-4228-8e9a-cbfeadecd8b9", "sighting_of_ref": "indicator--e1142226-a193-4d16-9518-b711ead327ef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09796b01-a638-4c4b-9f80-3494555db1e7", "sighting_of_ref": "indicator--ec9e99d9-6a36-48f4-bab0-b3ecd03bacdd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b40d819-773b-4195-b146-c997b275aeb6", "sighting_of_ref": "indicator--9a98726a-931b-4faf-b002-c16d0103fbb1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9ee1906-3fcd-4f4c-871e-a319b7966da8", "sighting_of_ref": "indicator--a30075d3-9bd6-4542-86f3-f2c362d76b8a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcb8e04a-2d46-4425-a1b8-3d64a25ee0fd", "sighting_of_ref": "indicator--078bdd1f-8edb-4317-9c62-8f6fe01d566b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93072375-4d95-48da-b578-0e983eac061f", "sighting_of_ref": "indicator--9a7e354c-f875-4c9c-ac15-c95f90aa303d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40bc84de-9768-47fa-9974-a17acf57451d", "sighting_of_ref": "indicator--d20f29c0-534e-45ef-a8dc-635a55673e71", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--460f76f0-29ff-4c07-8bbf-71ceb2d1703b", "sighting_of_ref": "indicator--0331a2a4-17cf-4741-a1b2-cdf59495657e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1fb16e0-0b20-4ebc-bcc1-9db28f686f5b", "sighting_of_ref": "indicator--277c9a1e-6aa8-4d8c-8fa7-8f7b2b0d9b4f", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94ed27d0-4c25-4a94-9cf5-10f1fd7ca3b4", "sighting_of_ref": "indicator--5fe2af4b-6867-4886-b17c-621d08a3acea", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26e98793-a9c2-4c5f-ae23-ac51bb713b3a", "sighting_of_ref": "indicator--aab5906b-01d6-4b65-9dbc-57f02875b3c1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--058002b2-fcd2-4403-bf71-4505eec5b6e2", "sighting_of_ref": "indicator--6386fc75-a54c-448d-a84a-b12a9bfedd13", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eebfdf2-1bae-422f-b26a-9832f008344b", "sighting_of_ref": "indicator--6386fc75-a54c-448d-a84a-b12a9bfedd13", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24f1f5a3-3448-49d5-b8c9-15a6febfb97d", "sighting_of_ref": "indicator--848d0e3c-ac8b-4c8a-bb96-5e4cc6804b47", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88dbb4fc-a5d3-4065-a2fc-5b1ee7c94006", "sighting_of_ref": "indicator--671fa09f-d200-407d-b60b-4eea1d0d750d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec946f69-9c40-44cf-84bc-ddb1d0c8c97d", "sighting_of_ref": "indicator--024268cb-2d51-4f69-bd8a-99ece13de4e6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d775167b-1779-4a4d-9fbb-ae5e20158cfa", "sighting_of_ref": "indicator--80c2d657-90b9-4d56-a836-3834ede1fa8d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--548df24c-9328-4a88-bb54-9b051fee340c", "sighting_of_ref": "indicator--e6ae847a-9702-46f0-9c15-d5616d966ee1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6f421f5-83d9-4a6c-84a9-2a929064f14c", "sighting_of_ref": "indicator--8baa313d-cfb1-48d1-913b-2fbb429d7680", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17552960-6450-43c3-a80b-970dfa6beaaf", "sighting_of_ref": "indicator--f16f4937-fc66-4904-ae54-0405cd330535", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87b4be6f-c100-45ac-9a5e-3643c9b76d13", "sighting_of_ref": "indicator--b2b4f8e5-b958-42dc-ac6c-48ca3489cf25", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b28cafb8-a78e-4338-93a3-46b438d45a05", "sighting_of_ref": "indicator--229649e9-0ad4-4480-81e5-839b41af92bb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2197693b-0656-41c1-9494-7066b33ee57c", "sighting_of_ref": "indicator--a18078ee-8d1d-4176-be3e-7e8d65b9ec06", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34d3d848-1b75-4977-9312-4a91bb1e5dc8", "sighting_of_ref": "indicator--a18078ee-8d1d-4176-be3e-7e8d65b9ec06", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5aa08a54-8789-4b03-9081-de56d2f6aae5", "sighting_of_ref": "indicator--cdeadea2-fbc1-4c95-82d1-0379e1775dce", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6446964f-ba9a-4598-bb72-b67698acf700", "sighting_of_ref": "indicator--07dbd28b-2beb-4649-9635-b21facebde9d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--975791cc-d7db-43ac-8823-2f40cfd686ad", "sighting_of_ref": "indicator--ba49602b-3c13-44c2-937b-4496efed29a1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11ad8514-af52-4eb8-84a0-0bfe643527b0", "sighting_of_ref": "indicator--ba49602b-3c13-44c2-937b-4496efed29a1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5ce5e73-8f70-4447-b1e0-b3c4e0a0f6dd", "sighting_of_ref": "indicator--df8ea776-7a04-4924-b7d9-3cf9f379e818", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a0de617-20a8-475f-889b-ba806f56776a", "sighting_of_ref": "indicator--48dd22f1-1488-4675-bc8a-62f4eecd0227", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b487e39-47e8-4d5c-a3a3-93d26be235cc", "sighting_of_ref": "indicator--b59d0558-9389-4d0d-91d5-e8e002baed74", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6952ce9-6e80-46b7-8e02-65dc6b91c907", "sighting_of_ref": "indicator--7cee1d42-159c-4024-b942-9bed3b0a2b03", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f67a37cf-effc-4de8-95da-af39a9ebd374", "sighting_of_ref": "indicator--058b81de-729f-4adc-98d8-882f265f4b24", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a01eaa9-31ba-448a-af8b-8f0f9b257986", "sighting_of_ref": "indicator--b398f02d-817e-45ff-8af5-bff28b08ef7b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c00805e9-5ffc-484e-a24b-8cda2b3264c0", "sighting_of_ref": "indicator--b398f02d-817e-45ff-8af5-bff28b08ef7b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba6f280f-f598-4c1a-aa77-e21de05d309a", "sighting_of_ref": "indicator--2c6dcfbb-664b-4612-aa0b-69062c7f7801", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2cba03c-d990-421b-a953-aa029b1db485", "sighting_of_ref": "indicator--e47f6a9a-599b-4513-a4f0-95f6d287cb31", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63de8a91-e5a1-475e-814b-7b9a00cf751f", "sighting_of_ref": "indicator--e47f6a9a-599b-4513-a4f0-95f6d287cb31", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdfa3e0b-22f2-4b0a-ab68-2a96d70632a9", "sighting_of_ref": "indicator--cdb47a7e-d4f0-44fd-baea-35f7fccbadae", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0acc346a-26ee-4d30-9378-499a9198cf37", "sighting_of_ref": "indicator--3b1aba2f-4014-4487-ad36-8e85220753b6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99f4f781-6de6-4822-9571-edd67752847a", "sighting_of_ref": "indicator--d27b1e9e-5060-4bb0-9eaf-1e3202a7feca", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2e9db7b-8532-4518-bb7d-cb2ded4d6f3f", "sighting_of_ref": "indicator--86c81464-d252-4b3f-a319-73449f4db794", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b032ebb2-6ce4-48d9-92fe-3313dd4517f1", "sighting_of_ref": "indicator--8f67bba2-c1fb-40bd-a017-e203424c51ac", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66512294-1f53-497f-9bab-84be05b3e9f1", "sighting_of_ref": "indicator--8f67bba2-c1fb-40bd-a017-e203424c51ac", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3556f22-3864-426a-a159-f6001e4c269d", "sighting_of_ref": "indicator--9033841b-a17a-4a60-b0b5-85ee1349ff55", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de938d2a-1642-44ab-92be-6d92f2c8dd8b", "sighting_of_ref": "indicator--1e2d109f-5f7b-498b-be7b-7cd5fe965d2f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f18ef17e-49d4-4bad-b992-31dc5d5cf83b", "sighting_of_ref": "indicator--b85448a9-1562-46bd-93d1-f5f45d9635fc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--264fadb7-0fc2-424b-96f4-5a12d4d9ee52", "sighting_of_ref": "indicator--82e298cf-6f8c-4a76-ad1c-745481cd5079", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--157d2c60-8132-4d38-abc3-8f102f105005", "sighting_of_ref": "indicator--5cf996e4-e1ff-4552-8fd5-2198ea9583f7", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9280e04-5e96-45b5-b61f-a812de25c6bb", "sighting_of_ref": "indicator--aaa46e4e-7f90-42c9-ac2c-11d752121969", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49afcf7e-c781-4942-8db6-2b0badc76fc4", "sighting_of_ref": "indicator--0f78a702-0f96-48dc-920f-56b5da7b58e1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f85c910a-1dae-4254-84d1-415196ffa344", "sighting_of_ref": "indicator--43e80da9-edb3-4376-81ba-a2865fd96570", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35b54dc7-0ef1-4fa3-b0a0-ab5af7f3e3c4", "sighting_of_ref": "indicator--e0e23164-8404-4467-a7f8-4576bbf366c9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc182933-2bef-4ee2-8747-e692c63b7e5b", "sighting_of_ref": "indicator--2b3fc0c4-9715-4493-9c1f-47fb04550816", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f007c8b-250e-4bed-bb68-3f3063b3c322", "sighting_of_ref": "indicator--442b777f-55bd-4137-81ea-42df5d71549f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7816473-2a4f-4b96-9860-262550e558de", "sighting_of_ref": "indicator--c3f306a3-b380-4a36-bb77-40ea1448f1b0", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--679f3c4b-597d-4acd-8d82-5d1c9d8c85e1", "sighting_of_ref": "indicator--ee79e519-03df-456e-bb25-4b8a54de8092", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05200690-a97c-40e9-847c-e07988548af1", "sighting_of_ref": "indicator--86627570-7ff8-471b-b278-76c12aa4f1f6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a1ff12f-eaf4-4eab-98fb-72b7f450d8dd", "sighting_of_ref": "indicator--accb45a0-1101-491f-89cc-2a1d83e64c76", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae8c8ea2-19d3-450e-8cb7-fda406941ea5", "sighting_of_ref": "indicator--0d6b8def-097d-4f3c-a54d-40f5dca93b2f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--978e4279-13ff-4d2f-b683-b27dabe7ec93", "sighting_of_ref": "indicator--ea668567-44ac-4ea7-a4e4-3cfd2b7680b0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ff52609-e6ed-4fd7-b3f0-e28f0e6c2e21", "sighting_of_ref": "indicator--ea668567-44ac-4ea7-a4e4-3cfd2b7680b0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cbe48d8-5997-4124-9d59-e9b53cbd8f57", "sighting_of_ref": "indicator--8cbed472-437a-4e0d-90f6-f7aa45f4da48", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--529e54fa-bd30-4355-a5b7-31c17e076af3", "sighting_of_ref": "indicator--1325d9ad-237d-42dd-ae93-cc70820adfc4", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fca7c0d0-dca7-4d48-a1a8-3b38d52df14b", "sighting_of_ref": "indicator--507a52d1-cacc-4a9a-acdb-c07af9c87f45", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db2212a5-b5ee-44f0-8778-5008008aa8af", "sighting_of_ref": "indicator--82522c60-61fb-4662-9d3f-f7353fe9a73f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19886df7-aa72-4674-8624-a10c3e679d5a", "sighting_of_ref": "indicator--173b7144-6af0-4102-97a5-d6c13034ebf2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2082ea79-1948-4cd3-9457-e1193071f51d", "sighting_of_ref": "indicator--51a798fb-c4c0-465f-a97f-ffbe73a26b08", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77ca3ce0-6816-426d-a58f-5c6ec608523f", "sighting_of_ref": "indicator--c9d65dc3-c071-49ba-b765-1ca251d0d89c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0011cd34-06ea-4e0c-aaa3-aac556add1c5", "sighting_of_ref": "indicator--e16caaae-021b-4b5a-b50c-208574e926f8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--700a5137-d2dd-40ec-95fe-845db88a99fd", "sighting_of_ref": "indicator--575b85aa-4c1e-4774-a940-6af864e8ef14", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0a8a46e-b743-4e62-9d55-378bb2fca8c0", "sighting_of_ref": "indicator--f6322ef2-a3d9-4a8f-8cd4-4310bb98312c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--539075d9-e0ea-4cb2-ac56-adb534d48fc1", "sighting_of_ref": "indicator--c2848532-c26f-4d07-a086-b733377a3d79", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e977ebc7-4ed5-457b-9b6e-c517d2efb07f", "sighting_of_ref": "indicator--ee60b0c0-9c7b-4532-bc7d-ec4f072a6a43", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe4622a8-abe0-4c71-aba6-fae87964764e", "sighting_of_ref": "indicator--63999955-b8a4-41cd-b19b-f46da00182cb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e82c9db-c48e-4472-9c99-93a3a35c13d7", "sighting_of_ref": "indicator--51926f02-a7b9-4061-aaaa-690d79ee0700", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c508ddd-b72f-4fbb-a946-dbbc289940ec", "sighting_of_ref": "indicator--1ba70b50-a9aa-453e-a894-48cb5cde8a47", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--655b1833-f6b9-4d3d-b7ae-4479dc7d64bd", "sighting_of_ref": "indicator--bf65c7ba-9957-460f-bb2f-f8754f2b0db0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--911679e3-7766-4f68-8cec-e3fe9d95ef3c", "sighting_of_ref": "indicator--d1c1b847-976d-4956-bbde-4d64f98f4ce4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00662e03-df6d-4144-89b2-b611c7d1177e", "sighting_of_ref": "indicator--5c1b35e6-78e8-4ae6-999a-37d41aa8a137", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b259b03-b191-4507-8f71-2b05dfb6fe3c", "sighting_of_ref": "indicator--b481ea2a-0016-448b-9a55-9958190daf2c", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5e03f0e-1aa3-40af-9cce-44b59820cce2", "sighting_of_ref": "indicator--882321e9-de6a-4488-8867-706ebbcc5757", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--230fdaa4-ad25-4974-ae87-eae5ef2fb4f1", "sighting_of_ref": "indicator--97a1253d-241d-4622-99c0-61056da7dd47", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faa9a01c-0ff8-4ef0-afa4-48fc48bcb2e4", "sighting_of_ref": "indicator--269eb532-dd57-448c-9a22-512f69ec322e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39e27fbb-884d-4ee2-bef0-280f2524165b", "sighting_of_ref": "indicator--4772a110-9f6e-4108-94d3-a88ed62b22ef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--728577cd-68dc-47a4-92ba-4e8865e0ece2", "sighting_of_ref": "indicator--7bf10be1-ca7d-497a-85d5-f1de667f84d9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8c589f5-9789-4af8-9d95-2b621ca04b6f", "sighting_of_ref": "indicator--dbe4c582-9c25-4b5e-96f2-adbfea7b174f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d704d9f-2e01-4ec7-9398-66075c002d98", "sighting_of_ref": "indicator--00473cc4-b013-42f9-8ab8-ccd10de1742d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6087fed-64b6-4ea9-9e33-ee9337011772", "sighting_of_ref": "indicator--a261157d-c1ab-431f-a735-9c2dff25af7b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d17ba9f-74dc-4756-9f79-a7af858c9fec", "sighting_of_ref": "indicator--8af06559-ea01-4865-9308-b4f334a38b88", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89bc9195-302c-44dc-bc7d-4a4da523e435", "sighting_of_ref": "indicator--c9a50474-7253-4c08-87f3-2f819dc48cab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11441104-6afc-4ba4-be4a-9383f4868024", "sighting_of_ref": "indicator--fe9662d6-198c-4632-9373-2bce8cfae442", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--593a101e-644f-4880-afaf-96b169908deb", "sighting_of_ref": "indicator--93fbe39c-3308-42d6-add1-c05d94ca0fa8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--726b4a59-90cb-4cef-aa6a-c5b60187ac12", "sighting_of_ref": "indicator--b7147e62-be35-433c-95c2-3aa9a3196e1c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72fb67d2-6e84-4992-8d1b-4593e3cbbf6b", "sighting_of_ref": "indicator--b7147e62-be35-433c-95c2-3aa9a3196e1c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1fe62e5-7321-46a7-9eb5-b826f5048962", "sighting_of_ref": "indicator--ba358135-ed14-4950-ad60-f34674aeb09b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acc86c72-86a0-40c0-8805-9f968444d70e", "sighting_of_ref": "indicator--ba358135-ed14-4950-ad60-f34674aeb09b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e06f1c4-a4c0-44f0-9372-5a814771951b", "sighting_of_ref": "indicator--ef8d5ef5-e09f-4067-be26-9f7c1fee3bca", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb897a9c-238d-4063-b3aa-075a5bc4c182", "sighting_of_ref": "indicator--b03d10a8-7bff-4897-8618-a00b28068329", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95294d94-f203-4209-bd9b-5a5bf22c7d1f", "sighting_of_ref": "indicator--c0830a78-d4b6-40ee-813f-86431c0d2893", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94e66835-44e2-4791-809c-898bc3a1f73e", "sighting_of_ref": "indicator--96ce2e17-ecfc-4688-8eb7-29e4dc6f6455", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d5a75ff-4670-43dd-9c2d-6866615db800", "sighting_of_ref": "indicator--1d843b89-70ed-473d-a23b-f53009705fb1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c3d58b3-7c4f-4255-8c78-47fd43407af8", "sighting_of_ref": "indicator--189fea1f-27e8-4411-b6d7-1d52d2bce0b4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a56d1ba6-fd1f-4940-92e9-2ffeda050f33", "sighting_of_ref": "indicator--189fea1f-27e8-4411-b6d7-1d52d2bce0b4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--758d0110-d94d-4545-a679-82c5225fdc3c", "sighting_of_ref": "indicator--63c7744b-3d0e-4eae-8e3f-1bef1bb7dbdb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9219f4b-d085-454c-856b-940bdc449272", "sighting_of_ref": "indicator--fdddfc34-e627-4581-97eb-72246aed4ddd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21e1dc0a-cd45-4d2b-92da-21304745371b", "sighting_of_ref": "indicator--83e0e98b-8a2c-47ed-8057-9b914842e7a7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fa47df6-2815-49e4-aacc-377db1275d6f", "sighting_of_ref": "indicator--47e51a96-68d4-4cae-adc2-dc75d52b6504", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4a8a4b2-1253-4092-8c64-ffd22379c357", "sighting_of_ref": "indicator--9d19dea4-88e0-451a-81dc-026522ff36b8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e44d3c4-76df-4ca6-a69f-0ea6de7db23d", "sighting_of_ref": "indicator--ee0903ec-9880-46cf-a807-651174cc14c3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f40157d-e8af-43da-8a78-fa7cb492ba20", "sighting_of_ref": "indicator--30dedc67-32a6-4d53-88a6-9a8e7c6973b2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdb061ed-c618-49e7-bcb5-b330bc18f8bc", "sighting_of_ref": "indicator--30dedc67-32a6-4d53-88a6-9a8e7c6973b2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43a9fc84-da10-4ac7-80d1-4216c972127c", "sighting_of_ref": "indicator--472f4f9f-30a0-412e-9c26-cd52369b48b0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--189dd891-a9bc-4491-9bb9-18a3182c4ce3", "sighting_of_ref": "indicator--51023f23-7549-46f4-8555-9d1b5d58b1d6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d52c4d5-3a4f-4a85-ba05-4d3db68b4817", "sighting_of_ref": "indicator--51023f23-7549-46f4-8555-9d1b5d58b1d6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a80b3b69-1092-4ca8-9a67-8c0cce1faee7", "sighting_of_ref": "indicator--3c4afa44-baee-438e-8ab5-baf604e08427", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d7fbdf7-646a-4645-8fbe-f905538e0bdf", "sighting_of_ref": "indicator--3c4afa44-baee-438e-8ab5-baf604e08427", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83668079-a2a9-47bc-9277-bab3a41d936f", "sighting_of_ref": "indicator--72eb143d-0608-4157-bdd7-ce7cabfbd9c5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee9ae59a-9216-4d21-9d61-4b604d3b6990", "sighting_of_ref": "indicator--6f8de285-4830-40aa-a27b-bb1a1e0cc59a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ba7a0d0-24a9-4cc9-86d0-4f4221d77833", "sighting_of_ref": "indicator--8c82a007-d1e2-43e5-ae73-e1bc85fdfc33", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea80d2b3-120d-4a41-ac7d-55f248fd73e8", "sighting_of_ref": "indicator--70ab7e58-abf0-49fa-9acc-fa3acfb81c31", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f07a8ab3-709a-43c5-a7a3-45f549b348c9", "sighting_of_ref": "indicator--1cf13e37-50c5-4af9-983c-a018ed0c4830", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--141500f8-2686-4a1d-a62a-b334886ec4d9", "sighting_of_ref": "indicator--1cf13e37-50c5-4af9-983c-a018ed0c4830", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7374713e-2ecf-44fa-bc4c-cce273e528af", "sighting_of_ref": "indicator--4b6f3951-139c-4e81-b0f0-f855530186f1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9669a8e9-2835-483f-932c-57afbaa5a502", "sighting_of_ref": "indicator--fa7ad11e-7ed9-46c0-9a80-508d7e916155", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8cf77ef-0223-4d2b-8868-a64da372b5e5", "sighting_of_ref": "indicator--edae4f53-7055-4c5e-9ca3-59484003fea8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b98ff8be-3882-414c-8dbe-6f8523985225", "sighting_of_ref": "indicator--87b215da-fa7b-42a4-96a3-eec638eeaafc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15c2de27-babb-4f24-bf91-74cb7d48f96a", "sighting_of_ref": "indicator--d0c0503e-4fc4-4614-b7f8-d730c00e4b6e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26573cbf-e788-4a2d-9e99-97e31a87c422", "sighting_of_ref": "indicator--16c677a3-cafa-463b-a251-7b884533c6cc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5013f70-93d3-445a-aeae-49ee3657f083", "sighting_of_ref": "indicator--95e776cb-7a34-4165-9f96-6cb5a0b722c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71de260c-15de-41de-8b04-2bb6a60ec0fa", "sighting_of_ref": "indicator--356ef249-bde8-4300-91cc-cdeaafeec87d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cc37e70-7a8d-42f4-b5aa-75e6a012996f", "sighting_of_ref": "indicator--8b1327cf-6d02-4818-b014-d28a171e4a85", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76fba6ff-e791-4435-90ba-bd32931d3053", "sighting_of_ref": "indicator--8b1327cf-6d02-4818-b014-d28a171e4a85", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1f08d28-a9bc-4995-bac1-a08d9681ef5e", "sighting_of_ref": "indicator--d3acdbfb-8c39-4494-bd4e-d846f615ccd0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c2f6eaa-2292-422e-a1ca-0c66b1aeeef1", "sighting_of_ref": "indicator--5b345724-f850-4e5a-872d-25ce3f35f579", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60668291-30ce-470c-906a-1125a35d2971", "sighting_of_ref": "indicator--be2acc65-871c-450d-a236-729379ee3c67", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01b61377-b251-4a31-95de-16f152cec6e4", "sighting_of_ref": "indicator--40657a6e-916e-4396-92c7-e67b81977353", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21cc6d2b-7a8f-483d-a748-bb482f16a356", "sighting_of_ref": "indicator--e612ee94-26c7-4514-94d8-290d1c1cc252", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a88fe26-4416-4a76-828a-ad00299cef4d", "sighting_of_ref": "indicator--efbd47f7-d651-4646-bc6d-7ed689b0bb8e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0eee62c-8a4e-4c03-8a64-0d122c52a5be", "sighting_of_ref": "indicator--68b4255d-3c30-47ae-9d7f-262dd72a94ce", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--904332ee-5f17-4aa3-94be-b08b0a31d790", "sighting_of_ref": "indicator--68b4255d-3c30-47ae-9d7f-262dd72a94ce", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e1ad308-ebe6-4584-89c9-ea9f71e24c3a", "sighting_of_ref": "indicator--a04eb0ec-8e3b-47ae-8c07-3dcdae302e14", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d02dacb0-818d-41e4-a6b8-e18a6a26fabf", "sighting_of_ref": "indicator--10e7e914-3e76-426c-a2df-9ff33a43ebf2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8e679bf-0886-4bfb-8417-98fb1541b5e3", "sighting_of_ref": "indicator--69b3ae3e-1d34-4a3d-b64e-d9fa39ae9ed6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40bfeb1f-359c-4b65-92c5-b62e7ba8c76b", "sighting_of_ref": "indicator--a1eb76ca-c1a4-4996-b535-be0118aef068", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fd1e02f-b8e1-4e9b-bae3-1f2067ad086c", "sighting_of_ref": "indicator--80c291e6-1ff0-43f6-8983-075e800d7451", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--169248db-098a-4fbc-8db7-133852bbccce", "sighting_of_ref": "indicator--bf969b35-9106-4b1d-aea2-36f55835784c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cb193b7-81c2-49f0-97f5-cef0899672d4", "sighting_of_ref": "indicator--d1c28777-46ce-4b02-89fa-a411963c5f91", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afd7b568-c490-45b8-9f65-f359a34b962d", "sighting_of_ref": "indicator--d1c28777-46ce-4b02-89fa-a411963c5f91", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e347d9a8-cd14-40ca-a6ff-871205fdcdab", "sighting_of_ref": "indicator--c616bb67-7901-4c75-a516-6c83b48e8037", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--032d5e67-8bb2-4853-bbe6-719daf3284e1", "sighting_of_ref": "indicator--9bd04f97-d5f0-460c-95eb-db6cef69bb91", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e61fa999-374e-4708-acba-62b70a1037cd", "sighting_of_ref": "indicator--d44ece95-44b9-4149-87f6-52b5e7b90412", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42ce651b-b185-472f-a1cb-ae811addf3cb", "sighting_of_ref": "indicator--63bea027-aa56-4210-94db-707183fcc293", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ce06b59-03d6-418c-bfd8-67b36254e58f", "sighting_of_ref": "indicator--53dcf824-346b-49c2-944b-963defaed9ab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac24d9ac-e632-487e-b70f-b96fd1b6a7c9", "sighting_of_ref": "indicator--53dcf824-346b-49c2-944b-963defaed9ab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--092e6b10-9532-4974-a4c5-e363cd4f5dde", "sighting_of_ref": "indicator--129f5789-11d9-4b95-8ca5-fdcdf4ce3c06", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e44179f-b246-4fbf-9be4-566429308ecd", "sighting_of_ref": "indicator--9ad7ea70-b2c4-4ae1-b414-c9074cd3b9a9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b08f665a-eb25-4c25-9d4e-f190727e920d", "sighting_of_ref": "indicator--f055a605-734d-4e04-837e-8ecee32d0773", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80b52a1e-8b5b-4b28-bbd2-5dd3925f073d", "sighting_of_ref": "indicator--e0db63a0-c9ce-404d-9bf6-289188eb6ad8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fbcc577-be28-4dad-82bc-83fe8b749d73", "sighting_of_ref": "indicator--e0db63a0-c9ce-404d-9bf6-289188eb6ad8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4a78380-658e-45c6-aa19-4a0f2bb21f68", "sighting_of_ref": "indicator--1964af1a-552a-495f-b82f-21ed1925ed97", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--075b94b7-c835-467c-b035-d138c0cd80d9", "sighting_of_ref": "indicator--46e14c68-eb35-4eea-a532-5b7d7ea72563", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc072516-174d-430e-b039-dea3f581db2f", "sighting_of_ref": "indicator--9a7e2d2d-2de0-4af1-83e5-582a39df4a7f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46cf7a01-8fba-410b-ac65-79c87d4df1fb", "sighting_of_ref": "indicator--5b1484d3-7ffb-4877-8c89-bf4bab0e8164", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cc37d7c-e690-415d-8463-33adeae4ceb1", "sighting_of_ref": "indicator--5b1484d3-7ffb-4877-8c89-bf4bab0e8164", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26e0b79d-0010-48f2-b8e4-a274b2ceacc2", "sighting_of_ref": "indicator--773dfdeb-feab-4fac-987f-c452b156482c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--292890fa-4bf0-4a13-b6f4-c3de194e5205", "sighting_of_ref": "indicator--5f35f490-015c-495c-9883-b1d7676730b0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3408a2d-594f-429e-9cf5-a4a3a09fc86b", "sighting_of_ref": "indicator--0942d012-28a5-4200-9212-a10828f6a204", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f39d3294-1ffb-45a3-89cd-2268044e0b61", "sighting_of_ref": "indicator--0942d012-28a5-4200-9212-a10828f6a204", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d972fe4-cfe1-4ceb-935c-101d55129eb0", "sighting_of_ref": "indicator--edc0fe7e-4b68-4f63-ba62-71189dbed3de", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28ee51aa-5a50-483c-b358-bde0321d6451", "sighting_of_ref": "indicator--ecc4211a-57be-41a4-93ba-937eaffe920c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ddd015d-4354-4799-8808-437d30d5fcf4", "sighting_of_ref": "indicator--33addd2d-35db-4b80-b600-8c7f1caa6624", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afa8a76a-592d-449f-9035-41c54b5ab730", "sighting_of_ref": "indicator--582aa067-c70e-44c8-a8eb-1aaca8225ec7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb53f1a8-7979-4ad4-8910-21ec864bd1e9", "sighting_of_ref": "indicator--dc8bc98c-8c26-4e52-8156-7c3dc5452a3a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22dac117-0267-45a9-98ed-ba05bcb6ae54", "sighting_of_ref": "indicator--f105d142-bd9b-453e-b1f2-5ab150396a00", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69803504-e213-4ae9-b220-dc6eaf6dc7a3", "sighting_of_ref": "indicator--f105d142-bd9b-453e-b1f2-5ab150396a00", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f63c4b8-c83e-47e9-85e2-d6dd47423239", "sighting_of_ref": "indicator--1570c1a8-f31e-4d89-8f7d-49542ab8d053", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40d549dd-6117-409b-bb68-5b2436c224ba", "sighting_of_ref": "indicator--1570c1a8-f31e-4d89-8f7d-49542ab8d053", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b05f7b5-a8db-4a90-a943-8c51840c6a9a", "sighting_of_ref": "indicator--aee62324-3347-40ff-9326-2ecb790c6c68", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--076b1f7d-3702-416e-b756-f6275b9efcc7", "sighting_of_ref": "indicator--4376c24a-17c0-48ed-9526-4a1651b5fbf3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9bbf7f0-86fc-455d-a613-6b237dcd29db", "sighting_of_ref": "indicator--4376c24a-17c0-48ed-9526-4a1651b5fbf3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddeeba27-9eae-4e8f-9c94-7f20bf269050", "sighting_of_ref": "indicator--8c1b7f9c-ab0a-4f58-8371-34ff3b964c15", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b1fa400-0078-447b-9e3a-8f4e0356fe45", "sighting_of_ref": "indicator--8c1b7f9c-ab0a-4f58-8371-34ff3b964c15", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48a5f744-3a50-48aa-9883-1ab32cc55b90", "sighting_of_ref": "indicator--00c3a2c7-d396-44a5-9163-12c1bb168e31", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1aaae6cb-31ed-40a8-a1f4-6c4d49de1f28", "sighting_of_ref": "indicator--00c3a2c7-d396-44a5-9163-12c1bb168e31", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--542ed6e5-b0ae-4b81-abb2-534924ab03cd", "sighting_of_ref": "indicator--58167fb8-7aa1-4546-9750-0ed2b5d438e2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb64bbce-34cf-4920-8506-1787161e8ed9", "sighting_of_ref": "indicator--58167fb8-7aa1-4546-9750-0ed2b5d438e2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6013d5e0-f1e7-446c-b6a9-5dd4c4979992", "sighting_of_ref": "indicator--f58341fc-fb26-4389-8dc3-5fb37b5c2a38", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1543337e-8afc-49b2-9ade-b6e1cb77198d", "sighting_of_ref": "indicator--a8ebfccc-2028-4d96-a5e0-0b94f83c7d2a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d15f9e3-9226-4b00-a0b7-d9dbcbb57489", "sighting_of_ref": "indicator--a8ebfccc-2028-4d96-a5e0-0b94f83c7d2a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acbc2e3f-7fba-4de1-bf48-7bf86218239b", "sighting_of_ref": "indicator--a393c76a-2e22-4576-a3db-508704d83b54", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b403870-769a-44a2-91a3-50a88cd13bb3", "sighting_of_ref": "indicator--a393c76a-2e22-4576-a3db-508704d83b54", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f52545f-bcda-4b8e-aba1-dc36cc9e919b", "sighting_of_ref": "indicator--b8ec85b6-fa9b-49da-805b-e5b4bb3ce686", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e421af56-6bbe-4341-a67d-f732a875471d", "sighting_of_ref": "indicator--b8ec85b6-fa9b-49da-805b-e5b4bb3ce686", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6c02f68-854a-4887-8ed5-36240221d514", "sighting_of_ref": "indicator--0d7857ed-241d-4622-bc87-5504b3279e87", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cda68939-2d3e-48bd-b3ec-76ecf3344f2e", "sighting_of_ref": "indicator--d8e4c44a-7133-4d0d-a214-910330e0445a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fd0544d-5383-473f-9cee-05304c7a2b62", "sighting_of_ref": "indicator--d8e4c44a-7133-4d0d-a214-910330e0445a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07bccb14-298b-4817-9d0b-eec338b41b0c", "sighting_of_ref": "indicator--b044d83f-7c01-4754-85b5-08d6e96c125a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee364fe1-63ef-4956-9f75-3150a791d637", "sighting_of_ref": "indicator--b044d83f-7c01-4754-85b5-08d6e96c125a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea3ca187-310a-4445-9bb6-2d9fb70ef9b1", "sighting_of_ref": "indicator--514e6cb3-c706-4ada-86e9-149b964685a7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fae0e59a-7d6b-4bf4-90e5-7a31cc6b76c1", "sighting_of_ref": "indicator--514e6cb3-c706-4ada-86e9-149b964685a7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4a41ee1-2120-41e1-8814-4c2a340dd54f", "sighting_of_ref": "indicator--dba7e688-6557-41aa-a532-9b78bc09e51f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9434246b-7ada-4662-a1c5-5cdd0b93be17", "sighting_of_ref": "indicator--dba7e688-6557-41aa-a532-9b78bc09e51f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2d67f4a-b8ff-4e33-b178-0079ccb60815", "sighting_of_ref": "indicator--8979dcad-d183-4f70-a113-2ee4399924da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f35205e7-67a4-45de-a04c-2060b4c90daf", "sighting_of_ref": "indicator--8979dcad-d183-4f70-a113-2ee4399924da", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40404d83-28ad-4a9f-b77a-8530f83f51aa", "sighting_of_ref": "indicator--49a7e50e-35e1-4896-9e55-6d1a4f3a084a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b069c1c-39a6-45ea-a599-afa8f911b32f", "sighting_of_ref": "indicator--49a7e50e-35e1-4896-9e55-6d1a4f3a084a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dd5388f-6804-4020-aa86-79642c406607", "sighting_of_ref": "indicator--339bd3ac-7e59-4e5d-b45d-8f017fa40679", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0164300a-50f4-430c-b2c8-37dd954dbcc1", "sighting_of_ref": "indicator--339bd3ac-7e59-4e5d-b45d-8f017fa40679", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af3ed253-67f7-4569-b4ff-db4fb03195ea", "sighting_of_ref": "indicator--acf5b0b8-e024-4dfe-891d-a6be883ac0dc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--803d2b66-91c8-41b9-b9da-b7dac43b1de0", "sighting_of_ref": "indicator--1dbd1c53-017d-4b41-b78f-da3c945e82b7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1f6ddea-efed-4f5b-af73-7b0f86b9199f", "sighting_of_ref": "indicator--1dbd1c53-017d-4b41-b78f-da3c945e82b7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1aede51e-68c2-48c4-ba70-3c1cc5daa01e", "sighting_of_ref": "indicator--2cedcee0-58d0-447d-a9a1-2e09dd16a639", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13cdbddc-dc5d-4a45-9b6d-05cff0fab7a5", "sighting_of_ref": "indicator--2cedcee0-58d0-447d-a9a1-2e09dd16a639", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a306c02-4160-4d32-97ce-aadb88bd5aca", "sighting_of_ref": "indicator--6a77f2a7-74ca-4a0e-ad18-078ec2328e04", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24ecd019-a3b4-4200-a930-f4c74e42d2ca", "sighting_of_ref": "indicator--6a77f2a7-74ca-4a0e-ad18-078ec2328e04", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e85512fd-f2cc-4eff-8927-ff004db04166", "sighting_of_ref": "indicator--ab55ce3d-dc41-423b-a336-45d0a7266197", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93841e83-8366-465a-8d46-8067693811d7", "sighting_of_ref": "indicator--ab55ce3d-dc41-423b-a336-45d0a7266197", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9a83339-268f-4a8f-8533-273881f4e2a1", "sighting_of_ref": "indicator--48a588fc-fd44-4fbf-87f3-c8336e44006c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1334ae9-3ade-4d18-be8a-88bb7cae29b5", "sighting_of_ref": "indicator--48a588fc-fd44-4fbf-87f3-c8336e44006c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4093f06-948b-498c-8509-1b2b534a337b", "sighting_of_ref": "indicator--642fd107-c536-4a8c-801d-3ed9d0e0cc84", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b984acec-e66d-4668-a6f9-37bc4c3896e3", "sighting_of_ref": "indicator--642fd107-c536-4a8c-801d-3ed9d0e0cc84", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d80f1a6e-e898-4fd7-8322-9a4eb3e0f616", "sighting_of_ref": "indicator--1b089778-2d2a-47a1-be0b-df48eb27db3f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9383874b-7ff7-4570-a8d5-bdb40a36ddb4", "sighting_of_ref": "indicator--1b089778-2d2a-47a1-be0b-df48eb27db3f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d07e0510-79fb-40cf-a5e3-43a4939d51b0", "sighting_of_ref": "indicator--5016cfb3-82de-4145-ada3-e900ae20c2d0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dea957c-d11e-4517-8860-508d8306bf98", "sighting_of_ref": "indicator--5016cfb3-82de-4145-ada3-e900ae20c2d0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7872ff36-bcbc-4c56-8fa9-2cbb2ab06b60", "sighting_of_ref": "indicator--47a29860-7d81-4f30-8f23-8ee6b7e924fd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10656091-d8bd-442e-a779-1a6b2c79d01e", "sighting_of_ref": "indicator--47a29860-7d81-4f30-8f23-8ee6b7e924fd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--025ca9c9-0b85-492b-8b45-52f8048222e0", "sighting_of_ref": "indicator--d9513cd9-69e4-4644-8d23-c57fbbb9891d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--983e3b7d-505b-4bfd-b06a-b4794f549574", "sighting_of_ref": "indicator--b65188e5-3fd5-4e65-b63e-ef27c5112992", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d738c25e-86c3-4dc7-bce2-cf3a269acbc6", "sighting_of_ref": "indicator--b65188e5-3fd5-4e65-b63e-ef27c5112992", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd529e9a-9b44-4b30-93ee-3ea51e60e7cc", "sighting_of_ref": "indicator--f79a9dc1-4729-4e8f-a65c-d022fe3bcda5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20ed2709-d948-4289-b97e-529a89623786", "sighting_of_ref": "indicator--8d359d21-4c8d-442b-9a38-82cd29582c23", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e835be6-bcda-44b7-8ef7-93ff2c85e881", "sighting_of_ref": "indicator--3b2ed35a-cba5-46b6-9a62-a8c3261b948d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1668c154-48df-43a6-afc4-de213ab7b6b5", "sighting_of_ref": "indicator--3b2ed35a-cba5-46b6-9a62-a8c3261b948d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c66fc5db-fd56-4457-b37e-f36c98d9d9de", "sighting_of_ref": "indicator--b6e06c83-b297-4bf9-a923-0469bc481f43", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42ef0380-8768-4d41-aaec-d241880e8772", "sighting_of_ref": "indicator--b6e06c83-b297-4bf9-a923-0469bc481f43", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97fe26f7-d14b-49dd-b3a8-bafe3ddf70cd", "sighting_of_ref": "indicator--192848a4-4c53-450a-8034-b922eaa65302", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48832049-98b4-4781-bb1e-aca733a46bfc", "sighting_of_ref": "indicator--192848a4-4c53-450a-8034-b922eaa65302", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--237dfe1f-e4ae-4f17-b93f-b299340455ed", "sighting_of_ref": "indicator--8a1eca17-ffdb-4d51-9657-09eb60588a4e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d0d2dab-af04-4e2d-8aef-4eb8a960384a", "sighting_of_ref": "indicator--8a1eca17-ffdb-4d51-9657-09eb60588a4e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5934c111-5a6d-4b46-9205-50f5029e78ee", "sighting_of_ref": "indicator--d7d8965a-0938-4b03-862b-1b0cb03828c0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a886dff0-baaf-4135-9601-121a5cfb9053", "sighting_of_ref": "indicator--254499ac-668e-4bf0-b777-c2a4458352d1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82bde848-2eb3-41b2-a773-43e021f5649f", "sighting_of_ref": "indicator--254499ac-668e-4bf0-b777-c2a4458352d1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c057796c-fb5c-44ab-bbe1-803c96fe84f7", "sighting_of_ref": "indicator--b0acec9b-ab04-426c-93e9-2a2d53760e8c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f049fce0-842a-471c-abc1-f58077706c63", "sighting_of_ref": "indicator--b0acec9b-ab04-426c-93e9-2a2d53760e8c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d742df80-a6fb-4e71-8ebd-ef952c049fa9", "sighting_of_ref": "indicator--99d8334d-373d-4aa3-9394-a56e9b57a3e7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efc81575-1f84-467b-b8d7-ddbf9b191a54", "sighting_of_ref": "indicator--1b25dcec-9b7f-4147-951d-4f4de18a8196", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34f6e270-fbc0-4997-9a2b-cfd1f02278f5", "sighting_of_ref": "indicator--1b25dcec-9b7f-4147-951d-4f4de18a8196", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df66700c-ff16-4994-897c-fe615ab364cf", "sighting_of_ref": "indicator--8495373c-74de-47f5-919a-50219c0a5890", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59066236-7b11-46e5-af9c-b677d224fe1d", "sighting_of_ref": "indicator--54078fcb-9445-4661-bea6-4da4e577c6b8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f3eaa72-b6bf-4568-b359-4c658b414a99", "sighting_of_ref": "indicator--54078fcb-9445-4661-bea6-4da4e577c6b8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6208258-6574-4e25-88bd-650f9fa07f41", "sighting_of_ref": "indicator--fa23ee59-15b8-4556-941c-09d862fe5ce2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--054129f8-0a20-48d9-956f-1711ae64490d", "sighting_of_ref": "indicator--fa23ee59-15b8-4556-941c-09d862fe5ce2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--005be07f-5280-48e5-b49f-56d407e2cb2a", "sighting_of_ref": "indicator--26383d5f-4e3a-4e63-ab1a-e3653116d7aa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c789ea84-585c-49f5-b4c6-fbc34cba08f5", "sighting_of_ref": "indicator--ab0115b9-f6b3-4096-9e64-93e58946ef78", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a81bcf29-decd-4ce3-b8a0-a2d7485f2c32", "sighting_of_ref": "indicator--ab0115b9-f6b3-4096-9e64-93e58946ef78", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10ce6ea4-9249-4acb-bc19-5afae812126e", "sighting_of_ref": "indicator--a2ad18ab-85fb-46df-b43b-577109b04ec9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d4619f5-d0ad-42bc-9b7a-00402b1f479a", "sighting_of_ref": "indicator--a2ad18ab-85fb-46df-b43b-577109b04ec9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91580d92-61e0-4271-934d-ff2903a590f7", "sighting_of_ref": "indicator--8b5b4cdf-e343-408a-a060-d3aafeed89c8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c57eaf1a-636d-4130-8b0e-9a4f56171a06", "sighting_of_ref": "indicator--8b5b4cdf-e343-408a-a060-d3aafeed89c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2331b951-911b-45bd-bfaa-b89a4daeae8d", "sighting_of_ref": "indicator--654585be-0773-4fcd-88c4-b780ecd8cb69", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43de8471-bf11-4b09-93ab-7eb4c3698a95", "sighting_of_ref": "indicator--9add64b6-7e8d-4f21-ad29-df8d9edaa824", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6ac5bd6-6ef5-463f-b0a1-25fb2233350f", "sighting_of_ref": "indicator--12a35a2e-2ecb-4ee9-bd10-52e18fb51ce9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08fda28e-2bbd-4b56-99ae-b9f399020d02", "sighting_of_ref": "indicator--357d8cb1-e42c-4169-941b-1cf1b1934118", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10ebdd11-343a-4174-9077-9655438a9259", "sighting_of_ref": "indicator--357d8cb1-e42c-4169-941b-1cf1b1934118", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--591ffb4b-af3f-47ca-a107-954356b40d8f", "sighting_of_ref": "indicator--31a1a882-0f82-47a6-82ba-d337ff4ddb49", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21633532-9948-4fc4-a6bb-3c6429a855db", "sighting_of_ref": "indicator--31a1a882-0f82-47a6-82ba-d337ff4ddb49", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75057708-0918-4ac4-8b35-0f1162767b9c", "sighting_of_ref": "indicator--b18a7a55-8eff-4d54-87f2-0016f164ee8d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13753817-23eb-436c-8782-d3c229f71c9c", "sighting_of_ref": "indicator--778bc66d-d41b-48bc-8146-54c23dbc157a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--613ed817-60ca-44b9-80e8-3c3c2e00b322", "sighting_of_ref": "indicator--778bc66d-d41b-48bc-8146-54c23dbc157a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f88d9462-34b6-4be7-a787-bf58a7b09845", "sighting_of_ref": "indicator--416b36a7-32c6-40a4-ac11-48c372406a1c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--031c3150-8891-4ef2-9c1a-55432f3cc5aa", "sighting_of_ref": "indicator--8938abcc-eb56-45dd-a863-85eb4fc92a1a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1085d78f-0563-4e81-ad31-fbd9cad5bd36", "sighting_of_ref": "indicator--8938abcc-eb56-45dd-a863-85eb4fc92a1a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2c76c2f-0553-4ec4-a697-5d7055616751", "sighting_of_ref": "indicator--0495f770-9b2a-4a6c-81bc-b03f7f531d68", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50b471b3-2263-4bad-8528-1270340271f2", "sighting_of_ref": "indicator--0495f770-9b2a-4a6c-81bc-b03f7f531d68", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6824d55-6ada-454c-aa33-6b4ccd5162b3", "sighting_of_ref": "indicator--e62ddce7-3c96-48f5-87ad-f5d3a9266663", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d597dc0e-ef2e-4eb4-9e57-2663abdc4e0b", "sighting_of_ref": "indicator--e62ddce7-3c96-48f5-87ad-f5d3a9266663", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5cfa775-d94f-462d-8dbc-873b28f9b3ac", "sighting_of_ref": "indicator--edfb5530-179e-4a84-8716-57cfffeb8710", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f88d5c50-0303-44c3-80d2-839a1a6214a4", "sighting_of_ref": "indicator--edfb5530-179e-4a84-8716-57cfffeb8710", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3016f87-69d5-44a5-bdd9-d9eb59f7d70d", "sighting_of_ref": "indicator--82474084-ec45-4484-8ee2-2147d2768237", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b886eb64-cd1e-46a9-a85a-8881b71efcdf", "sighting_of_ref": "indicator--82474084-ec45-4484-8ee2-2147d2768237", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf408f6d-a529-4af3-b75f-78510e4b3a1c", "sighting_of_ref": "indicator--258159f3-5dc6-44e4-8973-c2a329f01e2b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3480eba4-526d-4d35-84a8-dcf972ce75b7", "sighting_of_ref": "indicator--ddd3a44d-3dfb-4770-adf4-306fb82cc8e9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21b609d9-49ae-4f7e-a780-b6be8ed22400", "sighting_of_ref": "indicator--ddd3a44d-3dfb-4770-adf4-306fb82cc8e9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--700d317a-376f-4b57-8b69-0fd309a78ddf", "sighting_of_ref": "indicator--2d3b82d8-29c2-4e21-a123-3e1113987e56", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c3e72c7-2fbd-48dc-ae2d-ce52f7808226", "sighting_of_ref": "indicator--2d3b82d8-29c2-4e21-a123-3e1113987e56", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f4ce07b-fb49-45e3-b59d-0c61db71e1e9", "sighting_of_ref": "indicator--4da6bc29-e962-485a-bb94-afab8c1f5b64", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a6e8245-b181-4c21-8176-36e3c2caefef", "sighting_of_ref": "indicator--4da6bc29-e962-485a-bb94-afab8c1f5b64", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1acc9c2b-55de-498e-90b1-952723b6be97", "sighting_of_ref": "indicator--f37f084d-74a9-49f5-97d6-1f58e0404bcd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aaae56fd-f6fb-4c7a-aa0f-d113fa3e6b5e", "sighting_of_ref": "indicator--5e1e91e4-ffd9-4843-898e-8d5bce38ed19", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60939402-6e12-42ff-b971-49baf2ab6e40", "sighting_of_ref": "indicator--b79037f5-71d4-4b08-b31f-4a4b419611d9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6a3a51c-f13b-44e9-a1b1-9de18af4b9a6", "sighting_of_ref": "indicator--20bf947b-80e6-4571-bcf5-3152bc9bbf78", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67b5591f-fb8b-4110-810b-8cb6f770274b", "sighting_of_ref": "indicator--7ad78812-24df-49dc-b7b4-e131558b3a0a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9cc342b-b100-44c7-b558-c220455596ac", "sighting_of_ref": "indicator--7ad78812-24df-49dc-b7b4-e131558b3a0a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c5b7ea5-677b-4081-9dd4-4b855f93548b", "sighting_of_ref": "indicator--8e00929b-2060-453f-806e-e9befade8575", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f2107bf-4314-416f-a96c-029647cf2567", "sighting_of_ref": "indicator--8e00929b-2060-453f-806e-e9befade8575", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b899108d-cc32-4852-8caa-ebff10bc5f5a", "sighting_of_ref": "indicator--0fa07b5e-e93a-473b-ad08-c5a57c7ae566", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--861f5dc9-5083-4a6c-9102-63d3b4dabfc1", "sighting_of_ref": "indicator--f068d149-4a54-4572-901a-6a0898b15d42", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3313d17e-b90b-49f3-a0d9-339b0d5ae68f", "sighting_of_ref": "indicator--fe791dd8-d33b-4956-af04-e8ebdf23f129", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00a36608-4860-49a7-9f92-7454b310d92a", "sighting_of_ref": "indicator--fe791dd8-d33b-4956-af04-e8ebdf23f129", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17f652c0-b7e3-4bb2-a909-8f603a6e62d4", "sighting_of_ref": "indicator--ead9d574-8485-48a9-9439-ac3b8c5a623a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--347d2429-1571-4886-abd2-ffe131988199", "sighting_of_ref": "indicator--ead9d574-8485-48a9-9439-ac3b8c5a623a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--022e660b-8879-4bd5-a52f-a35ef635dfcd", "sighting_of_ref": "indicator--7f7db883-da2c-44d2-bf03-4e9962fa5f19", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7b68506-a9fe-4263-a43f-4bde8f190a8c", "sighting_of_ref": "indicator--4cfc6e4e-f893-4ce5-89f1-ad14e42c9c04", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5d423db-b817-47bd-892b-dc76b795c051", "sighting_of_ref": "indicator--4cfc6e4e-f893-4ce5-89f1-ad14e42c9c04", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c78d3488-f1ae-473d-8732-5dd35abdb0b5", "sighting_of_ref": "indicator--a5039937-b59f-47dc-b24d-1433f59c5a15", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d43c173d-a7d9-4fb4-a7cc-0e8d0f8259b0", "sighting_of_ref": "indicator--287fe404-3d7b-4164-9b40-d2bceb20c68f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55c76433-7a98-4fb3-b9b4-c225aa48c25d", "sighting_of_ref": "indicator--287fe404-3d7b-4164-9b40-d2bceb20c68f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--218a8438-7267-4946-9e84-f7d887032a2a", "sighting_of_ref": "indicator--77c68f77-817d-4922-8479-e03a547c2c45", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e535e381-4364-414c-ab69-bb00b96ec3d0", "sighting_of_ref": "indicator--1fdbfeff-81a9-42b6-bd95-4c6bed2f4a00", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e18de8ab-cc74-4748-bc91-b08eca4ce827", "sighting_of_ref": "indicator--08110048-f477-410a-8f87-2999a576429d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9033f664-579c-43d9-81c5-187ec775d3b1", "sighting_of_ref": "indicator--2d7b8a27-0d0e-4fcc-a692-f8d5ec58f4c5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c54b5d3a-ef44-4d4d-a009-d4b4dc2fabc8", "sighting_of_ref": "indicator--2d7b8a27-0d0e-4fcc-a692-f8d5ec58f4c5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d55864e6-f427-4896-ba66-12f399c99d2d", "sighting_of_ref": "indicator--07aea0f4-85c6-4f4f-8269-cb4be34241f7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87f1956a-8338-4e27-99e9-22041470aa62", "sighting_of_ref": "indicator--ff38c387-5114-45b4-847e-1b62266c2258", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9847a7e5-13b4-4d20-8e85-7ac67ef3fa4c", "sighting_of_ref": "indicator--4159c939-3f71-4f3f-a9dd-39b29fa1157b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f60e415a-3a87-45af-a0f2-b580c391f6a4", "sighting_of_ref": "indicator--74cc3c14-8a07-44bc-b004-e371cebcde2e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c11ab9f-3027-4fce-bfc9-6857422707f1", "sighting_of_ref": "indicator--74cc3c14-8a07-44bc-b004-e371cebcde2e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44307ea5-6eae-4190-a783-22322f5b3d1d", "sighting_of_ref": "indicator--7001068a-84e2-4235-aad9-8ef42520e2ca", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24ef1974-cff0-4ba5-815a-a024e27dc781", "sighting_of_ref": "indicator--82c290f0-5c71-484e-971b-cfbd81016060", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85fb9207-f040-4109-a80b-5dfb2a862f04", "sighting_of_ref": "indicator--f4ba0d47-2a27-4bd1-af1e-feeb00873418", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c42b7f34-ded7-4c3c-8760-43a2adea00c7", "sighting_of_ref": "indicator--b51a6bc3-ebb5-4a02-a739-aaac5c4f2569", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--462e8fac-59b0-4f7e-bdd8-4401b74815cb", "sighting_of_ref": "indicator--b51a6bc3-ebb5-4a02-a739-aaac5c4f2569", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48f445d8-70e7-4f71-9d93-57eab78557cf", "sighting_of_ref": "indicator--d69465ea-6340-417e-83ea-cb706a5c6be3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69a3cf05-c4ad-47d3-8686-1b47b2f7d760", "sighting_of_ref": "indicator--d69465ea-6340-417e-83ea-cb706a5c6be3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59328ab4-36ae-4d6f-8c3c-395bc086fdb0", "sighting_of_ref": "indicator--740f7496-3d99-4bff-a2fa-87cf8ca47c60", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d6663d0-3892-480b-842d-981b63ae5463", "sighting_of_ref": "indicator--e5de1d6b-ecd8-4224-ab60-0e17c35e7089", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25f73507-fa4e-434c-9c43-d91aae8c21d3", "sighting_of_ref": "indicator--df936031-7033-42a0-868a-147d31f6d9a4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a084ef65-c221-4c1d-b02e-8a14af2ebfec", "sighting_of_ref": "indicator--ff9f4041-5830-4898-8043-bf73f6af1cfe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af58dfa1-45ff-469c-9054-69c6bc3238b3", "sighting_of_ref": "indicator--dc8cc5fa-e6dc-4b9f-a0ce-2dc5ac6bdd68", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edb5e007-3986-4b0b-ab91-7706254af4d2", "sighting_of_ref": "indicator--a9ea9434-5e6c-49a0-a43f-3076f7958591", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aba56bb4-ffeb-4e90-8e7d-c7fef85a9903", "sighting_of_ref": "indicator--4b8fd8ca-5f3c-4824-8a1b-e530e8a9302c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98a1abd9-9597-477f-bcb9-53ccea0aff71", "sighting_of_ref": "indicator--1cfa2aa2-ecc6-4d38-96c2-1a166de2883a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5afe7b7-fc08-443d-84ab-75e9961dfa98", "sighting_of_ref": "indicator--6d182e5b-5f42-4bc4-878b-3048f5dd6e92", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cf1d5a7-3666-4419-a4cf-10cfd7bf829d", "sighting_of_ref": "indicator--6d182e5b-5f42-4bc4-878b-3048f5dd6e92", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64e2c919-979b-4e2e-a512-f16f6924fc6a", "sighting_of_ref": "indicator--fa106fbc-58e5-4afe-8468-031c67c4a74b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e4689e3-480a-43fc-9b2f-624651cb834a", "sighting_of_ref": "indicator--b9bf3e3d-106b-4a3d-b28e-4a23c180812e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0f6c17e-1750-4575-9837-ff4b512f9db1", "sighting_of_ref": "indicator--60109cbe-36de-441a-9467-ab0a200c44bb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93cdaf40-c9c1-4f8d-8be1-bfcf19680c62", "sighting_of_ref": "indicator--06b05352-34a9-42cc-94d7-38c537121fc5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac090e44-1e16-494a-9b48-9af3423b2d19", "sighting_of_ref": "indicator--e255106c-5c15-47e6-b576-6af37341e2ad", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30a8d22b-9f0c-4c44-a00c-d04e39c79403", "sighting_of_ref": "indicator--8e001ee7-c568-491e-94fc-991dd0ba51e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d307923c-d6b1-4ccd-8761-4d7d068db9ce", "sighting_of_ref": "indicator--4568a1c5-717b-445c-a295-28a2986d424e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2608a36-74c7-4413-a240-7d83800cdaad", "sighting_of_ref": "indicator--22fcd516-02e7-4301-8bbe-14398a8e852b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d835e402-205f-472a-b448-361f251d075e", "sighting_of_ref": "indicator--f5c342e6-0a1a-4c9a-bc69-5782107fc183", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f2a97ad-ef4a-484b-899f-30720c36596c", "sighting_of_ref": "indicator--39b36d87-db3e-43f2-829a-440e070e5f40", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27ec689d-8fe3-404c-ac75-6541a46a339d", "sighting_of_ref": "indicator--39b36d87-db3e-43f2-829a-440e070e5f40", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81ec5b5a-594c-4726-9166-e2f98fd0cc2a", "sighting_of_ref": "indicator--9b95ab4e-24bd-4306-8783-e7dac286edf2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a8f958a-7d2c-40fd-8e2a-6fe317d49bd3", "sighting_of_ref": "indicator--04d6ebe7-0461-4a4a-8bf9-c813f38aa0ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--282c0e53-dee1-4a0e-94c3-c7a9f6e67fb8", "sighting_of_ref": "indicator--1e55950d-3810-4c70-bc81-d3178e923e0a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--190dfe2c-b57c-4222-87a1-7eb56219adb0", "sighting_of_ref": "indicator--1e55950d-3810-4c70-bc81-d3178e923e0a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34b2994c-723a-4fd5-bac1-6a2198dd1402", "sighting_of_ref": "indicator--08ef299e-607a-4bb3-8c2f-07aa2f9a2d53", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5b9fda1-8dc4-4a68-b9eb-0fb8a5c9d243", "sighting_of_ref": "indicator--c610dd49-ad69-44c3-9fe4-e3401171a0f3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73cfb855-a59a-46df-97dc-2e4711b9413b", "sighting_of_ref": "indicator--c610dd49-ad69-44c3-9fe4-e3401171a0f3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86b071c0-7471-49fe-826a-e49b01ac8529", "sighting_of_ref": "indicator--78f22173-584b-4c56-a678-e8f6ab1fb4af", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10b03079-bbef-44a6-9525-7e2f5668d85e", "sighting_of_ref": "indicator--78f22173-584b-4c56-a678-e8f6ab1fb4af", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaf25da3-1bb4-47c5-acaf-67c76b5ad27a", "sighting_of_ref": "indicator--ffc77503-3ba2-42fb-93d7-46a351e95ec5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62002876-ebcf-4bed-8cab-6bcce65de7ed", "sighting_of_ref": "indicator--ffc77503-3ba2-42fb-93d7-46a351e95ec5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca3bb404-6aa3-454c-97e6-79f104e170ce", "sighting_of_ref": "indicator--76a2fea3-d46b-4aa5-910a-0d2c8c94f122", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78d397f6-f16f-4d41-b6c5-b2b669169da6", "sighting_of_ref": "indicator--690ec5b5-e50f-47fb-88b3-5fe4de35388a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4697c87c-2b9d-4449-8f1d-1124ef00c91b", "sighting_of_ref": "indicator--0530a7df-9448-4faf-9faf-252211a37b48", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d4d27e2-882f-4b89-8a5d-7a668dc5799e", "sighting_of_ref": "indicator--0530a7df-9448-4faf-9faf-252211a37b48", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9ca4454-0dfa-4ea4-b713-04de76a95746", "sighting_of_ref": "indicator--e8c7d443-ab5b-4919-b076-b441b39b5463", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--555d46b5-3625-4eb9-bac7-04b23d6571d9", "sighting_of_ref": "indicator--e8c7d443-ab5b-4919-b076-b441b39b5463", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab6cc8df-1385-41d6-b7d1-4ce538eeb42f", "sighting_of_ref": "indicator--a7a66d60-a2ed-445a-a940-4d08bee6d283", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40074192-39f4-41b9-a9bd-b230823cea30", "sighting_of_ref": "indicator--0d7d98d1-d18f-44ae-bf6a-5c4b820e611d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cbe7f55-9abc-4bed-8c5b-92113f478aff", "sighting_of_ref": "indicator--b51db354-86ab-4e8f-a916-059dbeae1304", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e86c2095-2859-4548-a109-254dec03f9b7", "sighting_of_ref": "indicator--6e333729-802d-4849-967b-dfc5d5ef9352", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e772d93b-44da-41c9-900d-967b343e24d3", "sighting_of_ref": "indicator--6e333729-802d-4849-967b-dfc5d5ef9352", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36297711-ac3f-438e-99a4-4319b2fa3f28", "sighting_of_ref": "indicator--2445bd7d-cb13-4273-b756-866e04a4393b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1ee9bb8-82cb-44b9-9844-2ab6d1a03305", "sighting_of_ref": "indicator--2445bd7d-cb13-4273-b756-866e04a4393b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--286fc099-f0bd-4de9-8732-67cc98c55db5", "sighting_of_ref": "indicator--6464d222-5ea1-44c4-9729-1d40a89ba2d9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02b1508b-651d-42bf-aa15-b8512c059d67", "sighting_of_ref": "indicator--819c3c1e-f37b-477b-a23f-6a03061fd31f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b61a798-3998-4e6d-8abc-7500e8973ed1", "sighting_of_ref": "indicator--0f08d9bc-8d88-402d-9a2e-614f93e0e94d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66b7a041-85b9-4d33-ae97-8d794bc2cc4c", "sighting_of_ref": "indicator--23c51474-e962-47c7-a14e-1dd40e109be6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56d45802-bd17-4ef6-94bf-0dc176f37f87", "sighting_of_ref": "indicator--d86d86cf-e5dc-4098-8a2c-cd9105a44ec4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f63aeb5-9722-4a9d-8f43-92abec84dfd7", "sighting_of_ref": "indicator--b412d031-f636-41b2-b0d1-27fb4e4dabc9", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4c14d64-3778-4a20-bf31-9b34f0e7f0a0", "sighting_of_ref": "indicator--b412d031-f636-41b2-b0d1-27fb4e4dabc9", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1ff620d-0c77-42bf-8fae-105f8c0f7858", "sighting_of_ref": "indicator--b412d031-f636-41b2-b0d1-27fb4e4dabc9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15fc1c64-00f6-4e05-8a22-166e927340cc", "sighting_of_ref": "indicator--b412d031-f636-41b2-b0d1-27fb4e4dabc9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a1d256d-aa8f-415f-a3e3-6cdc6402c7cc", "sighting_of_ref": "indicator--b412d031-f636-41b2-b0d1-27fb4e4dabc9", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--532c4ec9-db85-4eb7-b35f-21e76b477cec", "sighting_of_ref": "indicator--f6d24a31-c638-4846-bfe9-59aee08bde9e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8e2d6bf-d5e2-4c24-9ebd-c73ca0f3f1f9", "sighting_of_ref": "indicator--baf6f7c9-a995-43b6-b373-c846af2cbaed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--395b6582-3a03-4d72-bf92-9d2a19f5229c", "sighting_of_ref": "indicator--d83f7cea-3f0c-49d2-8a88-cab21c0b023b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2656df8-67a1-46e6-9a5d-1f32ae55e974", "sighting_of_ref": "indicator--955f8e30-cbef-4389-ab3f-73a7382e3258", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--484b00a3-b1dd-47bb-8ea1-910b23ced477", "sighting_of_ref": "indicator--da5a7bb0-e6b6-47cc-983c-f92901e331e3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb6da4dc-7b6b-4343-bd6e-6f7972c7278b", "sighting_of_ref": "indicator--11841e88-a7ed-47f2-8183-824480f3c4c6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0205c22b-ee59-47c8-b8bf-49db5d334974", "sighting_of_ref": "indicator--732a4871-80d2-4b34-9932-7502bd6eda2e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2579148-89be-4fdc-8b67-0b32a1232c23", "sighting_of_ref": "indicator--3c139a4d-e32d-47c2-8598-8d33702cedab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f206a488-8e01-465b-8613-7919c5005f28", "sighting_of_ref": "indicator--a9464573-37ec-4a66-8412-86d65d8f14df", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2e0211b-d9e8-4391-a06a-783466570e67", "sighting_of_ref": "indicator--a9464573-37ec-4a66-8412-86d65d8f14df", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29fd0c72-3bd6-4c7d-82d1-2d4923c9dca4", "sighting_of_ref": "indicator--58befedb-d230-4c3e-ba76-ba64f230b7a1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c6237a5-7322-4fcd-8f5d-d9a8751cce0e", "sighting_of_ref": "indicator--58befedb-d230-4c3e-ba76-ba64f230b7a1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fba8c3c-f0cc-4f36-9588-f07c3a6c4a3b", "sighting_of_ref": "indicator--c755effa-d44f-4a3a-80ab-61924a255c35", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fbebc6b-8236-4231-9fe5-7413f7bdc58f", "sighting_of_ref": "indicator--39fcbc8a-57aa-4f31-80a7-9754ae256662", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff2da577-10c0-4719-b74c-851d37755cbc", "sighting_of_ref": "indicator--ff8bbf5d-a517-4c75-a80b-f0b2f161d7ce", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09f678f7-1b96-4fb8-adcd-2ee4f4dd3a25", "sighting_of_ref": "indicator--a052e132-a10c-4f52-827d-7e777bb70a96", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fc3f55e-51e6-4424-af8e-39de5cc87486", "sighting_of_ref": "indicator--a052e132-a10c-4f52-827d-7e777bb70a96", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cbe3dd5-ee96-46f3-bdfe-73f37b49f057", "sighting_of_ref": "indicator--d21ff0ee-6d92-4fb6-98e9-125b12c2ccb9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ad17c92-9b6f-42fa-b420-7ab408a51322", "sighting_of_ref": "indicator--d6301f63-ef19-4a1a-8b7b-ad8f0343c750", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51373df7-eb1f-439f-8fa9-c07bed6f0e27", "sighting_of_ref": "indicator--582f12a3-12e5-4721-bfea-ebab75789df2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f65dd4a0-250b-491b-bd03-c6ecf258bfe5", "sighting_of_ref": "indicator--157eb524-6f42-4beb-a0a6-51b2e11fe6a5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff68be92-3ff2-487f-8892-495a49dfd171", "sighting_of_ref": "indicator--056fd635-da2a-49f0-9358-4c4f28a305d8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99d531ac-41ca-4023-b1a3-28f30f6a1b47", "sighting_of_ref": "indicator--2f5b992d-81ed-4c2a-b649-37d217bb4a8b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a181a824-bbdc-4d53-8961-d0ba6744a0e3", "sighting_of_ref": "indicator--74d0e539-1c5f-40eb-b39f-9cec5737da82", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0619c317-60cb-4c65-a221-a4eee965dd09", "sighting_of_ref": "indicator--07e452b4-e66c-4901-8b34-8732761ef126", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9c08155-9113-47e0-a046-6a62a2e61fb5", "sighting_of_ref": "indicator--c128daf2-75f8-4bf3-90ae-f7357705f83c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98d3f7ef-9b90-4483-8c7e-d271cfcc84a1", "sighting_of_ref": "indicator--ff7bf118-3cd1-4f4e-88b5-3cf8e6b02ddc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13132135-8b2b-460a-b9e4-445132c66f5c", "sighting_of_ref": "indicator--193e889b-f98e-4764-a963-ef29728c603f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--334be486-3cd5-4110-b047-7e5d8932de1a", "sighting_of_ref": "indicator--d7a0d60a-001f-44bc-86e7-530e65ff40c9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5d914a9-1986-4884-9ff4-a911ba105230", "sighting_of_ref": "indicator--29299289-abf2-4fb9-a1b3-08cc3e7f40a8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab0da7eb-f7a2-469b-8dd4-6a34e7fb6c5c", "sighting_of_ref": "indicator--1f0fb6ea-0ca5-47ff-a579-a136e3337b1e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b7bd914-062d-41e3-9dcf-ffb634ebbd03", "sighting_of_ref": "indicator--1d2f0ff9-4f3c-4a75-a4ca-5a1d3ab88fb2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c23a8cd8-d0dd-41c4-97c4-d4880e040934", "sighting_of_ref": "indicator--671c5311-e4c5-426c-b774-9a5cd4a95d54", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c829ac5-58d7-46af-8451-87a6a8d60059", "sighting_of_ref": "indicator--c9d14d98-9917-4ab7-9ff3-937aa0bad138", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5b375f5-73d4-46a1-bce1-123a02fdd4dd", "sighting_of_ref": "indicator--4ec63860-86d1-4db3-9816-c13cad148e58", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1af046de-dce9-4918-b3bc-6a8756901132", "sighting_of_ref": "indicator--1e88554f-f50f-44b7-b2e4-16b8fe538e87", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5ac6b8f-050f-46a2-be6c-8224e285a8c6", "sighting_of_ref": "indicator--e6262f79-4099-49be-a06f-6f5ca6b9d5a2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7eb5dd69-12f2-4445-bdd9-d3166183033f", "sighting_of_ref": "indicator--f890b722-095b-4844-87a3-abee830396e2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67a2827d-976f-4909-bca4-448ae0494672", "sighting_of_ref": "indicator--4cc57cbc-a620-4cf0-b388-5c1f108c9496", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e1e74c4-2c46-430c-b13e-4e7b0c1440ef", "sighting_of_ref": "indicator--4c4c2d20-d5e6-4679-aba6-a8729fcec3fe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d50ff549-7e14-4138-bb14-306cfb5deb20", "sighting_of_ref": "indicator--96c6ff44-21f9-4435-945a-4b995a438627", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa27b091-0758-44e4-8f19-cb3912ee7659", "sighting_of_ref": "indicator--2e77f401-b419-4fac-ab03-c47172c0ad4a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83ce7769-2756-4e91-af08-56dccdba3293", "sighting_of_ref": "indicator--20d2ce7c-bef4-47f7-93fc-349609b8cf9c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a7d26f8-3382-46d6-8cd1-9e7ee2b0ed5c", "sighting_of_ref": "indicator--a26bd85f-af55-4672-b492-ed35a2ad1ff8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--628df037-52f1-464c-acaf-2e05791d425b", "sighting_of_ref": "indicator--5892c873-4aca-4a64-aa4a-60fa647bb9cb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a093c0d-ac8a-4693-8868-bd34a94e1957", "sighting_of_ref": "indicator--c3ad58cc-5fa4-4e77-bc44-37aba0c4de70", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cbf7059-cbbb-428c-a5d3-2c7a1c47f814", "sighting_of_ref": "indicator--c3ad58cc-5fa4-4e77-bc44-37aba0c4de70", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb2bd953-523d-4f1d-8fb3-59247cd38b35", "sighting_of_ref": "indicator--d3076a26-5d87-43d4-a9bc-cfe284547960", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7509af0b-abfe-4e98-910a-faeac6fb7489", "sighting_of_ref": "indicator--d96f175d-4a54-4323-9923-9e2345e5982c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8362c58-d09f-48a3-8cfd-33a1c338f8a9", "sighting_of_ref": "indicator--d96f175d-4a54-4323-9923-9e2345e5982c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aec17cd9-8260-4f65-830e-59d44b2494ab", "sighting_of_ref": "indicator--ead5c424-41d6-4224-8a82-e79e08c0b728", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c428b030-4027-498a-8c3f-0cc773ba3f37", "sighting_of_ref": "indicator--22b8b0f0-3db5-4f59-be13-003748c91b8c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d0cf1cb-b37c-45bc-bcce-e2379140f383", "sighting_of_ref": "indicator--a11558a4-30a0-44f6-9625-f46354d7a282", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--566c58b5-06ae-4a3c-910e-a7d72daa928d", "sighting_of_ref": "indicator--a11558a4-30a0-44f6-9625-f46354d7a282", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77a28f73-41ce-43b3-8f57-d87bfdd4eb81", "sighting_of_ref": "indicator--5e8234f6-2fda-4386-997b-b22d87355d0b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2cfd445-4bc3-4a85-96a0-b5a24b1b5737", "sighting_of_ref": "indicator--53b792c8-086f-4849-8ba8-c22845da1475", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a340b095-50ef-47de-82ef-8b025f07a849", "sighting_of_ref": "indicator--53b792c8-086f-4849-8ba8-c22845da1475", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c4b2362-7a25-4c64-98c0-53fefa80c4ad", "sighting_of_ref": "indicator--7bf03c07-d55a-4268-8ae2-eee5e05801fd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--625d0e61-cdf0-4fad-b702-aac92a580879", "sighting_of_ref": "indicator--7bf03c07-d55a-4268-8ae2-eee5e05801fd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de575f5a-3adf-419f-b850-82db1802ec3d", "sighting_of_ref": "indicator--31de6431-277e-4cae-a06a-dd7819fdf666", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad16b8ea-7352-47fd-9f91-1505568475ba", "sighting_of_ref": "indicator--31de6431-277e-4cae-a06a-dd7819fdf666", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--217416c0-06ef-4af5-b415-7e564ca9d67a", "sighting_of_ref": "indicator--c393b792-40c0-4f07-9589-ef96608a5b14", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fec3a095-ef2d-40a0-abc4-118d65124641", "sighting_of_ref": "indicator--c393b792-40c0-4f07-9589-ef96608a5b14", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fe3b69b-0bf7-4cee-bdce-4615eacc772f", "sighting_of_ref": "indicator--79ca49ca-2b4c-4441-a86e-5462aba43d02", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--086f0a17-3111-4b75-9332-1adbde11ab4c", "sighting_of_ref": "indicator--79ca49ca-2b4c-4441-a86e-5462aba43d02", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9a5bb13-9ca9-401a-b722-52e243b7e063", "sighting_of_ref": "indicator--8b790f4e-4d77-467c-b037-c4db14a3ec76", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33001aa9-ce9f-4657-b6d4-c7e46c76cacb", "sighting_of_ref": "indicator--fc2b716b-c989-4e52-9b4c-f42f24057281", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--148d24ae-d10c-4a88-9a7a-6ade48d4d286", "sighting_of_ref": "indicator--a7b05684-aeb5-4d08-bcef-005fd665053f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7527798-3f65-4f4e-8b1a-b65173de9116", "sighting_of_ref": "indicator--a7b05684-aeb5-4d08-bcef-005fd665053f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25288a16-b60e-44e6-b2ab-a529c9e73e75", "sighting_of_ref": "indicator--1b597956-a222-432c-9642-0727836088fb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d7e7631-0eef-40de-8cd4-a2c850218e7d", "sighting_of_ref": "indicator--efde8c96-33d4-4fd4-9d3c-f63baef77708", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3bab1e3-7f7a-46bf-b668-91c4679e7593", "sighting_of_ref": "indicator--6c237758-9572-4adc-8dfc-3cd2a3b923fe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8efa8c75-fcc6-44a3-a2a4-35bfdabe1984", "sighting_of_ref": "indicator--6e323446-3c15-43d4-adf1-5f30ffcdc5d8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98a5056b-fb5c-44e4-9e48-3824f6616532", "sighting_of_ref": "indicator--6e323446-3c15-43d4-adf1-5f30ffcdc5d8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e1fae75-f7d2-4c33-8170-0a8c441ef843", "sighting_of_ref": "indicator--9bcd5fc8-2e4c-447e-b452-37268d7f81fa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afc137a9-21af-4d85-ae1a-d7edeebfc328", "sighting_of_ref": "indicator--9bcd5fc8-2e4c-447e-b452-37268d7f81fa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2a101fe-2674-4bc7-a82b-7d0d40a40ab3", "sighting_of_ref": "indicator--32156fef-2bca-4762-9d67-887d37f379ad", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4461922c-193a-43a1-a4f2-e50f2932868e", "sighting_of_ref": "indicator--96b93e5b-b973-4b19-96f1-3b6fd8da4142", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e671322d-3bdc-4651-90e7-78ec0b4516d5", "sighting_of_ref": "indicator--41e1a1fc-7205-4041-9d7e-7165e6bd5ed5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c7ce91c-8ae1-4985-8f66-b52f1c23e699", "sighting_of_ref": "indicator--1c96127f-598f-424f-b76e-1a68cebc3561", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3ebd502-7909-48c2-a6f8-5c8084e788d7", "sighting_of_ref": "indicator--1c96127f-598f-424f-b76e-1a68cebc3561", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea63da11-3698-41ec-8bb0-a62f61cf985f", "sighting_of_ref": "indicator--41fa3c1a-4418-4c53-83c1-8c26bbbbcc79", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fcf5fef-ac2c-44e1-94e5-559aad13b7af", "sighting_of_ref": "indicator--41fa3c1a-4418-4c53-83c1-8c26bbbbcc79", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--991eb47f-b4e0-4770-8e5a-e2b80ef239c0", "sighting_of_ref": "indicator--ac35e619-59a7-4c11-9e13-9f19f949d771", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89c4e741-3322-4def-98c5-b79f19a37271", "sighting_of_ref": "indicator--308f5351-94d0-4fcc-b884-96def62df2b3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b461e7b2-41b7-41b4-a224-e129184c5f5a", "sighting_of_ref": "indicator--2af6da8b-eba5-4d10-a795-77dce375299c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72681bdd-0313-4f61-89e7-7494f9bd8039", "sighting_of_ref": "indicator--2715da06-7c6d-417b-8116-5e33a63f146c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60af88c7-d0f3-45ab-8b24-b3ff3950c2de", "sighting_of_ref": "indicator--5be9355f-f2c8-4a74-a90f-fa1fe868e6b4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d1a58de-09f8-47f5-94c1-5b7e57918bd5", "sighting_of_ref": "indicator--37c1747e-981f-4eae-90ac-b3aeb1f73edb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89a9ed94-b53c-4836-8e71-de0d10e856b6", "sighting_of_ref": "indicator--42174a24-05e2-4cb1-adfd-a66a7eb4c2c6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bd56af7-e466-4aef-8ae9-d0183da704b5", "sighting_of_ref": "indicator--42174a24-05e2-4cb1-adfd-a66a7eb4c2c6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18ae7d8e-d6b2-4554-bbfe-113c23b44c26", "sighting_of_ref": "indicator--1308edad-d890-475d-bac9-5022b4cd7f01", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a981517d-209a-4829-a41f-2d46eff9dc65", "sighting_of_ref": "indicator--1308edad-d890-475d-bac9-5022b4cd7f01", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7073f6a-04b0-4462-99b7-54aae9ffe9df", "sighting_of_ref": "indicator--e972f5d8-7fe9-45e7-ab9c-1f9e87c9bf92", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3557bbb-745d-4586-8586-4d89d8a701c3", "sighting_of_ref": "indicator--e972f5d8-7fe9-45e7-ab9c-1f9e87c9bf92", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e060867-3fd3-4991-af26-045d57e65b2a", "sighting_of_ref": "indicator--cdbfa711-3954-4e80-9e62-5c77e4779719", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5854075-5e86-4435-93f1-25a086290c79", "sighting_of_ref": "indicator--79d86595-2301-4a52-9ef1-7eac757bb23c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f0bad1f-4ceb-4d25-ac84-2f1892dfbce4", "sighting_of_ref": "indicator--0d6f66f6-eaa1-409b-bb41-894fccc27b2e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36820443-084e-4141-9ab2-ced28a9a3c75", "sighting_of_ref": "indicator--61e01852-3e32-438c-820d-5ecc7c60f2cb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fabbf62-1ff0-4e76-9ac9-773ebd5d2d43", "sighting_of_ref": "indicator--d6443bfc-c83a-4c8c-947d-10a673a50f35", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ede7431-da75-4d5c-ac58-c8f32bfc73f5", "sighting_of_ref": "indicator--d6443bfc-c83a-4c8c-947d-10a673a50f35", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--826c8b3a-5bf5-4dac-992e-d98ca15a3dc7", "sighting_of_ref": "indicator--aa8c0350-7d0e-410d-a7ac-4d7b6425ecd4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ced67f7-1b03-44a2-a5bf-688abcb5754d", "sighting_of_ref": "indicator--aa8c0350-7d0e-410d-a7ac-4d7b6425ecd4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea14455c-0097-43bd-abcd-23d546b4f15c", "sighting_of_ref": "indicator--7d8810bc-90ae-4ac1-aa54-ee7f522a5563", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8ae0484-aae9-4e95-b77f-855c0bfcc2c6", "sighting_of_ref": "indicator--67d2c4fa-70ba-4066-9e91-31aeba3d2994", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3993954b-8043-4abf-bef0-d28265ce5f58", "sighting_of_ref": "indicator--2a342afa-9925-4c0d-a60f-4302f98d689d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c05cc018-1f5d-4dc7-a91a-243a589322ec", "sighting_of_ref": "indicator--2a342afa-9925-4c0d-a60f-4302f98d689d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9bf65b1-54f6-43c8-82fa-aaf0e8794bce", "sighting_of_ref": "indicator--3d1f2619-d868-4a03-a11e-f61bacdc99d5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07be0045-6d79-4077-8cf0-6974137f8b96", "sighting_of_ref": "indicator--3d1f2619-d868-4a03-a11e-f61bacdc99d5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ada16d77-f126-454a-8ba1-aa66559e2c94", "sighting_of_ref": "indicator--b5bdd85e-fd76-49e6-b4c3-b934a48257dc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69600a49-250f-4827-969d-6765bc54549a", "sighting_of_ref": "indicator--899f959c-f8c6-4830-b9b4-f063479abb58", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d23f0128-9ef2-4fc0-9f3a-5360f0437c5e", "sighting_of_ref": "indicator--c4044905-6390-49d5-bc6e-b952eb9263c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b197ecf6-d2dd-42f4-a2d4-b3d403455d85", "sighting_of_ref": "indicator--31fdaaa1-d85a-4d3a-918b-dc65e4f25f12", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdea0764-ce1d-4b8e-945e-ba993e765bfe", "sighting_of_ref": "indicator--5e005593-b353-49a5-b2c5-513fb8dc46d0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca41735c-3f74-4f94-b691-9d5998c9a8dc", "sighting_of_ref": "indicator--6ae6fe94-508b-492a-be47-854c8083c8cd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc6cd52a-f6f8-40fb-bc9f-f98c73cea98c", "sighting_of_ref": "indicator--9f90e982-b636-471c-aaca-46b2232471f6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bee3b2d-a817-46eb-9489-bf31fcb884ef", "sighting_of_ref": "indicator--202bf79e-5e48-428b-aee0-ec241a0a3c73", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83d8940c-318a-4b25-b948-bd02047e7708", "sighting_of_ref": "indicator--64c5a273-bf3a-4b1e-b8c2-6bf88cd271ae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb589b2a-b778-4a48-9d53-8c59b5f40923", "sighting_of_ref": "indicator--64c5a273-bf3a-4b1e-b8c2-6bf88cd271ae", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0364f19c-91b1-49eb-8e96-bc8fd0c69f00", "sighting_of_ref": "indicator--aa2bab34-99de-4d95-a3f9-866a481298d9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44e78a01-8f98-4079-a43a-c84aff6d141e", "sighting_of_ref": "indicator--aa2bab34-99de-4d95-a3f9-866a481298d9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53104053-7502-4f2c-ace1-be545f3dfe8e", "sighting_of_ref": "indicator--9e905030-58ae-4ed1-90e9-a672de722f32", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a025cb6-086e-4896-bbcb-4df278540caf", "sighting_of_ref": "indicator--bfd473ce-f46d-4487-828e-c901b2f4e2b3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--169795cd-f8bc-4a4b-a550-0e11c850d0f6", "sighting_of_ref": "indicator--cafdec61-925e-4f51-abff-41f457da453e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e56338dc-ad86-46ee-9174-bed34bd3db5c", "sighting_of_ref": "indicator--cf754064-ee10-4b86-9905-ed09525a3409", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d0ff3d9-ed4e-4516-8602-edb7298f5a7f", "sighting_of_ref": "indicator--8976d8b5-2abf-4bbe-98a6-d76523711b9c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df763373-e885-4756-a01d-89e38afac9fb", "sighting_of_ref": "indicator--b6f944d3-1521-46f6-bd6c-bd155a7abe8f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5159c87-8d6c-4413-a228-91bacbec04ef", "sighting_of_ref": "indicator--b6f944d3-1521-46f6-bd6c-bd155a7abe8f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72a4b3e9-0f0d-4d60-b302-d8583e13f7db", "sighting_of_ref": "indicator--ea6392bd-6ad7-48d0-9488-690c8f355698", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a31ee64d-ef6e-4704-935a-35e602d732d3", "sighting_of_ref": "indicator--5589ebbe-8a57-4311-9c1e-4c6754264310", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e962125f-8e1d-4e1d-ad6a-f0cafadb52a3", "sighting_of_ref": "indicator--5e49ba4e-e7fc-4365-af5e-44b308151138", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a63b70f4-9208-4791-a14e-c2f1e5d5ff9e", "sighting_of_ref": "indicator--b2aef6f8-085d-46d5-9ade-c81e5110bdb6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87993c6e-4627-498a-b4d6-2980b6850260", "sighting_of_ref": "indicator--e863bf6a-a1c2-4d04-b3c5-0db843c125b9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aece4173-d95e-4198-8480-bfcb2724b10d", "sighting_of_ref": "indicator--13a5b575-b17c-4512-8411-0f4fe526f863", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72f45b0d-9466-401e-a700-eac0ca505fb0", "sighting_of_ref": "indicator--c74c5e00-5005-423f-817f-7df0b453a7de", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e006845-bbab-4620-be51-4df3d4083987", "sighting_of_ref": "indicator--70ba420a-a9f8-4583-917a-28d936103a08", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--047fef79-c234-43af-97c9-80800b179842", "sighting_of_ref": "indicator--adea3e39-51b8-49d0-b1a4-79ede020f8e9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d31791a4-6983-492b-9b83-5fe80153b45a", "sighting_of_ref": "indicator--ecdead00-cc25-4f23-9718-559cdf83cf73", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abf1ea71-b0cf-4d5e-8a4d-57b636866153", "sighting_of_ref": "indicator--e506d313-04e8-4fc6-baad-3a1502d6af86", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60bd5734-88ec-45a9-9c64-1f63112a51a8", "sighting_of_ref": "indicator--197bfdc0-2482-468e-bbe8-db1fbd6d870e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e15e404c-732e-4afb-b065-9fc03353bda8", "sighting_of_ref": "indicator--c2e95f15-1d64-41ec-89f6-d510e57e54ce", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbe2b228-bd8a-4020-a0c0-1137b0aa18ea", "sighting_of_ref": "indicator--744a173f-41f6-468a-84db-ee7e512a5bbe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f83d1704-b79c-4e75-903a-9d362e918006", "sighting_of_ref": "indicator--7f14146c-8f6c-4478-9c2b-4d9301d43228", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b4276f1-a1c0-4ba5-b19f-db0b65659943", "sighting_of_ref": "indicator--49148d5c-b311-4a62-be6b-45007c5c6ef9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fbea4b7-5586-4c03-aba0-1a6ce3ccd4ec", "sighting_of_ref": "indicator--49148d5c-b311-4a62-be6b-45007c5c6ef9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab4bc317-f5bf-4712-942f-572b394ab54c", "sighting_of_ref": "indicator--385d4bf3-cd42-4500-b55e-bf1bd7a869ea", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a213c85c-f047-4a02-b6ee-c8b6b3ea15a8", "sighting_of_ref": "indicator--0e43aad0-dabe-4fe2-9497-cfc48eb69f0f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4d0125c-e43c-4931-8719-fa99dd50b7e4", "sighting_of_ref": "indicator--ea62b5dc-f662-4ea6-b7dd-2ad28c6aea72", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1956320d-6912-4460-b5e1-217777a35a7b", "sighting_of_ref": "indicator--00f21374-094e-43c7-b9a0-5f43d482fb11", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f658ad5-a63b-496b-a0f6-52555bb274d4", "sighting_of_ref": "indicator--606eea74-77f6-4423-98a5-2271f724cfde", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cdb8bd2-953e-43fa-bab6-9a953838aa50", "sighting_of_ref": "indicator--2baffa69-3089-42e3-bcd7-ef19777c008b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28c34c4b-ba0d-46d2-9da7-b7497a328def", "sighting_of_ref": "indicator--3ea1ec13-a0dc-4537-a4b1-bd834141e958", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83c87687-c6c7-40b0-b5d0-706c74145485", "sighting_of_ref": "indicator--f29da613-34d9-4ebd-b743-e6f78dabddc2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2392fbea-7f86-4053-9af1-663bed31164a", "sighting_of_ref": "indicator--6870246a-38d8-4751-aa46-06a40c17cdd6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d9c0aea-0c31-4541-bb67-4cedd9c2a374", "sighting_of_ref": "indicator--8e8c15d0-edb2-4f23-8eb3-20bb12bb2702", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3acc0c1b-5a86-42aa-97a2-23b7ee55ee19", "sighting_of_ref": "indicator--80a35a3a-8469-4dde-9195-a280726851a7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2b6227e-25d4-494c-83b3-08c7e840e694", "sighting_of_ref": "indicator--1b8d7f52-f193-4349-b1b2-5bade3dffe75", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23e5d8cd-0e96-451f-a34b-92fc52e7d01b", "sighting_of_ref": "indicator--5a343117-f569-4f92-bffa-754de43392ea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c72668ea-5bcb-4415-9cb5-7960c6b321dd", "sighting_of_ref": "indicator--b8bc6a36-707c-489f-9434-f94c3b728b8e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--795ee12a-a728-4d26-88e9-aa25ab02aa03", "sighting_of_ref": "indicator--60dfd46f-8804-449b-8a13-66a9e95d1673", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e56226b8-d937-426f-a82e-fd4b227e63ad", "sighting_of_ref": "indicator--130fe905-55d8-4c00-9fe3-fdc18843c650", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--150e7669-9e18-4b2a-80ad-2808a0dfc40c", "sighting_of_ref": "indicator--f79bbe92-9f16-4185-98fb-26fbe88c2f9c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b7c91c8-2dee-463a-b60a-8a611dcaa516", "sighting_of_ref": "indicator--f49e8449-e0fc-4b09-8992-c7860c8ccf64", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb97e89a-547e-4c40-83a0-8911d8983c7f", "sighting_of_ref": "indicator--f562e8b7-50cd-43e4-9e3e-a6fe12503dbf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32a899c6-035f-44c3-9492-42661f0638d1", "sighting_of_ref": "indicator--ebfd8e64-0d95-4304-a61f-b0b3f4563d7c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae2c9d17-7fc4-4b6c-8dee-9754081ab8d6", "sighting_of_ref": "indicator--0a062626-9d69-4b0a-9ca5-f42aaa2d2716", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80a96316-5008-498e-ab3d-d35b10001313", "sighting_of_ref": "indicator--03f3c396-cd3a-403e-a4a9-fd3441b3303b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d79fe22-c3f8-48a1-8418-4d2c4c793354", "sighting_of_ref": "indicator--92ac17d6-11df-4f1d-aad0-4c3e4505b41e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2d1142f-5817-44e0-920a-7ca4e47945c9", "sighting_of_ref": "indicator--6a7070b2-77dc-4d7e-9249-88e497b17620", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96c61ffe-dd33-4c82-bc79-65919928aa77", "sighting_of_ref": "indicator--6a7070b2-77dc-4d7e-9249-88e497b17620", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2aa64945-c3ad-4cf5-b1bd-89d4c2bc62a0", "sighting_of_ref": "indicator--1a88734c-9315-458e-a990-a67dec054fd3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91277aa8-af5d-45bb-ae61-dadd9242ef22", "sighting_of_ref": "indicator--76bd4fc2-48ff-48b8-9d81-0d17399256e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c55b1e6d-46f8-47cd-91b0-67ee965494dd", "sighting_of_ref": "indicator--73416d20-74e5-4776-92c4-e5b8727a82d8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50de8b54-883b-4584-94ba-1b66ebf963a0", "sighting_of_ref": "indicator--1b32c891-19b9-4703-8056-4b8934a3934d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2961f7d8-d8d0-4adb-8362-c0b54c1c1895", "sighting_of_ref": "indicator--26a88e8b-d295-4443-b276-307d20836a47", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7320dc7b-94e9-4bee-853b-cedc0573a8f1", "sighting_of_ref": "indicator--045dce9e-b281-4cd4-a5ea-07ceadbf8898", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7919b18d-2df6-4ff7-a044-b8563cbe73eb", "sighting_of_ref": "indicator--a3c7016f-7b78-4815-b1fb-b7cf62745531", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eac9386d-b151-450b-a721-98113dd169e6", "sighting_of_ref": "indicator--547c8f24-4330-4931-beea-6388fe1890c2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e693b0d7-9221-4a5d-8088-e9fa6cb83842", "sighting_of_ref": "indicator--7f97d626-14e6-40b0-86be-d88407bf03ce", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a01174d-4431-4e07-b846-4caad8b836fb", "sighting_of_ref": "indicator--a4c9a116-da34-4d53-b595-5abd7428f283", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79ee2447-3048-4a05-8e2b-27322fc32960", "sighting_of_ref": "indicator--2dd10ab0-9afd-4851-87d2-d36b5bf5b0c3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c955b94b-c920-4c34-a44a-73c281e2e53f", "sighting_of_ref": "indicator--fdea05b4-de25-44da-b7e7-471e8d79b59d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc448e7c-2759-4ff0-8752-fc4a2c4a489f", "sighting_of_ref": "indicator--a3ca2531-1e03-4d6f-982d-41b5ac5e1237", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c7ea7e6-7acb-456f-9539-4c5bd5b44a7a", "sighting_of_ref": "indicator--dad9dfd5-861c-4aba-bb80-21546e2081cb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--272b4102-bd35-4d7d-9559-efc90685aa0a", "sighting_of_ref": "indicator--a3132ce5-d141-4399-ad73-b15eca393a60", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5507dc55-33f9-4f8f-bd22-fe3e272bb422", "sighting_of_ref": "indicator--1ed3d7b1-7990-4153-a59c-9215462c1fa6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c9ac7ff-ae7f-4b3c-9d87-2c1d0fb25c4b", "sighting_of_ref": "indicator--90d02314-14c1-42e7-9742-3cb56c0092d9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57aa903d-8684-4160-ba76-d408d6e247c2", "sighting_of_ref": "indicator--8aba008f-f5dd-4415-a970-80d1a9a8fd7b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--701efe97-4919-47ae-a188-7b243c7f253f", "sighting_of_ref": "indicator--7cb47c99-02ef-491b-a4ae-40074097af25", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d05e097-fb41-4107-b4a6-78662fc0a9ea", "sighting_of_ref": "indicator--7bed4796-cf58-4a93-a40c-5efdb4280e60", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f9a585a-fb36-44b7-abee-05e46a85efc7", "sighting_of_ref": "indicator--eaedd405-08d4-49b0-95ef-adb087a7748a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--910b7847-c726-4aa7-b904-34dfb3ecb00c", "sighting_of_ref": "indicator--54749a68-0de5-4b87-9ea8-2bc556517df9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6abdaac8-ecba-4c72-bba8-9014621217c8", "sighting_of_ref": "indicator--d720e625-b5c0-49a2-a307-ee14c7c7f7aa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fe03fbb-9d6e-4473-9cfa-989df7806239", "sighting_of_ref": "indicator--8b00670b-2e7b-4b16-ac2c-1bde4e74e2dc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3deee054-27f5-471e-b785-7b7850dde3d8", "sighting_of_ref": "indicator--fc967e3b-047a-4aff-9e53-0093dd3fbcac", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a065629-c234-4011-8bce-91aa6c0caa75", "sighting_of_ref": "indicator--fc967e3b-047a-4aff-9e53-0093dd3fbcac", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78fc4085-7478-4636-9c84-6b7e6b8e7ae5", "sighting_of_ref": "indicator--dca87105-7840-47d3-8a25-275598ea23dc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a990fb39-eeb7-4292-951b-c51255509615", "sighting_of_ref": "indicator--f4d7d638-b80c-4e5c-9051-92596b1edfc5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8330ac0c-ca0e-4edf-9a39-8850e8597d2e", "sighting_of_ref": "indicator--f4d7d638-b80c-4e5c-9051-92596b1edfc5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ce20990-9938-4b77-a642-699f4c337c7a", "sighting_of_ref": "indicator--f65ca87c-3168-43ca-935f-42d6e47c2e30", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8eb63ebd-2582-4479-9344-d027d1183ac8", "sighting_of_ref": "indicator--7ef5f05c-fb96-45e2-a475-5ccb8d0fdddd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c0d976f-669e-4bda-ba8b-072570cda785", "sighting_of_ref": "indicator--a1c8187a-eace-4b20-ad58-49aef7f586c1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8e35db3-56c9-4098-9ec7-237203de1e5a", "sighting_of_ref": "indicator--5779bfd2-a286-4df8-bc0f-ff5a761917e3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--751dedab-2424-48d3-bd5e-ab2ee8fcadbf", "sighting_of_ref": "indicator--f9170a36-cb00-4493-842d-fcf449dcb3d7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--811cbd1c-d004-45c9-8048-debf713d2c7c", "sighting_of_ref": "indicator--af404e73-385b-4189-9b46-079b55372feb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e23f39f6-85f3-4115-8a47-dc1cf4505f9f", "sighting_of_ref": "indicator--3b5c44ac-4f26-452e-ab22-166640ed0ab0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6de4cc8e-843d-4e62-8c48-617d5865aaaa", "sighting_of_ref": "indicator--561e299f-a0ef-4f42-8268-4fb673e5bab7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fcfd7ea-6021-4ddd-9976-b03c0c9a35cc", "sighting_of_ref": "indicator--1470f650-9ee7-475a-ab54-dbb0a2c459f5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e0efe17-7d9b-4c55-9879-a698cd8131c3", "sighting_of_ref": "indicator--6164ab16-dc67-4228-9045-307d15d8a9d5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3af41f3e-6757-47c1-8d8f-2c7d688a23ff", "sighting_of_ref": "indicator--b8c56e4f-832f-4ea8-95d9-18015e5c3bc9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6f91dbd-fbc6-4c46-8924-c80649b93236", "sighting_of_ref": "indicator--5a40ee96-8986-4722-909d-25a5eb007a68", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c74e2806-5592-4c0e-9863-ac6c299d062b", "sighting_of_ref": "indicator--de1c1705-dfe1-41a4-9fda-9102fdc7eff8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6a92bfe-1e6c-4330-bbe6-e8cf89973ba5", "sighting_of_ref": "indicator--b271422a-9c66-4b30-b56d-855c97664130", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--095ea51b-19a0-4253-9f5e-33cf680fc697", "sighting_of_ref": "indicator--ca648b5e-5cea-40d3-a497-8d8fcf31b123", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15c5f247-4a69-4f8e-bd61-dba482c7ec8a", "sighting_of_ref": "indicator--b97b7db5-224b-47e2-8d14-24aaab48ec2e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98ff089b-2095-4475-ab92-85207ed45437", "sighting_of_ref": "indicator--e2dc2d83-5775-4b02-bbeb-505ffa450625", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6b9534b-46f7-4bf1-afec-2c1b3cb8edcd", "sighting_of_ref": "indicator--91e6850c-cbb5-4044-ba25-7a493f2cfd49", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b59b765-aab3-43bd-893e-fa1138d033d8", "sighting_of_ref": "indicator--181a60cd-555f-490f-b734-8c29d5d24506", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--316f6caf-df5d-4029-b674-fbc4a2332fc2", "sighting_of_ref": "indicator--db1cf4e4-2e11-4c61-b49d-44c4ee93d864", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd9b2a94-32b7-4212-8e6f-ff62e2c86fb0", "sighting_of_ref": "indicator--7920213d-e92e-47e1-93f3-03e5fca146ce", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba9b3dea-554f-439a-9271-a45887394525", "sighting_of_ref": "indicator--168970f0-3bfa-4b7e-a4e1-af067ade70fc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7190d8a9-fb8f-485e-a59d-edd2f0a4f4c4", "sighting_of_ref": "indicator--8171d785-05c9-4116-a74f-b7259eb48f64", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa4da99a-b74a-414d-8667-97af1cc5f0a8", "sighting_of_ref": "indicator--5941a3e4-d9c2-4aa4-8a7c-a0270b690c7e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e944a07-b6f2-4bc7-998e-cabe458cbf88", "sighting_of_ref": "indicator--0d6e90f0-d5eb-43b4-a34e-0bcb7938cc37", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75b4f248-e260-4b51-82bd-67d46e4a20ff", "sighting_of_ref": "indicator--f31d669d-d221-4ea2-9150-632b5a05188e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40702865-c170-4dd0-94f1-c563bf3d4635", "sighting_of_ref": "indicator--b58e00f1-30d3-45b8-83c2-d4d96ca07589", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dceb418-ff8d-4b94-82a6-3c8c8132478d", "sighting_of_ref": "indicator--b58e00f1-30d3-45b8-83c2-d4d96ca07589", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60eb8e77-37c1-42da-93ec-e5e7e839fb3a", "sighting_of_ref": "indicator--b99c2b4d-0cda-4456-a9ef-2f8e30a0b1ab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d0f2f25-8831-4edb-8735-37715815eb2c", "sighting_of_ref": "indicator--b99c2b4d-0cda-4456-a9ef-2f8e30a0b1ab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--569dd71d-9d61-4fda-bf8e-7ad1aff625a6", "sighting_of_ref": "indicator--24de978a-84f2-4098-8334-9e30701fc2d6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93cac700-b294-4056-834d-28afecde649d", "sighting_of_ref": "indicator--24de978a-84f2-4098-8334-9e30701fc2d6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41e179d7-413c-4158-960c-a89d4a0c86dc", "sighting_of_ref": "indicator--36fb4c9e-9827-4806-9510-33566970f46f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1eacbdf-0ec4-480d-8641-16ab82693335", "sighting_of_ref": "indicator--c0ed0526-344e-48c4-9d21-f2547d227d8d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--987331c6-77ab-4cb7-b522-e994e7d78f65", "sighting_of_ref": "indicator--eed8a6ca-a5f0-4789-a713-97c8ad369ed8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--680f39e3-018c-48d2-95c0-99ff9908f623", "sighting_of_ref": "indicator--350f045f-f9a1-4cb8-8f9d-c08815c51bfa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69f7e2b3-dc23-42a2-bbc9-d3a9634c2a3a", "sighting_of_ref": "indicator--188e3ef7-3b16-41ef-9a4b-da54f94edce3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc9d83af-3a8f-4253-870e-4119fa169f30", "sighting_of_ref": "indicator--2689ac14-94f0-4099-a2f0-e0955c064685", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8261ca4f-dca5-4615-a4a4-e5bfb3069d50", "sighting_of_ref": "indicator--ecf7c8f2-f417-49a6-b959-3eeaad8603eb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17ed6966-9548-482f-9a1a-88016ca7e722", "sighting_of_ref": "indicator--263941c3-c5c1-4d54-bae9-16b542440010", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9964541-1b72-4575-91f0-08b7988216ab", "sighting_of_ref": "indicator--c413909e-f051-4134-9099-68fad549ce70", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eb8a9cc-96c0-4ccc-bd06-fb8ed9d3ae4c", "sighting_of_ref": "indicator--5eb719c1-75a4-470f-9df7-d1bdfa4742f2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c721f0b-5ebd-43ff-b2c0-df355be4bc5e", "sighting_of_ref": "indicator--20e645d3-e12f-4794-9eef-6434183210e8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7df12e67-41f6-4b75-be90-4ea4e13cefc0", "sighting_of_ref": "indicator--67dc87a7-1b59-425f-a369-8885efe4ffa0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fcfd9c7-2073-453c-bb37-940176a27db6", "sighting_of_ref": "indicator--2d7d2edf-3a7e-42b0-80d5-c488ca260c70", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34eca604-c526-4677-8aee-2cb483e571c6", "sighting_of_ref": "indicator--d23e4031-4369-43b8-aa2c-383c506d57af", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c68245e2-5d74-4fe3-8582-2d75c7d011c1", "sighting_of_ref": "indicator--d23e4031-4369-43b8-aa2c-383c506d57af", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8638f31-8f85-4e42-8804-0c6ef2c30d10", "sighting_of_ref": "indicator--05edf198-7aa3-402e-ab9a-92cc7ad6cc28", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--812864ad-2fa5-4d1a-a3f8-c2f7099c323b", "sighting_of_ref": "indicator--5a8a0f50-169a-460a-805f-944f98a5ab0d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eac62e1d-8218-44b2-b3e6-b905ff5bde73", "sighting_of_ref": "indicator--3e675f11-173e-47e3-83be-159bab1eedf7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44dbb043-9b8a-4e0c-b9cd-c4ef542f3af4", "sighting_of_ref": "indicator--2e46a695-bf85-4605-b6ad-ef617174fa91", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a667271f-bc94-49f3-abde-0869c218a2ac", "sighting_of_ref": "indicator--2e46a695-bf85-4605-b6ad-ef617174fa91", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72b9807d-38d2-4f4b-a0ab-ab2d441ae2ab", "sighting_of_ref": "indicator--c27d36c4-775d-436d-84d7-cbd77a1897ab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35557c70-4d87-4eeb-b5f1-f8757b8cb1f5", "sighting_of_ref": "indicator--c27d36c4-775d-436d-84d7-cbd77a1897ab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d7bbef5-988e-4609-bea5-37356a67aa61", "sighting_of_ref": "indicator--2f80f4ee-410d-4469-bf3b-550a2f985469", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8360bbc4-e0a2-4580-a4d9-46ed06ddc945", "sighting_of_ref": "indicator--172e0eec-1d74-4a6e-99fb-aac9907d01a0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1723fd52-eca1-4bad-8e90-063da5eb569b", "sighting_of_ref": "indicator--f13fa0ff-c108-42a4-a0eb-d9bdf313363f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--492e790a-018c-432a-b55b-1389deb694ef", "sighting_of_ref": "indicator--f13fa0ff-c108-42a4-a0eb-d9bdf313363f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f28340b-609e-47e0-8abc-cf032f48cd47", "sighting_of_ref": "indicator--f28e2361-d96a-4f0d-a06f-fc196b56c0b5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8f5d6ad-0a83-4b63-a9ff-5313be9c33c1", "sighting_of_ref": "indicator--95d751ee-f9d1-47de-a3da-cf4186f2561b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd90d520-0fac-4b11-b6c9-97d0a19e5aff", "sighting_of_ref": "indicator--e4ace771-c81c-458f-8958-077e6ed7b5e1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f90ae27b-ec47-4239-8d64-d2ef05761b63", "sighting_of_ref": "indicator--5c54f7ae-092f-4b36-8e83-a52c8a1be079", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e814265-61a3-46a6-95be-3a82bed7293c", "sighting_of_ref": "indicator--5c54f7ae-092f-4b36-8e83-a52c8a1be079", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--094bd62d-583c-4815-b134-1d9c64e37f12", "sighting_of_ref": "indicator--ce560472-8539-463f-8418-21d7b78dbb8b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80d1c086-5ac8-49cb-97b6-53cb231b1e8b", "sighting_of_ref": "indicator--f67eb1fa-9e7f-4531-b9a3-738e1b29c017", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f4d6adb-8ed0-4d26-99aa-f4f46b0820f2", "sighting_of_ref": "indicator--df129667-9192-49f6-bce1-b8ca1eb57c0a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--994ef608-37bf-4d7e-a907-97074f9d9efc", "sighting_of_ref": "indicator--c0543db3-b8ab-4340-bfed-16e5d77fd7c9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91535682-bdf3-47b0-90b6-c59c6bca6089", "sighting_of_ref": "indicator--658c63df-883d-41a5-bcdd-90f1d73631c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70e123e1-aa5d-49f0-8428-8449e2fc55a0", "sighting_of_ref": "indicator--f3981ff2-9793-461f-9265-86d8153c3716", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4041c6b-4353-466a-ba5f-9c3ff7675b94", "sighting_of_ref": "indicator--f3981ff2-9793-461f-9265-86d8153c3716", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dcd0ddf-87b1-4a85-9203-48691aaa267a", "sighting_of_ref": "indicator--4eb8808c-516f-4ed2-a2ef-0646a4fb46b1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac09927b-b133-4ce9-a78a-f8daf526a3dd", "sighting_of_ref": "indicator--34fe3376-fe96-48b8-9a9b-70a17af30702", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0997cd4e-c1f6-425f-9e4b-a7a39b550c84", "sighting_of_ref": "indicator--34fe3376-fe96-48b8-9a9b-70a17af30702", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fbdf3f0-9cc1-4b15-8d51-d9dae9b49c14", "sighting_of_ref": "indicator--0fb2f65c-ef35-4657-baa2-4d62f2843fbe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84dba381-5662-41cb-8f0f-85668e6cc183", "sighting_of_ref": "indicator--bec17cf2-6a3c-4455-a8c6-965541131745", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76f29f62-f36b-4e89-b7eb-283c7c092f1f", "sighting_of_ref": "indicator--d93c970e-e4d1-4a54-af90-b58934f6cbd9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32bd1784-086c-471c-9155-cd4fe8b4bea4", "sighting_of_ref": "indicator--062e01bc-ecd9-47d2-aaa6-5462993079be", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83e3ca21-a26b-4841-aa20-e998c51b034b", "sighting_of_ref": "indicator--062e01bc-ecd9-47d2-aaa6-5462993079be", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b160b67-1540-4689-b65f-f02dd33fbfe9", "sighting_of_ref": "indicator--a5ab92a9-a5bf-4896-95e6-749b703af2f4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26961d56-73c7-4dbe-b0f1-38a6c01f6d48", "sighting_of_ref": "indicator--e9f7a8c2-aae2-4b18-92a8-fbb9d38ffa9d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34bfb67a-a009-4cf4-a181-19f36ec75dc3", "sighting_of_ref": "indicator--e9f7a8c2-aae2-4b18-92a8-fbb9d38ffa9d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4021320-16a9-4f36-ae1d-9975943b4db0", "sighting_of_ref": "indicator--e6b0d2eb-5d78-4463-8fcc-9a52a40a3e75", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32a2ab5b-3744-4e5b-a2ce-5f406deae44e", "sighting_of_ref": "indicator--f02efc28-65dc-4f22-9713-2b6b24e9a33f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76669f6a-5876-42d1-b916-91ee95f6297e", "sighting_of_ref": "indicator--7cfad26a-4535-4f8b-8755-02f55c81251a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06b303b7-c895-4cb4-95b4-e5c3a37a1aad", "sighting_of_ref": "indicator--bb710e2d-21c8-4689-a5b2-8415651231e4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33774f2b-bb10-431d-9626-3ea4f6ad7936", "sighting_of_ref": "indicator--9811ffd5-e45a-46bd-b904-fbf1b8039b50", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--053e7721-a1f7-4b6e-b404-55c8c7fa5991", "sighting_of_ref": "indicator--7550c746-17cd-42b3-9d28-d342b8a25ef0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56d66ac4-ceb7-44ad-a0ff-ce48dd536339", "sighting_of_ref": "indicator--ae23adcc-c963-472b-a851-e306184cdc2e", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb1f72ca-295f-4695-98d9-ae66df66a779", "sighting_of_ref": "indicator--a91b4d32-1c3b-435a-aa90-cd8e8e890994", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f74a7c0-0f0c-49ca-bb34-b2f1254e7df4", "sighting_of_ref": "indicator--d5a735d4-9020-4319-a83f-b51cefd15750", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06ebcdc9-cc8d-4541-a2a1-f4c24b4d0a95", "sighting_of_ref": "indicator--ac44de69-c161-4c4a-bb2b-94d4d5069a12", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cfa11b3-5e95-47df-b490-048291fea5a5", "sighting_of_ref": "indicator--b729a38d-0e27-4bfe-81ed-25193c2e4be6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6bd95aa-f6d6-4ee6-9525-8f07c08d06ca", "sighting_of_ref": "indicator--bd23bca9-b67b-4be1-bb93-c287820cb429", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fc8c0dd-f76f-4e60-b2db-c652f0ce2b1a", "sighting_of_ref": "indicator--81b99089-32c3-4a55-9808-a484bd539022", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81183058-4452-4b66-94cf-2bdc935ff497", "sighting_of_ref": "indicator--c086f9c6-76a6-425c-b57e-984b46a5de0e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--045f2194-f16c-4a94-85f0-b40d56bae6bf", "sighting_of_ref": "indicator--78990f65-9dc7-4899-8525-21fdef7eca74", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e36db0f4-357e-4ffe-addd-3b06646ce3e1", "sighting_of_ref": "indicator--dc3ce167-a90c-4779-8c04-d22394b3576b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a59e3b1-20e0-4b78-8472-0c397c905245", "sighting_of_ref": "indicator--0289a874-7267-4e95-9008-7e090725795e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e03a3f53-d404-4126-a44d-977341a1297b", "sighting_of_ref": "indicator--ae726e06-7d1a-42cd-8b76-086ee5f1860d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aca2c431-383a-4bd8-a0e5-5fe490f275d4", "sighting_of_ref": "indicator--bae5fc3c-0dea-417a-a262-82f0c080b958", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--700bc35c-bca8-4f0f-a73d-4f08230023b9", "sighting_of_ref": "indicator--eb3e457d-0e79-4512-a6d0-6855bce13e01", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9d52f61-9eb6-47d4-af17-683ad5b44c9a", "sighting_of_ref": "indicator--9089c155-b6ba-4f7c-abaf-1cedea46461a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e6b689e-7b66-4c2e-8325-0e468b0d600e", "sighting_of_ref": "indicator--558c95e9-75fa-46de-aeee-2ef26af48dce", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06b46d65-c9e6-42b4-8223-05567ad9e69e", "sighting_of_ref": "indicator--645c79ee-2b8a-4354-a520-5eaa41a5f935", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58a0ffac-b71d-47b0-958c-76adaea90959", "sighting_of_ref": "indicator--65fd99d1-0721-48ab-ac56-ea39b73c2bc6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e1b585c-e7d7-411c-b93e-3dca58c9f9eb", "sighting_of_ref": "indicator--8b9948a5-f2d6-48e8-8e67-91e81c804c8e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f2828a4-baa1-464c-82a2-740efe968afc", "sighting_of_ref": "indicator--b15f9281-89f7-4843-8786-2144eb4c31e0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1bcbb30-d2dc-4377-98d2-49136360e401", "sighting_of_ref": "indicator--7db82a41-4a87-437f-a499-4855e1d71510", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecc7a52d-a6ca-4a54-8008-4b82487cdaeb", "sighting_of_ref": "indicator--7db82a41-4a87-437f-a499-4855e1d71510", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f67c9bbc-583c-4ce8-9a79-a67f386e8cb2", "sighting_of_ref": "indicator--bf6fa16e-a886-4de2-aacc-1655434c6956", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e66e9602-2625-4aa7-b792-99d074a85bd3", "sighting_of_ref": "indicator--cf6ff127-aacd-4244-b3a6-66f3adcae20d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46b1ecb0-3ef5-440f-a4f8-3ad44c6f0225", "sighting_of_ref": "indicator--a42150c1-74f9-4127-8e74-cabb391dad69", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d19b2a0-4693-49b9-9619-0315e0db4b23", "sighting_of_ref": "indicator--a42150c1-74f9-4127-8e74-cabb391dad69", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36f2afc9-2472-432c-8b4f-1b87945762f4", "sighting_of_ref": "indicator--daac0dab-da9a-4680-98ea-f62bb24d95e3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef526d51-feb8-48c2-b7d8-648b1e64dfed", "sighting_of_ref": "indicator--8bbec3f4-d46e-4a47-a274-d03fe24ff541", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b67fee83-ca60-4870-bac2-d5ebc4bc3652", "sighting_of_ref": "indicator--1a93957c-e3c9-4ab8-8877-4d35442bbca8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51d57d30-fb31-459b-979c-57747bd6698f", "sighting_of_ref": "indicator--80a1bb8c-873f-4c6c-9fa1-d8d3f29b0ea7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c66495e-6826-478e-b211-0a3db44325cd", "sighting_of_ref": "indicator--dbb81323-aa22-436d-80a1-dc5dc212023f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f408a30f-992d-404a-8ff9-a0d779378ff2", "sighting_of_ref": "indicator--6fe188d6-d8db-416a-aa55-b7caa568f5ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--645fb831-59da-4fea-9300-b051000c079d", "sighting_of_ref": "indicator--019f4297-014b-4b10-a0bd-211e2f38861b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d6d227a-6543-41a3-afb4-8835c533a842", "sighting_of_ref": "indicator--918154a2-242c-47f9-8d4b-3752539c54ff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce5b5222-f819-4b44-a6ae-9ba94367c4b3", "sighting_of_ref": "indicator--918154a2-242c-47f9-8d4b-3752539c54ff", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de83f7da-70fe-462e-89c9-cb6de35e5214", "sighting_of_ref": "indicator--eebb20db-de74-43c5-abcc-4725b8914028", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6da246fe-0afb-434b-8317-611d2737a71b", "sighting_of_ref": "indicator--27bb0b05-82ff-4d93-889c-bedb95d3af58", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9455801-a6c9-4279-979e-1bbc71393ab1", "sighting_of_ref": "indicator--142b0215-878a-466c-bd6a-1fae15e11dce", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9aac195d-ba7e-44b2-98a0-c76891786400", "sighting_of_ref": "indicator--142b0215-878a-466c-bd6a-1fae15e11dce", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--beb21edc-ff46-4beb-a846-eec2607e2781", "sighting_of_ref": "indicator--10ed82be-0e49-4980-a011-39fef800509d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5486511-3778-49b3-abd1-83889d2ad771", "sighting_of_ref": "indicator--f90ebcb7-3e43-4671-b67b-783bc864cfa6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c4043f2-86ba-4103-bfb2-2d04ed2ab700", "sighting_of_ref": "indicator--f90ebcb7-3e43-4671-b67b-783bc864cfa6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df028cbb-2b84-4d26-8008-18eb26586d2e", "sighting_of_ref": "indicator--3f2db2fb-68eb-4a38-aba5-1497268e9334", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c86308b-a523-4f2b-9bb2-80308fa80684", "sighting_of_ref": "indicator--51b5995f-8cab-4b6b-b6f7-129268f8ba91", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16e66676-7ad4-44c8-81d8-5f88fae270de", "sighting_of_ref": "indicator--51b5995f-8cab-4b6b-b6f7-129268f8ba91", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9bf825c-0b58-4102-b57f-4330a51eaa22", "sighting_of_ref": "indicator--7ba73f2d-748f-4ee8-bf0b-870f64d28b57", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41e304c8-e1d2-4efe-a1a5-6a4298bc9a1d", "sighting_of_ref": "indicator--0f255016-8a88-4fb0-9c6b-7384aa23b4b2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fef3e45-0a9b-4b20-ab69-5ece2614c9b9", "sighting_of_ref": "indicator--c356f9ab-17f1-4371-9ad7-279d4cda631f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f4c3077-f07e-4fa4-83e9-a3ea01fd4f4a", "sighting_of_ref": "indicator--22d0b5ac-798e-4d67-8391-60556b614d28", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4710cb1-3c5a-4aae-8c5a-2a5b0dbc3b0c", "sighting_of_ref": "indicator--28269f60-9583-4dd1-bbd7-b82b924564f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cd520af-9190-488d-a0df-d64f7b4d7b78", "sighting_of_ref": "indicator--82bca353-d89d-480f-875b-204df7f1b435", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f343ae9-2768-4456-8ab2-d1fa4a2f3344", "sighting_of_ref": "indicator--44921d46-381e-4e8e-8d62-e2fc6196dd87", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdacea96-4455-4c16-96f3-6794f8371cc3", "sighting_of_ref": "indicator--4667dfe7-febf-4d51-88c4-85792db6027c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e5811c1-a4d3-4c5a-a004-97978b0f7fd4", "sighting_of_ref": "indicator--298768ff-52eb-4038-bb30-b6f3a33280a4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c1450c9-8c8b-4d56-b0a9-1e69850f5ef5", "sighting_of_ref": "indicator--efedf643-d911-4eaf-aee5-78b2d72471f6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9d2a470-185e-4c3e-8f1a-0707d74b6461", "sighting_of_ref": "indicator--b7cdf22a-ef66-4f0d-992c-ea574ddf9a75", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b88a7f4f-df10-4d95-806a-989f7788b19b", "sighting_of_ref": "indicator--b7cdf22a-ef66-4f0d-992c-ea574ddf9a75", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d12ff81d-8d86-46b0-9c46-d18b76566bd0", "sighting_of_ref": "indicator--5aea33a0-4d3b-4e31-9fe5-b93fd277e334", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f0c68f0-db3d-46d8-9642-132395c7a6c0", "sighting_of_ref": "indicator--bc7a6db8-6824-4d86-9a86-4930df5fec2b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--571ce107-ea22-4b06-8172-f5e8c0e29d00", "sighting_of_ref": "indicator--d99f5fd3-1fcb-4a6e-b11f-7a804e7a85c8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a10cb1e-fadc-4d3b-af83-d86b21d4c469", "sighting_of_ref": "indicator--d99f5fd3-1fcb-4a6e-b11f-7a804e7a85c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfcb0369-811a-486a-8caf-d4b340d1588d", "sighting_of_ref": "indicator--e6ff2a92-11db-4e51-8d86-892705d57a50", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da7695a5-94b8-43a2-80fa-2b9c25e2cc4e", "sighting_of_ref": "indicator--92b2e7d8-eaa4-4bc5-a3b3-97b6629d77af", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc29e222-31c3-4fd6-8877-c43a2a67d403", "sighting_of_ref": "indicator--d1e70e03-4b33-42a3-a742-b18079d039c4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53f3068f-77e5-4232-bab4-7b4a5c2b9ac3", "sighting_of_ref": "indicator--d1e70e03-4b33-42a3-a742-b18079d039c4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b9bc485-5757-4d34-8359-46036aac0b61", "sighting_of_ref": "indicator--369fe4ca-171e-4f8e-bc9a-13f5d28ddd25", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96b7262f-9c6f-45b7-896a-3cad62452e5b", "sighting_of_ref": "indicator--af3a28f9-253d-495f-bf93-cb8426e815bd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2877240d-9b8f-43c5-9edc-37a282530883", "sighting_of_ref": "indicator--af3a28f9-253d-495f-bf93-cb8426e815bd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aada2797-7b09-46ba-ba58-839849633835", "sighting_of_ref": "indicator--9109dfe2-0673-4b16-bf76-03bdc2dab89e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ad94a5d-60b1-49b8-af99-240b8c07f3fc", "sighting_of_ref": "indicator--9109dfe2-0673-4b16-bf76-03bdc2dab89e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e70d9d16-995e-4695-bd82-8e6d7b4a7c7c", "sighting_of_ref": "indicator--494cdb20-a21c-474f-a658-59d4e46621a9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d01ce1e-00fb-469d-aeb0-6d8fa411ce63", "sighting_of_ref": "indicator--494cdb20-a21c-474f-a658-59d4e46621a9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bdeb461-a8bc-4842-9302-b10a9da94994", "sighting_of_ref": "indicator--9e3c14b2-41e1-47a0-9939-7d409b28592e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d037550-1d5d-491c-902b-1e6eed45494b", "sighting_of_ref": "indicator--caa5cf92-5f4c-4a13-8ab9-69d9e2a9b434", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--903a8207-f39f-4754-b962-5ffceec65ce3", "sighting_of_ref": "indicator--caa5cf92-5f4c-4a13-8ab9-69d9e2a9b434", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a6219a7-b0a8-44a7-b4d1-48015e4e07d7", "sighting_of_ref": "indicator--4a943ce6-f10c-4a4e-8152-ddf9ebbca7e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c4bd68b-f186-47ad-a78a-69d16271505e", "sighting_of_ref": "indicator--5fc7198a-423d-4635-87e5-645ee95a0c32", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22f79bf5-38f6-449b-8f70-4e3fea50ffa9", "sighting_of_ref": "indicator--5fc7198a-423d-4635-87e5-645ee95a0c32", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f815a78-4f35-4bda-8328-c02297bc94a4", "sighting_of_ref": "indicator--c415c857-41e1-452c-9656-fed1ad98dbfc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67428b20-d32c-4c9d-a91f-3826ad83919e", "sighting_of_ref": "indicator--ae03cbe4-a16e-45d2-b646-e77670ded019", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c2723d2-2385-4f34-94f5-0918a86b83a2", "sighting_of_ref": "indicator--31e4d3db-3b13-4cdf-8190-579e103ac978", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e9a50a1-73ad-440d-91c5-6f406f7911dc", "sighting_of_ref": "indicator--52691135-e8b6-4d8e-8703-2c74dfa41cd2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99596793-71a2-4fbe-948b-b7a1cc64e47d", "sighting_of_ref": "indicator--f4cf0ed2-e12d-4d03-827c-c065b1590a5c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ceea588-4518-4b53-af59-21bb2804bade", "sighting_of_ref": "indicator--de912293-f1da-4b14-9b54-a01ed6f66dcc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39a50b53-57be-449a-871d-258eef3a0338", "sighting_of_ref": "indicator--de912293-f1da-4b14-9b54-a01ed6f66dcc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4f0bc9d-2b2c-4d26-80de-407a85ed9700", "sighting_of_ref": "indicator--c598189e-40f3-4a16-85ac-b77091f7b7cd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51f0421a-acf4-4ee3-9055-ca11fc86b086", "sighting_of_ref": "indicator--b8f7e424-0003-454d-9fb2-9322c5b2d8e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e5c9c05-7e92-49b0-8652-6e06852669dd", "sighting_of_ref": "indicator--b8f7e424-0003-454d-9fb2-9322c5b2d8e1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--857eb209-d5db-401a-a574-3c9ab171dcc8", "sighting_of_ref": "indicator--8fba03c0-ada2-4a9c-afc7-2c98b89380ab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16c93408-bca6-4722-acaf-229883ee91bb", "sighting_of_ref": "indicator--8fba03c0-ada2-4a9c-afc7-2c98b89380ab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c825930-e320-440d-aab8-b6e03d45da7b", "sighting_of_ref": "indicator--337828c7-06b0-45b8-ac72-37c74aae5a46", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a3ab2e7-6334-48fb-b2da-7e386842b4e9", "sighting_of_ref": "indicator--337828c7-06b0-45b8-ac72-37c74aae5a46", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c425744e-a63e-4285-aa0a-fa354731a9ab", "sighting_of_ref": "indicator--9b0a4377-1812-4f96-98a2-279ef37320d6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c80a34af-1692-46e3-ac5d-0edfefa7249b", "sighting_of_ref": "indicator--e86a7ebb-e424-47a0-a237-719868882176", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e3dd69b-63a8-4ab6-875c-13378b84cc9c", "sighting_of_ref": "indicator--930e9dbd-a891-4f23-aedf-86b750f649e2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7441bdd6-c763-4818-99dc-4a3aad3fee0c", "sighting_of_ref": "indicator--a952276d-b11e-4ff7-a1b0-52b16760bf0c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00977010-002a-4b20-86c7-73cc4aaee66c", "sighting_of_ref": "indicator--61df1d80-35b7-44d8-b16c-6408df5e6175", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--500e3bd4-2b30-46f2-a1ad-32ce19931335", "sighting_of_ref": "indicator--aa0e43e2-53c8-4e41-b3fc-4828819fa8c4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c0c48fe-5b6e-4530-8804-c7d67e3e8832", "sighting_of_ref": "indicator--ed1fc3e3-e40a-4a02-872a-9e73a5c38b2f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bf8df00-2efd-4860-a1f8-11072133ab23", "sighting_of_ref": "indicator--ed1fc3e3-e40a-4a02-872a-9e73a5c38b2f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18197f10-109f-4d6a-8999-fc5d904d00eb", "sighting_of_ref": "indicator--1261ff2b-34cf-49c1-9e7e-0f87188f4488", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f9a456c-99b2-49e2-b6f0-1609e4d85f25", "sighting_of_ref": "indicator--1261ff2b-34cf-49c1-9e7e-0f87188f4488", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44e67e64-6f2d-4e91-932d-4614f241ab27", "sighting_of_ref": "indicator--ab2b0b1e-94bb-4b6f-98b8-abead8398542", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--838926ca-fcbb-4158-b356-60e3cea0cc5b", "sighting_of_ref": "indicator--daffa19a-c5fb-4b4c-8ab4-a23a8f3313f1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ced618f7-a22a-403d-9792-52f0d200d63f", "sighting_of_ref": "indicator--daffa19a-c5fb-4b4c-8ab4-a23a8f3313f1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de17c0a0-4f5c-43c9-8e7b-b45253bdef1a", "sighting_of_ref": "indicator--60ac5a20-3c19-4c19-9309-9ea0746f1857", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dab5c8f2-6c2e-4abe-8f2b-fe60f58354f9", "sighting_of_ref": "indicator--2ec55df2-b2b2-4c10-a5ba-b4bb71c62989", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9790ef9-c2c8-441e-ab59-02fffd7cae7e", "sighting_of_ref": "indicator--80584896-313c-4c61-8e17-d68cfc71af31", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7302e92-df96-442e-a0f8-497d007a8fc2", "sighting_of_ref": "indicator--80584896-313c-4c61-8e17-d68cfc71af31", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--477af0bd-74f1-4c66-98f8-16f46b5a63e6", "sighting_of_ref": "indicator--e4bb5c1e-fb2d-410c-8548-f5ce97dd70cb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ef0fa5c-bebe-4935-aa1e-6437865d8c24", "sighting_of_ref": "indicator--4f7e98aa-ba78-4fed-a464-850a138a305d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b074221-20e8-4b76-84a6-301aecccc50a", "sighting_of_ref": "indicator--7e0e20aa-a71c-4f94-922c-57487ac47a1d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30f6cfe6-2ae0-4e02-b549-ae6b4d6ffddb", "sighting_of_ref": "indicator--7e0e20aa-a71c-4f94-922c-57487ac47a1d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3dc713a-463d-489f-8990-0aa01e6a86b8", "sighting_of_ref": "indicator--fa5c219b-dd71-42d0-ae72-21acae4fd510", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9202f7e-8402-463e-b5e4-7306a5d1ef9c", "sighting_of_ref": "indicator--fa5c219b-dd71-42d0-ae72-21acae4fd510", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdb61170-eb0e-4e8d-8475-e5c929de0ea3", "sighting_of_ref": "indicator--9e24c981-72b9-434f-878b-6a32313450ca", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3aa541a-5740-499f-8fbd-bbce22775285", "sighting_of_ref": "indicator--9e24c981-72b9-434f-878b-6a32313450ca", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2ac3867-58de-4e1f-a4aa-ecafacb2dad1", "sighting_of_ref": "indicator--d27dff4f-c5c6-482f-bdd9-fc9ea6b089a5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef237258-c725-4477-8c83-02cb5a4aebd6", "sighting_of_ref": "indicator--d27dff4f-c5c6-482f-bdd9-fc9ea6b089a5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c33c54a2-cb54-46ec-b188-da5e38658ff5", "sighting_of_ref": "indicator--74776e73-2169-4c44-af0a-c55d649be6ab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c80320c9-5032-47ac-9eec-8ced1fc9b18f", "sighting_of_ref": "indicator--a02bf3a4-25c5-4578-abb8-7bdc132fb740", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3b20cf6-0246-40f8-ba96-861133f502f9", "sighting_of_ref": "indicator--82bad397-7efa-43a4-aa0e-1a1a76ae91d8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--863a19fd-db90-4e58-842f-d5d54da152c4", "sighting_of_ref": "indicator--82bad397-7efa-43a4-aa0e-1a1a76ae91d8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af527b5e-075c-49df-b866-5fba9c88a732", "sighting_of_ref": "indicator--cf541db8-fafe-4642-afd5-d99646e182c6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e023cb9-3209-447a-bb87-85e884fd6a97", "sighting_of_ref": "indicator--cf541db8-fafe-4642-afd5-d99646e182c6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2994e646-9ceb-4bdd-9795-c1aa48c8e838", "sighting_of_ref": "indicator--3dfc6f59-6837-4e04-9ceb-32811c6e4479", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b85a4f19-7b08-46d4-adf0-3c7fa42a1c47", "sighting_of_ref": "indicator--df5c9f73-dd9f-49a4-9b99-4a98161a495e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de48d91f-42d6-4464-a899-230f19719820", "sighting_of_ref": "indicator--df5c9f73-dd9f-49a4-9b99-4a98161a495e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d8fe65d-e526-4d16-a796-07ef2d18774c", "sighting_of_ref": "indicator--77e7d30d-8ba9-4ad2-928b-022725572ead", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc642eab-9425-4a99-8a8a-4492664c11f8", "sighting_of_ref": "indicator--ad465f13-1bef-4b0d-8a59-6d754a6d53cf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e28f72b-e036-431b-9018-e4e8c20167d0", "sighting_of_ref": "indicator--358642db-1fa6-42c0-ab15-137801d52268", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fa2b3c9-fbd7-4d8d-b271-59b488bcf680", "sighting_of_ref": "indicator--64c68ae4-5707-4b65-8165-8344cad110c3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eba2f11-64c3-43a0-a5fb-3ecf7e7e0d11", "sighting_of_ref": "indicator--dd5b9bb8-0109-44d7-9aa1-b2dd81c802ba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7c0f0a2-384f-43ff-b578-1027362eb964", "sighting_of_ref": "indicator--238c2678-423a-4391-8817-2faa22302490", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fe13bd0-46ba-4ed0-ba45-79e82b10a103", "sighting_of_ref": "indicator--8cd868d2-6a27-4b8b-8099-33d871d9bbf7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89bad109-80a6-4035-b3af-15e132cafdca", "sighting_of_ref": "indicator--3f84b725-99b8-4592-9e5c-88c710f1f875", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afea54c3-a3f3-4734-b7af-9f6b5dd1a970", "sighting_of_ref": "indicator--21a03e39-aba9-4b92-9b67-defc34ef99cb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34091099-0f86-4f07-8e6a-b2f3cd778f3a", "sighting_of_ref": "indicator--a3d2ad66-3d93-4695-b308-629ad8ee7331", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f041244e-4714-4283-8c68-fede08888403", "sighting_of_ref": "indicator--a3d2ad66-3d93-4695-b308-629ad8ee7331", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f32e371e-b76c-463b-8943-7b0768a63d14", "sighting_of_ref": "indicator--6e73db8a-3602-4dea-bc35-45ac88513a38", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--214a6548-bfe7-4181-bb7f-75b5c4ddc9cb", "sighting_of_ref": "indicator--14d3bc72-4ab8-4413-961a-0f95412d232a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c552c47c-a395-4ef5-bdd8-c366184edbcd", "sighting_of_ref": "indicator--c85b3c6b-fdf4-4a3d-adcc-79ed64f5416f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6786eb1d-4b35-4348-9bd6-049016075def", "sighting_of_ref": "indicator--511f2638-476a-4a42-9ea5-892df440c88f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0ffab76-3134-4b7d-8808-1e4083c1fded", "sighting_of_ref": "indicator--eff6595c-85e7-448d-b908-377683a91d10", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f138b7f4-d8d8-43e8-9c24-d8855a919748", "sighting_of_ref": "indicator--ea0afe73-29db-4d40-9c17-cd31a36b123f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c99c1ac-c4a9-4552-b91d-f3ea67bcf3c7", "sighting_of_ref": "indicator--66347d41-e034-45cc-8da1-27d7cc8b8e16", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b95228dc-58a5-4a20-ad16-7c3edd4edabe", "sighting_of_ref": "indicator--529b93d7-1987-4699-82b4-389b0dda5297", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a720bc0-2381-4894-9807-77ab55c2513f", "sighting_of_ref": "indicator--529b93d7-1987-4699-82b4-389b0dda5297", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e33d8aad-e53e-46f4-ad24-254971e43c52", "sighting_of_ref": "indicator--93ad8da1-1ab4-4ca9-8221-14189d49595a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7155c388-39ce-4bb9-9649-cc1288af0c93", "sighting_of_ref": "indicator--ed79632b-56b4-4ea6-9304-28ed4924b8dc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb73c727-5a62-4332-9f34-f195302abe5e", "sighting_of_ref": "indicator--47fe1f03-4cbc-4080-ac38-b312be7bad60", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61b5c03a-9f11-4558-b25d-71c1b68ea5cd", "sighting_of_ref": "indicator--47fe1f03-4cbc-4080-ac38-b312be7bad60", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--893ab32e-1ca3-4d11-90f6-366e8e9eeabe", "sighting_of_ref": "indicator--db06ebe5-942b-48b5-90e3-d0a1a7b0701d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f8d2d69-a131-49a8-85a7-e3a09c337e1d", "sighting_of_ref": "indicator--565245bb-fc98-4a97-9c38-f6519408e06d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f35a1f59-32a9-41c2-95ff-ff6f8e0b24c8", "sighting_of_ref": "indicator--536ac58a-739d-4a55-a12c-a7475b81e3cc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4204776-7f8f-4dc8-8e65-2dd8974a3227", "sighting_of_ref": "indicator--ab0d8108-472d-4506-b026-10fd14c06373", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e351280-23aa-4c24-9b66-953eae5cb22a", "sighting_of_ref": "indicator--9d1b597a-9c59-46fd-a53e-2e4f2f9e23b0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2837e512-b5fb-4583-a3ec-cce31285ae1d", "sighting_of_ref": "indicator--3ff6a6c3-d851-4562-bb36-e157a0db232f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1bf1884-d521-4aed-ac6b-297cb0e0f61a", "sighting_of_ref": "indicator--d2e41626-977a-45f6-997c-b0e83ae486a8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77f5a9e6-9fd1-461b-98bd-23aa22998686", "sighting_of_ref": "indicator--f1ce80af-a7ee-440f-a634-aee1a6ffc38b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--819d7007-3620-4fb2-80b4-ea9d125c0eaf", "sighting_of_ref": "indicator--f1ce80af-a7ee-440f-a634-aee1a6ffc38b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b37a1dd-141b-4f10-8918-dce4f316224a", "sighting_of_ref": "indicator--559c10b6-282e-4efa-9f25-d1112f0e3087", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c0c17ae-ddaf-4388-bba8-8717444a0419", "sighting_of_ref": "indicator--559c10b6-282e-4efa-9f25-d1112f0e3087", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--977c4ebd-1d1e-4af5-b3c5-29b513781842", "sighting_of_ref": "indicator--9b0d8103-8cab-4e07-930d-e48cff8289c9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcf9ce72-4526-419c-9605-1ef9d2353633", "sighting_of_ref": "indicator--7befd4e2-6263-4f1c-9f50-da8de20d7239", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c53fb13-9cc9-411f-aae0-a3f8ede3b740", "sighting_of_ref": "indicator--9c570fbf-e335-42bf-893e-bc6774caf5ac", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5c9a9f4-53b6-4148-bdee-303b1e4f1aec", "sighting_of_ref": "indicator--f30dc180-92a9-49b7-9654-245045eb8c46", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff8788be-3614-478c-9bd7-b67dac7d9343", "sighting_of_ref": "indicator--354cfa1a-1632-48b3-b1ad-59e2cf35d6b0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57f6392a-e7c8-47e6-8c85-ffdecad58c34", "sighting_of_ref": "indicator--6fae6661-28f9-4914-8d65-cc69f4608b89", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9e0730c-d379-4771-8c35-86b1a91c29dd", "sighting_of_ref": "indicator--eb7f8dd7-9cb1-4a1b-8da1-5539194eb1f5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0416d04-c5fb-416b-b21a-a79027982aa6", "sighting_of_ref": "indicator--6c3d5997-0180-4b34-86c6-d258ec3a049e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e46927f0-6e3b-4fa7-85f9-c8e2ec680465", "sighting_of_ref": "indicator--6c3d5997-0180-4b34-86c6-d258ec3a049e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b6f24ce-72cf-4bb5-ab8a-1d9df36c5162", "sighting_of_ref": "indicator--0133df71-c198-4d03-bf5c-2fdb65ed39df", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1c37705-01b7-4b63-ab97-10f6f5229f2d", "sighting_of_ref": "indicator--41e4cef1-ec16-45de-b6f3-4bafc45351fe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3a1dc66-d01d-4598-9dd3-69d6f19b5604", "sighting_of_ref": "indicator--f0090278-a942-4bb9-9bbc-bdfa9406c7a5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0d860ec-bd8e-400e-ac73-dcbbf10b8db5", "sighting_of_ref": "indicator--f1abb047-eb40-4c54-82c9-ce15bec13947", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f68cb390-fbfc-4f31-9e0c-053dac5c7c89", "sighting_of_ref": "indicator--230c7c5b-d561-4788-9cf9-6aaf50009fd8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e21d0a63-9dee-4a45-8f72-0d2717dd0a94", "sighting_of_ref": "indicator--e1b5e1c6-a781-4c96-b6f7-3294326deef2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47aee909-fe3c-4801-a28e-018d398c8342", "sighting_of_ref": "indicator--c92df231-d101-4868-9326-414a0ed94b4e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be7dea6b-a42f-4878-a396-3230810fe6cb", "sighting_of_ref": "indicator--c92df231-d101-4868-9326-414a0ed94b4e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7c7e90d-39e3-4341-9a26-dc6ea9ce5229", "sighting_of_ref": "indicator--b19d4783-482f-435c-918c-f773663acacd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5349f190-d486-46fb-8575-59a674c2743f", "sighting_of_ref": "indicator--033b6453-662d-45aa-a0fc-94fa811a271e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--360c8e01-5e53-4c51-adaa-20f5ad1f1cd2", "sighting_of_ref": "indicator--3cfd759f-619e-496a-801e-231b3e812f5a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ae84b91-5f81-4003-9640-4312cb969895", "sighting_of_ref": "indicator--92a2a4ec-2257-486d-b7f4-5e1ca6773272", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92b41005-2528-4b8e-9a5f-066475cb5951", "sighting_of_ref": "indicator--1c507962-1443-4d8d-8c0f-b64ed76db154", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--592d9d44-4050-4ebd-8888-f15f5a6f314d", "sighting_of_ref": "indicator--fd652365-c261-4d76-9863-14cc7b7b325a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f90d9b6-3f24-4d98-8c2e-d3e737350fdd", "sighting_of_ref": "indicator--15e17a6b-eea9-493b-9345-2fb1b5d17e0d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ede2b4c-635b-4450-b4e2-c523e373d946", "sighting_of_ref": "indicator--f7dcbd73-d086-4e8b-b0e0-a22749f64543", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab66cb6e-0eb6-468a-b448-f05a3c4a034a", "sighting_of_ref": "indicator--f7dcbd73-d086-4e8b-b0e0-a22749f64543", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5a21ff7-34ac-41ba-8846-571be3d0995b", "sighting_of_ref": "indicator--e4f40f8b-92e0-4775-801d-4195bafc7de8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcf873c4-64c4-4b2a-bc43-6de9d6dfae99", "sighting_of_ref": "indicator--8dbf3142-b09e-4433-b103-3ade21363b3a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--affe0bd3-6997-4c93-87c7-2b8153ea292a", "sighting_of_ref": "indicator--3619fe8a-d384-46be-a30d-283c80060f18", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28e2de14-5a6a-4206-8472-560a2514cfa0", "sighting_of_ref": "indicator--8a7bb0b8-0aef-4b81-9f3c-22e17e16a8d1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0320469c-c0f8-4f50-9e48-c7e1e02409ea", "sighting_of_ref": "indicator--a7803e0e-4106-4500-849b-d7b3c542ffed", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb3038d0-a9d7-4646-be2d-03d284092fc5", "sighting_of_ref": "indicator--f0e4e525-855a-416e-8f45-ed1d100c2f6a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af63f3c4-78ae-458e-af88-5520b2f1f158", "sighting_of_ref": "indicator--6fd907e1-1386-4a4b-82c8-458e51b8a9b6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb17c3d0-26ed-4a8a-b22d-7298651f50f4", "sighting_of_ref": "indicator--6fd907e1-1386-4a4b-82c8-458e51b8a9b6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2665a607-0e0f-4645-a690-e24fbf9c981a", "sighting_of_ref": "indicator--281cce84-3bf0-4051-b607-096b438c5ed9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb857bba-0896-4dc1-8070-f6288e633f2b", "sighting_of_ref": "indicator--281cce84-3bf0-4051-b607-096b438c5ed9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe39e8ea-a05f-4ae4-ae99-620d3cd40f3a", "sighting_of_ref": "indicator--01890a8a-551e-4dc7-91b0-f20fb0cf47c0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e321e02-6c2e-45e3-bd03-e1c9e20535ba", "sighting_of_ref": "indicator--143be3f1-45fd-4114-a9d8-3269f5456f1c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85dd14ad-5acb-476f-9462-afb407ee0e35", "sighting_of_ref": "indicator--ca3e8a80-5768-4007-95d0-7682db9e25d4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--921e75d5-841d-4743-b7db-ac99105a7f82", "sighting_of_ref": "indicator--ca3e8a80-5768-4007-95d0-7682db9e25d4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93707098-221c-4ffb-bc96-7b5810e5e958", "sighting_of_ref": "indicator--f2519ae6-e7db-4494-ad6a-191444255d0b", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20069db3-6dd9-4e05-9540-2f7c8cb0a1dc", "sighting_of_ref": "indicator--e02aa481-d6f8-4698-9c82-d141f2004a2c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb979868-c9c5-440e-96cf-9bbe414d1828", "sighting_of_ref": "indicator--282a605c-47c8-4150-9cbd-79a80d39c920", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77e1e272-d004-42ec-bf45-19bad49d3a83", "sighting_of_ref": "indicator--619048a2-34a3-4e1e-9b3a-181dbb0a803a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d8e295b-1b3d-4ebb-9432-b3ae4e30bda6", "sighting_of_ref": "indicator--b8f683aa-06eb-49a4-bfb5-c22497cefa91", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d169cc44-a44d-49bb-89f6-8169500ca8f5", "sighting_of_ref": "indicator--b8f683aa-06eb-49a4-bfb5-c22497cefa91", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1edd01e8-0863-43f1-b700-b7bdf02e14c7", "sighting_of_ref": "indicator--707ba541-618d-44bf-9131-c742a5642bef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bc2d567-cfad-4ae8-bc2e-b8be65d2eec7", "sighting_of_ref": "indicator--707ba541-618d-44bf-9131-c742a5642bef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96d2d27d-84cf-42a9-87cc-0e13b66373d9", "sighting_of_ref": "indicator--6b8537a5-c26f-4720-807a-80c1e2e4d55d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a46f2fe-9bee-4aa3-a605-b1e4551e730a", "sighting_of_ref": "indicator--652792bf-2fa8-4537-b550-913f9f35ef6b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--514738f8-e82a-4ca2-8e37-a8bcdbcc60b4", "sighting_of_ref": "indicator--2da14706-7236-463d-b8b0-df59501a47d3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--046ab4f4-ede4-4f36-95b2-368fe44501fb", "sighting_of_ref": "indicator--73a2393b-15b8-4bee-b622-941ab78bef13", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8e57405-1bd4-4398-acbd-98bcfd708ec0", "sighting_of_ref": "indicator--41f67cdd-8a92-40cc-858a-d5535673e67e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f543cbed-8a43-4d36-88bd-8f27f96dccd5", "sighting_of_ref": "indicator--307f3efa-cd4f-4cd5-a9f9-93d1f6dc71a4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eacb6622-bd8b-4396-a980-6096a7d3aedc", "sighting_of_ref": "indicator--46630790-2597-4178-86e3-2bf87e77e833", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48b807a8-defb-43ed-81ca-9ee9ea5fd297", "sighting_of_ref": "indicator--ddf4d88e-7bd1-43a4-b015-3b22dbffb0bd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38a7d587-707a-42e4-a6e7-836cbad843dc", "sighting_of_ref": "indicator--385eaa90-df17-4776-8520-d0fada2de106", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b3a4304-d8c1-4421-8483-c84d026cfca9", "sighting_of_ref": "indicator--a9072222-d17e-4afb-a6ee-bf3a6fa5abc5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fada95a7-3c9f-4635-94b3-5a833a6d1cf0", "sighting_of_ref": "indicator--ef9d0f8a-da69-477f-9a2a-c126b2641fcf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e38d5e3-2c03-42b6-bf3c-d00c309e0bef", "sighting_of_ref": "indicator--a8476b84-2065-4aac-b867-0ed75bd8875d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9449ba1-0e29-4273-9e1c-60747d376709", "sighting_of_ref": "indicator--5a1b39ae-1bfa-456f-ae7f-b635917a755e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10c20e2a-2aa8-44fa-b1f5-eedb86abed27", "sighting_of_ref": "indicator--5a1b39ae-1bfa-456f-ae7f-b635917a755e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce665935-be35-4c1c-aa37-825db4e7ed7f", "sighting_of_ref": "indicator--b0778241-ae63-4383-adb6-7abef1294ca8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--801122d9-c448-465a-bb16-8858656376d6", "sighting_of_ref": "indicator--b0778241-ae63-4383-adb6-7abef1294ca8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70ac1495-9356-4a63-87f5-6575d7fdf954", "sighting_of_ref": "indicator--d38a3a06-c341-41a5-ac36-c9d6f91d6071", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e09aab0-a788-4817-954b-498923578ea3", "sighting_of_ref": "indicator--d38a3a06-c341-41a5-ac36-c9d6f91d6071", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72330cf8-eec0-4431-bd3d-dbe5d002f053", "sighting_of_ref": "indicator--7baa42e6-54a4-4f23-9b14-4f89b7f0564f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--996e9663-c044-4652-bf49-b92e45069692", "sighting_of_ref": "indicator--7baa42e6-54a4-4f23-9b14-4f89b7f0564f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7146687b-d1dd-47d1-94b7-5004870667fa", "sighting_of_ref": "indicator--fc943d2b-af6f-4a0a-880f-7ec283aa15bf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff484c98-f7e8-4d6f-b783-a370924bb9cc", "sighting_of_ref": "indicator--9c712417-e786-4aa3-a6bd-e6cf40c2fcc5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d43c420f-8534-469d-bbec-7c28255d6e6f", "sighting_of_ref": "indicator--9c712417-e786-4aa3-a6bd-e6cf40c2fcc5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dbf8f44-2cc4-4d4c-b490-dab2b7783dc7", "sighting_of_ref": "indicator--2ddee4a3-8d94-4dba-9a39-722e08c0c343", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8de3fd55-7629-4615-8afe-d56dbf2c7bee", "sighting_of_ref": "indicator--dfea175c-1254-4f16-9c9b-f503bed0ce98", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--445ddff7-cebe-4663-8616-6415325e9cdf", "sighting_of_ref": "indicator--dfea175c-1254-4f16-9c9b-f503bed0ce98", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97ff8e0c-fed8-440e-b4d0-fdd9a6bda887", "sighting_of_ref": "indicator--fc2de688-d3d4-4a15-8450-d023f8b0b538", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ae7d1a1-3a41-42ca-9eb1-605827ee8c21", "sighting_of_ref": "indicator--fc2de688-d3d4-4a15-8450-d023f8b0b538", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--689bb66c-bce6-4311-afdf-fccd84e1507d", "sighting_of_ref": "indicator--21ee9c6f-2afe-4888-a9fe-4f5f68bfb4e0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de38c333-0615-4833-b2a4-2702b469342c", "sighting_of_ref": "indicator--496c3bbc-6cf8-4bb5-958e-f2c8ec442b10", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7704478-5c32-45a2-9141-5572f053f251", "sighting_of_ref": "indicator--496c3bbc-6cf8-4bb5-958e-f2c8ec442b10", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c4b3f2e-99e8-467e-bda4-3b7bebe21354", "sighting_of_ref": "indicator--db52e0e1-2d66-452d-9dac-44b283e90e44", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5adf459f-362d-4f97-a4a1-65090faddda2", "sighting_of_ref": "indicator--db52e0e1-2d66-452d-9dac-44b283e90e44", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddc51306-1e93-42cc-a0d5-d428689c0771", "sighting_of_ref": "indicator--241c6d28-c09c-472b-ad6c-17145488fcff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d5ee734-f211-4fff-8bda-0e6399da5dbf", "sighting_of_ref": "indicator--241c6d28-c09c-472b-ad6c-17145488fcff", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7155bb59-fd65-4a47-b1fc-5715412e5e64", "sighting_of_ref": "indicator--6fccc931-1623-4749-b76d-666bbbd78dcd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--865055ec-102a-436d-9be8-426857a18e99", "sighting_of_ref": "indicator--6fccc931-1623-4749-b76d-666bbbd78dcd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60163848-c966-4004-82aa-81d3eea80d3c", "sighting_of_ref": "indicator--374aa6a4-6e1c-460f-99c8-4092233cbf3e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cffde0c1-cbd0-4c39-aa5b-b6bf630cbd43", "sighting_of_ref": "indicator--0748b956-6df0-4738-969f-206df4d97ef8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e851ef9d-f069-4d8d-b18a-1df66ca81519", "sighting_of_ref": "indicator--0748b956-6df0-4738-969f-206df4d97ef8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--743ff05f-bd69-4ea2-a5c5-65accb932502", "sighting_of_ref": "indicator--839ed4f1-f37b-47b6-92e5-7ee7ed1fd585", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79723950-6563-450a-a04d-0078f61dc617", "sighting_of_ref": "indicator--9a865782-0803-4170-8948-f25cdf19b1d0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4585142-20e2-48b6-beaf-ec6c02f19d0f", "sighting_of_ref": "indicator--a8fbe05b-53cc-4f6a-bab9-f4d2015e5d46", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1733df94-a236-4d49-aaa7-b4966ed96699", "sighting_of_ref": "indicator--b44dc1ff-7b7d-471d-89e4-40e23db0a387", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d33a32a-dabb-4cca-a076-775509fabe9c", "sighting_of_ref": "indicator--ebe95040-67bc-43ed-8c51-d58ebb6fed56", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f90360ac-1f67-40d9-927c-aa409098b898", "sighting_of_ref": "indicator--03484565-8888-4c60-884e-dfb3a9ea75d8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2ac048f-0c49-40cd-8bcb-0146331a96bc", "sighting_of_ref": "indicator--7b5fde7d-b496-47b1-a0cc-62e6c5f56a2d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c3faab5-64f0-4db9-a93b-312b382d74eb", "sighting_of_ref": "indicator--7079efa1-fcd7-448a-9227-9af7f2a30567", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e6b47ee-d537-46ef-a2cc-c6a9d4d6ed1b", "sighting_of_ref": "indicator--cfa75592-41d1-46f0-b7e4-7dde9803822b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e38aaa5-5485-454c-bb5a-f769f55f4afc", "sighting_of_ref": "indicator--620e5b87-0733-4a6a-b811-306b513487f7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee47e478-b770-423f-8fcc-dbef68731a1e", "sighting_of_ref": "indicator--5b770a4c-e8eb-41c9-a2a6-6e3789948c8a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ad7a9ab-2356-454e-9b60-3de7bb33be80", "sighting_of_ref": "indicator--2c9109e0-3389-45d6-ae0b-d7f184748010", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4222dc36-2e57-4a5f-9582-440497be5a46", "sighting_of_ref": "indicator--985fcbff-3dcd-4209-a50b-9dc30a52d1a7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52b15cc6-fd3d-4e8e-bfc6-94d99a829dcf", "sighting_of_ref": "indicator--da777f60-fea5-4fb3-950b-40acdd2de559", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64bef259-d1b6-4cf1-85d2-80775d0fca7a", "sighting_of_ref": "indicator--0a99ccdd-4c26-4f7f-a593-9aa8f07ec8f8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ff4533d-281d-48f6-8638-25e401da9db5", "sighting_of_ref": "indicator--b156573e-5dbd-4e3d-a208-6b4c1f06bdf9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--644ba6f0-4fe0-49e1-bb80-be4331bbcf93", "sighting_of_ref": "indicator--52b0910f-4f8a-46e2-96ba-c32d910b1988", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5d7f6bd-4349-4d35-84fa-603e0cb90b0b", "sighting_of_ref": "indicator--0978e748-3d11-4ac4-91f1-e82e11641680", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0612a79b-a276-4438-8fd0-0b16635d3a83", "sighting_of_ref": "indicator--bd59dc99-2f5f-415f-962e-064c63a59b3e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dbac683-81d7-4d39-aef4-cd43441b9c4b", "sighting_of_ref": "indicator--b017e4d9-c324-4242-8f0e-77eb03f77ef2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edcaeb75-c167-4f94-8bff-52ac76efb6dd", "sighting_of_ref": "indicator--b017e4d9-c324-4242-8f0e-77eb03f77ef2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aae6ba2e-c2eb-4018-88f8-7dd2fcd05d9f", "sighting_of_ref": "indicator--baa7df2d-2030-4d70-8aa7-a447b9b44951", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f950913-7694-4991-8afd-31eb657f93e5", "sighting_of_ref": "indicator--baa7df2d-2030-4d70-8aa7-a447b9b44951", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d506208a-5154-4486-a3ee-49bf839162c7", "sighting_of_ref": "indicator--a7b97c55-1edf-4ebb-b6c8-124a458df436", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc6cd63e-1282-4bea-8e0b-200d71473446", "sighting_of_ref": "indicator--385ec501-f6ac-42d9-afeb-8787f133f5b2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3aaa0a9-d003-4af8-830e-e81d0ae83d5d", "sighting_of_ref": "indicator--d64596a1-e973-485f-b386-430fba247f12", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ac427a7-a0ac-4296-bcc4-f71e4f208170", "sighting_of_ref": "indicator--d64596a1-e973-485f-b386-430fba247f12", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f01a2a6-cfca-462c-be69-92fa66b07bcb", "sighting_of_ref": "indicator--d64596a1-e973-485f-b386-430fba247f12", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03cd9852-ce3d-4d45-89a7-3b23b93cb1cd", "sighting_of_ref": "indicator--b1791e81-02fc-45f4-a79f-4bb2a2f650f8", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fe4fc1e-a668-49cb-b721-0ac0320a8c83", "sighting_of_ref": "indicator--b1791e81-02fc-45f4-a79f-4bb2a2f650f8", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a98614ae-fd55-411b-9d79-3489f714df41", "sighting_of_ref": "indicator--b1791e81-02fc-45f4-a79f-4bb2a2f650f8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d4e63e6-bab7-46de-b3ec-e5ad62b0b54c", "sighting_of_ref": "indicator--85509412-c996-4346-8965-941546b7f96c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd69411f-ee99-4995-965e-9e31d89d9fd7", "sighting_of_ref": "indicator--85509412-c996-4346-8965-941546b7f96c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8deef07a-9595-4798-9fff-ee1b0473b68d", "sighting_of_ref": "indicator--85509412-c996-4346-8965-941546b7f96c", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9d41bac-b5fd-4a2f-b29b-340c2afa2b26", "sighting_of_ref": "indicator--941644f4-08f4-4361-af9e-cb8c72dc3ff9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0489d47-9992-48c8-98e9-05efc0f511c6", "sighting_of_ref": "indicator--941644f4-08f4-4361-af9e-cb8c72dc3ff9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cff12f4-8fb0-416b-991d-005817c7e1cc", "sighting_of_ref": "indicator--941644f4-08f4-4361-af9e-cb8c72dc3ff9", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0db491d0-2086-44a4-973f-8f675d6c2574", "sighting_of_ref": "indicator--063d6e75-8840-46f3-80e4-1031d88cb6c3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cede1ec-78c7-468c-8265-f28451adb84d", "sighting_of_ref": "indicator--063d6e75-8840-46f3-80e4-1031d88cb6c3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f96fcb5e-5bfe-421d-81f7-7ef25ef9dc44", "sighting_of_ref": "indicator--063d6e75-8840-46f3-80e4-1031d88cb6c3", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f109ab25-e706-4bfe-ae4a-43d317e9720e", "sighting_of_ref": "indicator--5f19a7a3-abc6-45e7-b221-51d5c53c3e44", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aad06a2b-0ce7-4ada-8013-c3af79ad8f87", "sighting_of_ref": "indicator--5f19a7a3-abc6-45e7-b221-51d5c53c3e44", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--468263cb-29c8-4dfd-90cc-52824d11f5b0", "sighting_of_ref": "indicator--5f19a7a3-abc6-45e7-b221-51d5c53c3e44", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c814b180-88a9-49c5-a49d-d0e7754b6a19", "sighting_of_ref": "indicator--b5d49a21-6858-482d-bc6a-727694272bfd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccf7b246-f5a3-4496-9bc4-063d215049a6", "sighting_of_ref": "indicator--b5d49a21-6858-482d-bc6a-727694272bfd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcc52c23-de5e-4823-aa7f-c29f7583b705", "sighting_of_ref": "indicator--b5d49a21-6858-482d-bc6a-727694272bfd", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c93f283c-cfec-41be-8d00-54d91de51986", "sighting_of_ref": "indicator--f8b0ec87-5b81-4929-8816-defe434879e8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b060b2bb-5155-4e59-b277-7d1e7c46cd3c", "sighting_of_ref": "indicator--f8b0ec87-5b81-4929-8816-defe434879e8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1a9dfcc-64ea-47a1-8f0b-1059798235ea", "sighting_of_ref": "indicator--f8b0ec87-5b81-4929-8816-defe434879e8", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de1515be-1dab-4dcb-a8e8-fbbc459fdf97", "sighting_of_ref": "indicator--2fdf258b-1a30-4dbb-9e93-702a2be6db07", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0393522f-9ce2-452d-a9fd-7526b25d09fe", "sighting_of_ref": "indicator--2fdf258b-1a30-4dbb-9e93-702a2be6db07", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e200b7cd-3e11-4ce8-9cb0-352d16665dbc", "sighting_of_ref": "indicator--2fdf258b-1a30-4dbb-9e93-702a2be6db07", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e1c836d-1695-49f9-8ead-3136329494a7", "sighting_of_ref": "indicator--cd5ab9c7-a816-4ecf-b07d-6d5cd1622e10", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64c27345-fa73-4dbc-93ca-6ce689c55eaa", "sighting_of_ref": "indicator--cd5ab9c7-a816-4ecf-b07d-6d5cd1622e10", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc1c100e-2bb5-4050-a037-db92af366ad3", "sighting_of_ref": "indicator--cd5ab9c7-a816-4ecf-b07d-6d5cd1622e10", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac617155-b6c7-4bb6-b180-a3fcc3b15168", "sighting_of_ref": "indicator--2f6a1047-53d0-4d03-a0a3-8a6bdb753923", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec6e461e-6a4c-4ceb-b121-1b9352b2c816", "sighting_of_ref": "indicator--2f6a1047-53d0-4d03-a0a3-8a6bdb753923", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25cf1bd6-f336-4150-84e0-99dd45c7df3b", "sighting_of_ref": "indicator--2f6a1047-53d0-4d03-a0a3-8a6bdb753923", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--817e983c-5b27-470e-9097-d036875845ae", "sighting_of_ref": "indicator--19fb19a6-f6df-4078-9a37-9d92e8930a93", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c037c9c-044c-48ef-b386-4f24134951e3", "sighting_of_ref": "indicator--19fb19a6-f6df-4078-9a37-9d92e8930a93", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4406fb56-925d-4d08-a9f0-8d45847e6864", "sighting_of_ref": "indicator--19fb19a6-f6df-4078-9a37-9d92e8930a93", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44f56408-4800-40d3-9f46-026f9617e399", "sighting_of_ref": "indicator--19fb19a6-f6df-4078-9a37-9d92e8930a93", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d53f429-d72a-4601-a3fd-5084dbff08e2", "sighting_of_ref": "indicator--19fb19a6-f6df-4078-9a37-9d92e8930a93", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2dee82a0-0afe-4299-a89e-a1abf24391e0", "sighting_of_ref": "indicator--a5aedf8b-3312-4332-bd60-86dc0d6635fc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac10d165-5666-4b5f-afa2-a054945b4ebc", "sighting_of_ref": "indicator--a5aedf8b-3312-4332-bd60-86dc0d6635fc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34e76be3-10e4-43b5-a0d3-79cf1e8cceda", "sighting_of_ref": "indicator--7c76901a-dd37-4049-a556-e07499472a10", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4b1789a-fd71-4ebb-bc77-b832604db541", "sighting_of_ref": "indicator--b0301367-41c1-4bb2-b97e-c64198ea3a13", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0cd9c01-9064-40b9-bb18-6401fe15b609", "sighting_of_ref": "indicator--3b0d3f37-6ea6-4cde-a48d-14a517cf4b8b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0225444-03fb-46ce-90b0-5086590a005e", "sighting_of_ref": "indicator--3c69fe8f-1fa3-4b76-8800-a9aeb331b08b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--095e0ec3-a86b-4c8f-ab2b-9c472a3968a9", "sighting_of_ref": "indicator--c5844640-5c8e-4c15-94d0-b694c51e666f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e1166c9-9b7d-4992-858e-909979127b9d", "sighting_of_ref": "indicator--76e65a54-c3ce-4ecb-8dc9-ac0902861ddd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--367c3f77-e992-4766-98a9-071178943146", "sighting_of_ref": "indicator--37cb7e4c-c07e-4cf7-9a67-032e1f1495df", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68dd52e4-04cb-4203-9d78-fdb594aadd5f", "sighting_of_ref": "indicator--930192c5-89fe-480d-9cd7-21947bb9ac13", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a60c5d1-2bd0-4bb9-ba8e-2f3ab89bfebf", "sighting_of_ref": "indicator--fd24ae99-3482-46bc-8dd8-1b6e6d969528", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00bc17ff-369a-42c4-b682-54f69c0a4b52", "sighting_of_ref": "indicator--d7a4a774-bb80-4ece-9b82-b71f8e8cbaaa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3a74ce7-4bbc-4f66-9c9c-840c46c7795e", "sighting_of_ref": "indicator--8553c6d7-c467-44a8-918e-9fdd40f9b3db", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--201f6761-f871-4435-85b2-9c05fd01cd80", "sighting_of_ref": "indicator--e892c151-dd63-481b-9ece-f933ffd2027e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc78ba4a-9985-4b84-beec-0601cdcff0d6", "sighting_of_ref": "indicator--38a0d882-7990-4493-8d9b-db4f32b5fa07", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb597ce8-f15c-4b23-9386-2bcfc0e9cfb0", "sighting_of_ref": "indicator--13783ff9-84b3-41bf-b68f-c681a08fc36f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de1746c4-5456-4483-a93f-095542d36fa7", "sighting_of_ref": "indicator--08fbdd10-eb09-4687-bc99-b5b03ce0bd36", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5a0d357-6596-444f-ac44-c1c66f4f9a79", "sighting_of_ref": "indicator--5af51779-6efa-4c6a-817c-4e82ee84d8eb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6494aefd-8161-415d-9ee0-dd0c66d6d4cd", "sighting_of_ref": "indicator--b7568c16-d980-4c40-8f8f-7fb2b176b1b7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--580e9610-8dd7-4137-9583-afc1b45171cf", "sighting_of_ref": "indicator--e9c5eea3-3756-46ca-907b-72d105e62dc6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c235e101-408c-4e73-9bb1-db1239d81df8", "sighting_of_ref": "indicator--002be210-a7ca-4396-b0a1-50feb023be14", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32008197-15a4-4677-b953-5e7dec19ec1a", "sighting_of_ref": "indicator--6ae4d272-987d-41e3-bdeb-c5c8542f2121", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb956382-3582-4a9c-a9a5-d73f4670fa0f", "sighting_of_ref": "indicator--eeb10480-cf3d-4136-b01d-5345fdad38c7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7873a22f-dd07-496c-8a52-3a6ced98d07f", "sighting_of_ref": "indicator--1cc54ca2-81de-4038-9dbf-5c11c5e15b51", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d13defbb-655a-4e56-b12d-5827cad77ece", "sighting_of_ref": "indicator--2d99bfa8-021f-4588-a249-fe3014958cd0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8196341f-b309-4bfc-8348-d179c5a8ce92", "sighting_of_ref": "indicator--c6e25be8-0b98-4606-9224-2838f87d36fb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f38c3b18-8014-4682-9554-3acf65ef1fb0", "sighting_of_ref": "indicator--d8f63242-ebcd-4718-9913-a2af6a4dd73d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e141226-840b-407d-8c30-0eb32ccefd8a", "sighting_of_ref": "indicator--9797076a-7081-4dae-8325-b42ac0547ccd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--994d654f-027e-4ce8-b483-0c9d5369af22", "sighting_of_ref": "indicator--614cd3ac-0507-42f1-8939-3e13de5a3c84", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8ccd4d9-26d6-4493-9ce2-80557ea5ab6f", "sighting_of_ref": "indicator--489a1764-c326-48f9-844f-c7ca01c97b74", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be2d2852-5b90-40b3-bcf5-3572d96ea5af", "sighting_of_ref": "indicator--86683f28-e08a-4d78-8fd5-ff3984893c9a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9af54f6f-c386-4058-98c9-ed9ed36c21ac", "sighting_of_ref": "indicator--b88cc30c-1de4-4b86-8f3e-11615ed45855", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--020ecd44-2fd4-40d8-9d65-803e862a2d97", "sighting_of_ref": "indicator--0b352adc-d7fc-41ee-98ee-2279ca9137a2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e0f1188-5e86-461b-b492-5ff8d4feb745", "sighting_of_ref": "indicator--59ee7273-8ba1-4be8-bd6c-0d6e915ca744", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e27af17-75dc-4b58-981c-c16019c8bb3b", "sighting_of_ref": "indicator--bbdecd79-cf67-4db1-b41f-8f8799e68817", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d3c35aa-0bdc-4896-a801-0f6cad3b3770", "sighting_of_ref": "indicator--5ab0f4bf-3859-44d0-ae2d-c93c712b93ee", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--718c96ee-048b-48be-a90e-c9ce4e31fbd9", "sighting_of_ref": "indicator--8c8a3e6e-3d9c-4d3a-9922-719489c0c31a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08162b87-98e4-407c-acb3-9237f000371b", "sighting_of_ref": "indicator--8380e76b-2610-420d-9779-692906d7b372", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9077a935-c4c4-4d69-b1aa-dbaf9513ce92", "sighting_of_ref": "indicator--6155d9ad-55bc-452d-9fbe-fc482955b027", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7168a39a-ff89-44a6-b182-b6c65e6530ba", "sighting_of_ref": "indicator--9aabb188-369a-4830-b4cd-8f66ee6f3d81", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef87217e-1372-4381-9955-f2788b1f012c", "sighting_of_ref": "indicator--47902ec0-729d-47bd-8545-48214ad4c8c7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72f5e03a-080b-42fb-ac19-e04bfbce87de", "sighting_of_ref": "indicator--487fab6c-97b5-4c30-ad29-322cf974a8a3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b51d81b3-4d10-49f1-8470-e6b46ef48e7c", "sighting_of_ref": "indicator--521cc2c3-be03-48c1-be15-151aa1c2afa1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96826c64-a978-4822-b2b8-236f9cf1474d", "sighting_of_ref": "indicator--60066f0f-a570-4917-a258-71bbea68ee2b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b364f5f1-05ee-4a5d-a391-59cc1d86f451", "sighting_of_ref": "indicator--4a630ada-5733-40bc-b428-dd8287bf3671", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85f5ef4b-5764-42f9-b3d3-ea1990e159f6", "sighting_of_ref": "indicator--9c990e47-58e7-40df-9b51-5313392d12e2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d19c1c3-f0fd-40e2-ac69-d35e1a8dc37f", "sighting_of_ref": "indicator--c96bfb53-e152-4f46-8e68-1c8a1b155cf7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a261f35a-a83b-418c-857e-02f9808f10c6", "sighting_of_ref": "indicator--66e560af-ba1f-4f07-93ef-7e7d7f289eac", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdd171a2-5da7-4961-bddc-a0f8a5e0e419", "sighting_of_ref": "indicator--070b3fa2-a889-4e8a-8f26-9b483467c8bf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d66765d-08fb-4903-801b-dac7cf499b36", "sighting_of_ref": "indicator--f89ff36e-b04a-483f-a85b-40953ee7e608", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--992c33b6-b414-4293-bd2d-18fd4328756c", "sighting_of_ref": "indicator--88709e8b-924f-4c4a-a42a-454816e61519", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9963bc68-860d-4458-a979-60047653cf4d", "sighting_of_ref": "indicator--88709e8b-924f-4c4a-a42a-454816e61519", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab5b0352-8158-400c-bc3c-9e8bac0ee7f5", "sighting_of_ref": "indicator--7ea1e777-f0b1-43ec-947a-553d2cb497e9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edea1abc-420a-41bf-8885-4f75ebe4b1a0", "sighting_of_ref": "indicator--6fefdaee-b99d-4d31-b762-b66d38665850", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f6781d4-77e8-436e-b4ab-6d5c97e888ce", "sighting_of_ref": "indicator--dfe369d4-352b-4df7-be2c-a350833878a7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9d8312c-06ff-4681-8093-d4f91f272423", "sighting_of_ref": "indicator--74885290-ceb1-4ae2-b17a-49add5133428", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4c6f858-f13b-441d-ae79-afac75697dff", "sighting_of_ref": "indicator--74885290-ceb1-4ae2-b17a-49add5133428", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eefca877-0728-4270-b577-7eca8224db48", "sighting_of_ref": "indicator--f2964587-b868-4194-8de8-c47be643a7c7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--743d8a3f-fc0d-478a-97bd-d35fcd7371ec", "sighting_of_ref": "indicator--f2964587-b868-4194-8de8-c47be643a7c7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5657b35-e187-4038-b24d-7e0750e27e20", "sighting_of_ref": "indicator--5eefa6d8-a573-4382-808b-551d154b6c64", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf93f520-6b68-46b4-b4cb-d06952d448bc", "sighting_of_ref": "indicator--7e21b349-1f78-4958-bef6-b3cd02010031", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d007c871-f257-4d61-8d1f-66ef919c836a", "sighting_of_ref": "indicator--b763f521-8614-4432-bafb-aa35de4ebff7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e283298c-0a4b-474c-98af-8c8bf22e8b35", "sighting_of_ref": "indicator--2b0d1c8a-220d-477f-80e7-4ef3536bc1ab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2b0dfb9-257e-4ed8-ba83-f0d0a366a1c7", "sighting_of_ref": "indicator--11cc09d9-8100-4594-a091-12d748f8b4fe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4102399b-5737-4b0c-975a-eacc812fc7de", "sighting_of_ref": "indicator--89dbb182-9f71-4406-8a8f-59253229ceca", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40463fa1-267b-41f2-8c9e-36b619f0b3b8", "sighting_of_ref": "indicator--f4ef166a-dc57-47da-84c5-6b972cb484b6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4907e44b-0f49-4671-b681-62a5f654043b", "sighting_of_ref": "indicator--f4ef166a-dc57-47da-84c5-6b972cb484b6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--125b76e3-f177-46af-84f8-f4ac1e738464", "sighting_of_ref": "indicator--a4bfd3fd-b687-4f8f-811c-2d8e06cab714", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6966085-e65f-4e6d-a433-3769beae0fd6", "sighting_of_ref": "indicator--47bd6284-6cb2-40c6-856d-95c687cda76c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a33698fa-be62-42c4-b493-7b3d1ffa9b3f", "sighting_of_ref": "indicator--3f2d2dec-fc0a-4761-94f7-4786d4ff14e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cc6eafb-4e12-4786-a4e6-e02bb1553712", "sighting_of_ref": "indicator--b6ac48ee-c1ba-4249-a180-5c6f8aceac4b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df064e0c-636f-461e-9751-fbe06a76a207", "sighting_of_ref": "indicator--cd0f79d0-3059-4900-9af4-48c23c2811b3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39ac2a4d-d9fc-42ed-baee-8b03ed995fe7", "sighting_of_ref": "indicator--737d06b6-9fce-4557-8b5c-545ddbd98725", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a07a0304-e34d-46de-96e5-987f1722cc45", "sighting_of_ref": "indicator--737d06b6-9fce-4557-8b5c-545ddbd98725", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67b17986-909d-4f98-bc4b-05305ff7ccd1", "sighting_of_ref": "indicator--711ee24a-f0da-428c-9c9f-0640ff663c0b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b9ddd61-5ff0-43ce-acfd-9314eda8fbaa", "sighting_of_ref": "indicator--09cc1afa-4506-4065-b189-a0ffdde25044", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de1a7c5e-8794-446a-bec9-8a73b72fb125", "sighting_of_ref": "indicator--e004515b-1d8b-46c6-8d0b-a9d718e1d3a9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4449f6b5-b5b9-4f60-b20e-09a3b7325a10", "sighting_of_ref": "indicator--e004515b-1d8b-46c6-8d0b-a9d718e1d3a9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4a3ef5b-74ab-4ea5-b6d0-d60b1474fdd2", "sighting_of_ref": "indicator--e8cfe1df-8cf9-4725-a549-5c3e4fa28086", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f89a6c6-57f8-461d-85f5-bd21683a3702", "sighting_of_ref": "indicator--e4b7629e-ebf3-4227-bb3f-af4cdba63219", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88e85cb1-df35-4a78-a3cf-d4fa75223e07", "sighting_of_ref": "indicator--9a88ca26-4d8d-489b-9174-c8b96a391ca4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4bfee34-dd20-4ef6-b450-f94fd688d0dc", "sighting_of_ref": "indicator--db5c642b-f2b4-4329-b2c0-3a55ab0a8eff", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6083477-19af-46a2-b5ec-1a4e2140034d", "sighting_of_ref": "indicator--1b7dcdd1-513f-450d-af76-026a11fe1ca7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df8b9a52-be43-44af-938e-3f0f86166f1b", "sighting_of_ref": "indicator--1b7dcdd1-513f-450d-af76-026a11fe1ca7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e404267b-eb01-4900-9d36-014e0cc1d180", "sighting_of_ref": "indicator--3cfbbec4-a23e-4672-a010-3e36ad6c8a85", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce08dbf6-13fe-4acc-bf75-6ff44e2d7829", "sighting_of_ref": "indicator--2d1943f6-7ab0-4087-9c7c-6026bda67b34", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9662b53b-fc7c-427a-ac12-ca7d0705dc2a", "sighting_of_ref": "indicator--e16a836d-4a0f-478f-9402-eaf500d9a5ee", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b284aa46-0245-49a0-8653-d85e7a781927", "sighting_of_ref": "indicator--e16a836d-4a0f-478f-9402-eaf500d9a5ee", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1ff0488-d86d-4170-8b92-0d01f273f9bd", "sighting_of_ref": "indicator--678fae0e-85c0-4591-bd63-e1542418bae0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbd534d6-558e-49d3-890e-4787bb21e76a", "sighting_of_ref": "indicator--09c47098-5e98-4caa-97f4-33efe6e32173", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89d7fe8b-77b2-4c55-80d1-18c31b051d65", "sighting_of_ref": "indicator--5b1d463f-76ad-4982-849f-ae36a08f3770", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc311211-a687-46e2-b858-28b0b37a23dd", "sighting_of_ref": "indicator--79cd3c3e-a2ce-4c99-9c0c-065808bc8df6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7c68f3d-c685-4a0a-958c-51fd496c0509", "sighting_of_ref": "indicator--79cd3c3e-a2ce-4c99-9c0c-065808bc8df6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b044967a-18da-42b7-b9a9-2a29dde4255a", "sighting_of_ref": "indicator--ba46d5d6-b35c-4a65-b032-da75b5aacb62", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c9cbcad-71fb-4898-a6f4-e4a2de315542", "sighting_of_ref": "indicator--3d8f862e-78dc-4a81-9415-5eb0d8706e75", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--943a3105-0515-4988-8671-17cc20408f93", "sighting_of_ref": "indicator--d9d4fa60-8d1b-4206-9c20-06935d07154b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46bd8c2f-ca9f-40ae-a769-2eeaff0330e0", "sighting_of_ref": "indicator--5dcb4d9c-1b83-4556-a8ad-5b9925664144", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aee83c08-f38f-414d-9e03-fc397bb51498", "sighting_of_ref": "indicator--d0fe0789-0cd0-49c6-b0c5-68fc7f7b7e5f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0f93314-1279-4fc6-8054-0af1c4c61cf8", "sighting_of_ref": "indicator--6d2ddf86-0588-4a26-89e0-f963be9dc1e4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41c482a3-7110-47d9-899f-af73d07bbc9d", "sighting_of_ref": "indicator--ff34f1f4-8311-4744-bf37-6bbaab88d416", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--069d827c-4a1f-43d8-ab8d-c8da67ce3acb", "sighting_of_ref": "indicator--6e90765f-9bc6-48b2-901e-4bd3457e19d9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c662ccb-cfa7-453b-9bd8-0f172889fc02", "sighting_of_ref": "indicator--bc2b4ce4-fec9-412b-862a-932fe67d50b6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93ce89d6-fa01-4543-9eb0-7281b7fa8832", "sighting_of_ref": "indicator--5808cb1c-f2ee-44cb-bb72-fad134997202", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bc2a898-0329-420b-99d5-e76e3f02b307", "sighting_of_ref": "indicator--c4492c5d-c7c9-4004-8971-8002caf13315", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad0ea037-e6dd-4e30-b602-99ba4a7eccde", "sighting_of_ref": "indicator--51786ad6-3cee-40ba-8c9b-4dfbd59566e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b775fe24-f8a6-453e-a71b-ea01be25846f", "sighting_of_ref": "indicator--d0234889-f58f-4554-852b-49e9b6380583", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9857642a-52ec-45dd-9607-e053aa7eba1f", "sighting_of_ref": "indicator--776c7cda-992f-4191-a5b5-274a2b6a439d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0891a25-defa-49c5-9bb3-795fa3d37b6f", "sighting_of_ref": "indicator--30ea3e3e-d03f-46ad-96ab-628fd226841d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ade1f91-f691-42eb-a92c-5d19f3ed6627", "sighting_of_ref": "indicator--ece483a0-b746-48ea-b2ef-697c9b9adf27", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14db70cf-be27-46d9-91a7-6f76d6c73709", "sighting_of_ref": "indicator--ae0d7bf5-7b76-4586-a862-949487e3a4e7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06593194-c2ad-4141-84ca-382dae50e2d3", "sighting_of_ref": "indicator--c716d366-c0fd-47fd-9073-b56e83fe7019", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c826d254-d9c8-4c57-9dcb-b0363ab16e60", "sighting_of_ref": "indicator--41a13c83-474c-4018-8112-f249cfc458ba", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6b1e22e-79d2-42e8-a28a-3dcc025a5d51", "sighting_of_ref": "indicator--56bcbbb1-db06-4915-abab-5a835b63ad98", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdd6b875-5092-4d86-a52d-9f0055e138b8", "sighting_of_ref": "indicator--8b51044b-24ae-48ad-a908-daa305abae16", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8ce9b7f-b90a-4172-a014-6e2f05dfba43", "sighting_of_ref": "indicator--1e19425a-1105-4508-bcb9-db6760304fb0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b5286c1-f431-4cd1-b722-934244888435", "sighting_of_ref": "indicator--d272439b-bb88-4655-b936-a7a4e6b83b57", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf9fab6c-4b18-4dd4-afcb-c165c502b672", "sighting_of_ref": "indicator--ff277831-64ac-4a48-8372-34d8d24d24e0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6475cb2-b758-4ffa-897c-3181cd505749", "sighting_of_ref": "indicator--b0279116-036a-4f8a-9b4a-a9be38594e67", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--700e79b9-c0ef-4c26-8248-9bcca4c9d38d", "sighting_of_ref": "indicator--e05d77f7-f565-403e-a95d-52cb6c2ddaab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32c031e6-41f1-49bf-b578-4b9e3399b1cc", "sighting_of_ref": "indicator--db4ea5da-6c73-4a29-99c0-a028cbb7750b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35afe410-8c5a-4330-a046-a1ef9cece5bf", "sighting_of_ref": "indicator--83549d80-30cd-40da-9039-bc60347bbe9b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6ec9e86-3a42-4ad4-9a08-c999de17b274", "sighting_of_ref": "indicator--d59738dd-6679-4376-9423-3740fb6f9d6e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ee507ee-0cfb-40f8-a728-bae78ef9709f", "sighting_of_ref": "indicator--8d714b14-513c-46cd-8ba6-873528781553", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f55a55d-cd8f-4c27-9ae7-2fc552629460", "sighting_of_ref": "indicator--7c83d657-17a5-45f5-9bfe-266b76c2b55e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7a631c4-b22f-478f-a334-a6ae978bb00b", "sighting_of_ref": "indicator--048a2442-0079-4901-8537-5102aaf4d1e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab544e74-2a5a-4c33-bb6c-dbae176e3dc3", "sighting_of_ref": "indicator--c88a583c-32ef-4ea5-a80d-46bba9076167", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78af64c9-f7b4-4bb2-9837-64bc8c21a5d3", "sighting_of_ref": "indicator--0724e28d-b997-45db-833a-a3ac79c0b7b2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ba18bad-a7c0-4c22-ac0b-75008be28162", "sighting_of_ref": "indicator--8d2ebb4b-21b2-4178-a7b3-a42aaddde89c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e86099a-aab3-48f2-bc2c-54a0aecd97f5", "sighting_of_ref": "indicator--b27b491f-9153-4496-ac99-0b5a8dfd1590", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28929442-e5c7-4d8e-80df-bfd6a12eff9f", "sighting_of_ref": "indicator--0a2dedd1-c140-4935-b84d-16c1bd707268", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--093d6b37-162f-4561-9c0c-cd5945db512a", "sighting_of_ref": "indicator--8da054ff-b2f9-4bad-80eb-0d744e83ca53", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49fb4747-1042-4a08-882f-c4bc4d9a1315", "sighting_of_ref": "indicator--8277e4db-c8bf-4773-bd83-5a99e3ffd332", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3c72de4-e7f4-4fd9-9003-f565839cabe4", "sighting_of_ref": "indicator--bc63c3b4-4675-4f21-a7c1-ac79847ce9bf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cca679d0-8ea8-4783-8488-42039baf4186", "sighting_of_ref": "indicator--a0782e81-90cd-4e90-b1b2-f5350c0520fc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e509d1a-2605-4f57-bc0b-024d4b83db8f", "sighting_of_ref": "indicator--0e5a752e-00f6-4892-8d86-186eda93cb56", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eadd16a8-c90e-41ff-81f9-df18fa01cb3c", "sighting_of_ref": "indicator--4650f297-50d1-44b7-b4e5-0c144b155dd4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--675e613a-07be-4afb-a672-b1c602c371fb", "sighting_of_ref": "indicator--d94b23b9-0f63-4488-946c-b7debe150e89", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15992ca0-e57a-4180-b236-b4576722a456", "sighting_of_ref": "indicator--3ef5bb6b-1122-464a-a87e-4974d4ec2e87", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b953f32a-2ba6-4cd4-8b8e-c7c6660899d4", "sighting_of_ref": "indicator--b9af66a0-05b3-4896-a6ab-f6b5b31d62dc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53c3d527-a0d6-4247-a8ff-f515eb1ba6a1", "sighting_of_ref": "indicator--2a36c1ff-c98d-4102-b170-088801bdad31", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a985b417-ce33-46ed-8a97-6a841ebb3f72", "sighting_of_ref": "indicator--cefa8126-21a6-474a-b2c9-c3942f0bc0e0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ceb9604-4caf-45b0-aac5-6d15eb598ec6", "sighting_of_ref": "indicator--cd978eea-02de-4578-81e5-d6d137da76c2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--049b6930-e701-46c8-8970-993dd9ccf666", "sighting_of_ref": "indicator--91490fad-d5b4-4135-99b8-4e6aff9231c7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64e5f0a9-8160-48df-9692-95a5c38f6129", "sighting_of_ref": "indicator--9197a9c8-246b-4ece-8f0b-8e53a1862710", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3568f5d-aff1-42bd-8641-5fa7ca633370", "sighting_of_ref": "indicator--235e2a73-7189-4fa7-bc05-c7abf6389991", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b54319e-de7c-4d9b-9bc4-459435f2cee0", "sighting_of_ref": "indicator--166a91b8-5a74-496c-b926-881117be21a5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c8edf56-2f44-4c84-aa03-14fae29d9f9c", "sighting_of_ref": "indicator--e65f8e9e-2906-421f-bcb4-4598db19f2be", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--318fba8d-2b37-4960-8493-91006ce64197", "sighting_of_ref": "indicator--dc3f0788-0a47-40c5-89d2-2965ae2259c5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--443d2570-a40a-4300-a766-3fdaf45b6f86", "sighting_of_ref": "indicator--132f1acf-c525-49a1-b982-e8bd3b669951", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1aec67a3-2022-4a69-8641-b367ba4ab9b2", "sighting_of_ref": "indicator--a73b5f57-8bdc-46dd-8134-c2d2429b8f32", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab55afb5-b0e8-46f3-890b-bd5aebf9aa6f", "sighting_of_ref": "indicator--07eb7733-8555-4642-899e-b4e580598311", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef3e7690-254e-4f5b-8724-fcf6adda560a", "sighting_of_ref": "indicator--a3132c6c-3898-47f3-985e-98f830f0117d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dbfc791-bbcc-45b5-80f2-40189d08a819", "sighting_of_ref": "indicator--68087840-2eda-4f04-ab37-fd9fff80da58", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53edf65e-89d7-45dc-94a9-d81a27582c65", "sighting_of_ref": "indicator--ff9e345e-5cdf-42b2-9eea-13d960ea8390", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9470cc77-e3f9-4729-8f86-c6539a61ebdc", "sighting_of_ref": "indicator--a53b1d91-4796-49ef-a094-f13802a54e6c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f7985c4-3ff8-42d5-a7dd-cef30aca4c8e", "sighting_of_ref": "indicator--56abf054-ec38-4de7-af5c-bba5f3345c30", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2663d3e-06e9-4952-8bf7-e14032845da2", "sighting_of_ref": "indicator--9fad81cd-cd90-417e-8277-73f1024ebf41", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11fa482e-2943-488d-8029-971193caeffc", "sighting_of_ref": "indicator--da08923c-22d8-446f-9e8d-fe24ed54986e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77381b0a-2189-493a-8005-92927ce7746a", "sighting_of_ref": "indicator--01c41a16-fdd0-4286-959f-adcf59d81064", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba398aa8-695c-4fc8-8a19-6d247e619f42", "sighting_of_ref": "indicator--b029cae7-2de7-48dd-b4e6-9736c55da141", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f43504f3-627d-4e9c-81f3-084fbd8b797d", "sighting_of_ref": "indicator--433c25e6-3142-48cc-8d7f-076a344a2655", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa2159ae-9202-447d-bab0-f8cc7e787a34", "sighting_of_ref": "indicator--652e8526-21de-4729-b85c-e154bddac1d8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24eca0f0-0709-4044-bae7-2f55ff6dd9e3", "sighting_of_ref": "indicator--9bdfc900-8c66-45fd-a836-f13c0e85c342", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ebeade7-0c5b-4a2b-b141-1e301658602a", "sighting_of_ref": "indicator--ed83b897-6c79-47a2-bb03-ef0f45907191", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a8cbd42-dd02-4439-9e2d-84e88ec91d5d", "sighting_of_ref": "indicator--82853cf4-aa27-4f5e-b334-539e20265b49", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2aa2394-b934-4d73-ba58-5e30b48fa4b5", "sighting_of_ref": "indicator--72bc4e90-3596-4dd2-b25b-eea794bba8b1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de242963-5d3e-4643-ab46-d695d823791c", "sighting_of_ref": "indicator--823fda64-1982-4dfe-b833-1d3c57ddba03", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2cc1efb-bff8-4332-aa17-020e8450b1ba", "sighting_of_ref": "indicator--080560d5-6939-4e66-bd59-e5e6c634b326", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fb0b526-280c-45d0-a0f8-1f2e8204a019", "sighting_of_ref": "indicator--a0471af5-d234-4776-8bc1-02e79bb84c19", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8531bc8-ff39-49ae-95da-02d0ea9ab46e", "sighting_of_ref": "indicator--0b90724e-a0c1-44b8-b02f-1126666fe601", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--493e3d17-0efc-45fb-aed5-0173b698924e", "sighting_of_ref": "indicator--4fa96b00-8d9a-4582-8e85-1e7ab9f9a2cf", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7538e303-d665-4fb7-939f-111d1616fd97", "sighting_of_ref": "indicator--e75749f6-5aaf-499a-b036-de5a483cb387", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--667b0824-3301-4a06-acbb-0b5d14efc636", "sighting_of_ref": "indicator--c9e20603-2e9e-43cf-8ce7-647692d8f49e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07d5950a-2a6f-47a3-bfd3-32d22bf26292", "sighting_of_ref": "indicator--341dc24a-281f-49a9-93c4-a6fc6b97ceb6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff53f3d7-a93a-4ab7-bdf0-4718a6c88af3", "sighting_of_ref": "indicator--5618f400-bef6-40ce-ab8c-6467198d7908", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ff03273-a36f-4c21-be78-92c706b8c905", "sighting_of_ref": "indicator--33d3087f-beb3-44bf-8f10-18f8a15f0f8f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9afcdd76-840e-43cc-97d4-ea5d1d2792cb", "sighting_of_ref": "indicator--472c34a2-eb53-492b-b976-c71b5c0afda7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59f865cd-6e0a-4625-ac61-0e429d130cd0", "sighting_of_ref": "indicator--c1db56e3-34c1-4fa1-9169-49bcce964740", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bcc3709-cedf-4e31-b128-42ab5d931b3a", "sighting_of_ref": "indicator--1458d728-92cf-4e4b-a3e3-e143988da5d1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3f7102b-e80e-4a7a-9960-5ed02ff4fe9c", "sighting_of_ref": "indicator--849cd845-e6ba-4e26-9783-1b6d66e4e144", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bfc3ae7-acbb-437b-bf79-26622dad31e5", "sighting_of_ref": "indicator--69129e5e-b648-48ef-87ff-b723688f82bc", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf38fed3-a896-435e-b03c-3b6a9d8a684f", "sighting_of_ref": "indicator--f8e3b7d4-3771-47c2-9e85-2f6ad313ad82", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd50c0d4-b61b-47b9-af2a-f6bf791849bb", "sighting_of_ref": "indicator--3b66a83f-3d06-4c24-9a4b-ecf8ce32bae0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b431989-dcee-4a7e-acee-6bba6ac4278d", "sighting_of_ref": "indicator--8818dff6-a63e-4c93-b0b1-77bc50f7300d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca2efb67-6ba1-4cd4-a90f-ec5777dce37c", "sighting_of_ref": "indicator--a480a545-b4e3-4f08-95f3-462820c130e2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae2ffcdb-07f0-4558-9beb-0fc1118ad4e4", "sighting_of_ref": "indicator--ec7a2908-7ab9-4d10-a184-c4ba9e9f33f1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef57cc0b-996d-4a7f-870b-d13a1893220d", "sighting_of_ref": "indicator--ad25fd97-85bf-4c1a-9aaf-7eeb52affa36", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c924a85b-d623-408e-9c80-104ffde9cba6", "sighting_of_ref": "indicator--ca9858df-832f-4a5e-89dd-1b79cbc55c96", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd4db631-51a9-4938-b46b-9bc565a5a3fc", "sighting_of_ref": "indicator--43288992-f21a-42ef-a94c-135cff19c25f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8e410db-b53c-40e2-b5c2-8635a0bebb1d", "sighting_of_ref": "indicator--d8438afe-3ee5-475d-9f58-98d539428ae0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b529dde-94f5-48e2-89ce-50513154211d", "sighting_of_ref": "indicator--d8438afe-3ee5-475d-9f58-98d539428ae0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c712b633-25bc-402b-b72f-221959839cf5", "sighting_of_ref": "indicator--c0c2a7b6-b79d-4683-9d5c-78f4a3cc9f97", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee2efc34-6be0-4ba8-b704-27d23d084000", "sighting_of_ref": "indicator--fa018da6-d61a-4fdd-8c0d-2c15fc00f52a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4335b7a5-bb91-4d2d-9a19-79f5639aa63a", "sighting_of_ref": "indicator--0e498882-7c86-46f0-baf7-cdb3f16886ac", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2db9f4ab-66ae-4069-995a-ac2a70178bb7", "sighting_of_ref": "indicator--e936fb27-8aa8-47df-b733-fb2cc94c7754", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--954501fd-74b2-42e2-88e3-e19f9d20757e", "sighting_of_ref": "indicator--e936fb27-8aa8-47df-b733-fb2cc94c7754", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4669d393-1737-46c5-9186-f3106e09d9e2", "sighting_of_ref": "indicator--4cab5a9e-f8a7-4890-9fb7-e8f65cd15c2d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9461945b-cb03-4b88-8dbf-738163fe2389", "sighting_of_ref": "indicator--48e6f6c3-b896-42b9-aebf-d3bb5a958247", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e0afcd5-e2a7-4658-8f9d-57238a24e6d2", "sighting_of_ref": "indicator--689fe434-c303-4629-8678-60b12dd4db49", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4256164-596b-4fe5-aa3e-bbe9eff64c9b", "sighting_of_ref": "indicator--f88770da-500e-462f-b686-fb67b4708e5e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95d0d83f-700e-4b4b-af52-6957c2ed6207", "sighting_of_ref": "indicator--40bb45ba-1f5c-4fa0-806e-df0dfc951a41", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b393bb1c-66b8-4552-9d6c-bcf143f99fcd", "sighting_of_ref": "indicator--88953823-f56b-4912-9c3e-8123cb11dae7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b86285e5-9155-4f6b-8d0d-106043165c15", "sighting_of_ref": "indicator--3cdaa2be-cc13-41d9-96b9-5f733f56cddb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe10be97-6f89-436a-ad88-c88b57a88d57", "sighting_of_ref": "indicator--ffcbed88-1554-4157-a68a-ea672ca59621", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0e0f39a-5198-4ae0-a122-ce07d26fceb5", "sighting_of_ref": "indicator--83433657-e5b9-4104-a8e1-b1ab402241af", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d6aba08-ffe3-4b4f-886f-cee73fa576cf", "sighting_of_ref": "indicator--77b38c04-8ffb-4922-b6cf-d47d3d8b77ba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54144bca-d978-4a4f-b6d1-2561e9f5d5e4", "sighting_of_ref": "indicator--9ccf1666-68fd-4d11-95c0-db79ab40cbbc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15337c7c-9778-439d-8009-97d8a722d0ac", "sighting_of_ref": "indicator--83a19ef3-f21e-4625-83d9-4bbdfce2997e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b175c162-ddc5-4598-984b-2872ffcb4f64", "sighting_of_ref": "indicator--31ef3192-a307-4b98-8090-36c500a7dcb7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a70ef537-fe5a-4ee5-82ab-1f8591bec986", "sighting_of_ref": "indicator--26e2b6ab-b7c4-4aa8-bda6-077065cc6bd6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac4056d2-bb04-478b-a120-c079732e4c30", "sighting_of_ref": "indicator--103d4da9-9941-4373-b501-3fecea300ba2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8adb7a39-7c64-4ac9-befd-beadc269ec6c", "sighting_of_ref": "indicator--9183f395-4d22-480f-9660-904a40f1857e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b1f3f0f-0e4f-4a48-82e1-89c9c9fa6f10", "sighting_of_ref": "indicator--7be9c7ce-7d35-4dd3-9233-38ec874c527f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bc908c5-02a9-4acc-9316-1565deebc005", "sighting_of_ref": "indicator--a6ab5e2e-b6b9-459c-8153-9a1f8c4eb657", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22bab729-8d41-4b73-b0fb-29d588d0540c", "sighting_of_ref": "indicator--768d03b7-0e0d-4137-ac83-b772596339b7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--838a31e1-7918-4047-833d-74dd15aae1ab", "sighting_of_ref": "indicator--486f01fd-74d3-43b9-aebb-545c1cff4eee", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca49b935-8ee8-4b56-8007-04bf7d2b2df8", "sighting_of_ref": "indicator--42affa3c-b30d-462c-8e18-464eec5ed952", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60295a65-8a46-4eb6-a64e-4fe942b42921", "sighting_of_ref": "indicator--df496118-b5b2-4f25-ace2-bab9bb48fd64", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34369760-c6ed-421a-b3ae-81494aed9cbe", "sighting_of_ref": "indicator--a661cda8-8aac-45ac-8dce-a48e23efd1e4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffeb3c26-3033-493a-bf85-8cabf261d086", "sighting_of_ref": "indicator--24a0dc65-f777-4906-bd9f-4654e7875a4f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79332897-885b-45e0-adaa-88f57174ea7b", "sighting_of_ref": "indicator--652bc48c-6a1d-4eb0-8567-fba2fa6f9482", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6348c34c-e8b4-4c7a-95fe-c43ef229d234", "sighting_of_ref": "indicator--f88ea7b2-0808-484d-b5f8-458f1b24d70d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea20e9a8-3d12-40f5-a653-e747027437f3", "sighting_of_ref": "indicator--7d7a6da9-ea24-4837-8cba-c48ddf6de098", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e51c5ca1-0a66-463f-9119-a1f504068aaa", "sighting_of_ref": "indicator--6c28bae4-89b6-45cb-87ac-2a69afbe0047", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca8e77cb-f11e-46ca-853b-cea5bec12f0a", "sighting_of_ref": "indicator--e963e58b-d5f5-4cf7-9207-9eba92ad4a4f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c188dfaf-ed2c-4b50-aa37-e4be168006e6", "sighting_of_ref": "indicator--be67d830-ec91-4b68-9d05-5f54c6b520af", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbd70507-2682-45d1-9562-d746c9c666c1", "sighting_of_ref": "indicator--a770d2f6-f0f3-43ac-8c9c-58e408eab8eb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6787b4b4-4b00-477b-b874-f1e79663a51d", "sighting_of_ref": "indicator--965cfbfb-542c-43e2-ac82-fd06c24c93df", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f945cef-c85d-4426-b496-e186c74e1bc2", "sighting_of_ref": "indicator--6af4d196-111a-4546-8fcb-6f296e29a062", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03ca7c46-6ad9-40d8-b4e9-07364dfbcb0b", "sighting_of_ref": "indicator--f2720729-3803-408d-80a5-a9bd4b0c8392", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4af326e4-9a09-4370-b2c3-3aa622703a01", "sighting_of_ref": "indicator--b0531c64-094a-4a28-b108-4cb9b1512998", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4b5ea82-20dd-4fb7-861f-51f7cedc5755", "sighting_of_ref": "indicator--cf852065-11c1-45c3-a017-9df8b371bc07", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--beef4874-75c7-49e9-b6c3-423818f0988e", "sighting_of_ref": "indicator--f0d9b60b-f9dc-43e5-85b4-6f5841c2b38a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd42b178-9fdb-4322-b203-ef0544f087b1", "sighting_of_ref": "indicator--f0d9b60b-f9dc-43e5-85b4-6f5841c2b38a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35f93b69-515f-4602-9f7f-44f65cbc59e2", "sighting_of_ref": "indicator--2ed01a6c-8daf-47df-8d1a-aa7785d53081", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99d0eaf7-65d6-4b86-8c31-55ca19893872", "sighting_of_ref": "indicator--2ed01a6c-8daf-47df-8d1a-aa7785d53081", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37ecddd5-d797-4237-b7ed-10e187904cb4", "sighting_of_ref": "indicator--6c2451e1-c0bd-40a8-ae3b-9ce6172e3e88", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae53c633-d651-4861-9f5e-29bb9c044316", "sighting_of_ref": "indicator--e3173e9b-7efa-4900-961a-1508a6e3165c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46b52cd5-9b24-4cbb-976c-20a63bda12c4", "sighting_of_ref": "indicator--592b6290-533e-4a33-8fb2-6ef5a4782d34", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21467535-5f09-4c6b-9bdf-5991bdad11cb", "sighting_of_ref": "indicator--2d37d0f7-963b-44b2-a6af-bcf35521c438", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19e1b410-c62e-465f-aa93-665a5846791a", "sighting_of_ref": "indicator--920e9c3b-8395-47d8-831b-8b80d8b7ab89", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be99ac9f-f5d7-4ee0-9452-7a24b0c8d72e", "sighting_of_ref": "indicator--246e91a1-7651-41b5-aa56-46989f18af22", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64e4497f-2817-420a-86d3-4d596c138201", "sighting_of_ref": "indicator--58855923-f412-4342-b314-d2535da22d85", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b60eb053-5302-406b-9806-c242ce2fb6da", "sighting_of_ref": "indicator--59d3a91f-2e68-4587-bba2-fd57aad8f838", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--917765e6-ff81-4ecb-93bd-eccc90f3d29a", "sighting_of_ref": "indicator--59d3a91f-2e68-4587-bba2-fd57aad8f838", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f174685c-6681-4f72-8b18-1268d3349613", "sighting_of_ref": "indicator--563acf67-d3e6-4479-8b70-4c84b4c837e4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3de61711-6e75-4316-b988-13a8a161b6cd", "sighting_of_ref": "indicator--7cadb991-33ff-4967-ba39-31afd323e2fb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5994c48-b732-469e-b40f-00b514d57a79", "sighting_of_ref": "indicator--6fd0137a-ab11-4b8b-986e-13e43bdfd81a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67ca3f2f-a50c-44b0-9058-22f6cc102def", "sighting_of_ref": "indicator--1cf691d3-14e2-4179-a61e-3c170f9b502a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--537c03c7-0a94-48ef-8057-7c37cd88da61", "sighting_of_ref": "indicator--688bb833-9c17-4ab1-b947-7feaa310ccaf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a9bc406-c344-4231-a51d-9311c0c27cea", "sighting_of_ref": "indicator--0b1ab3fd-4ec8-4e43-ab31-dcaa5cf1b071", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd7cdcc9-0e39-4e52-9d0e-9e2bf051d628", "sighting_of_ref": "indicator--ea3d3e57-18ba-438c-86f4-e6de0352a6e9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6fd993f-b264-4bc1-8b37-f90cc6e3c783", "sighting_of_ref": "indicator--87e2295e-fa2f-4d2e-a63a-220bd795cf67", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7a6658f-3430-44ec-82eb-0905c2ee94d0", "sighting_of_ref": "indicator--6421379a-c9e1-4743-9762-6487efe3e9ad", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--626a244d-f256-42d5-b5b9-360e5c7deabc", "sighting_of_ref": "indicator--b01e2a15-e7e0-4d3f-be24-8958138cb5c0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--509c47a1-e8b4-40e4-8735-ac8ee429bbd7", "sighting_of_ref": "indicator--15ca9136-dc90-4225-8c56-cef39c05b318", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4c0c1c4-cf9a-481c-aacc-be15253d291a", "sighting_of_ref": "indicator--b52107ef-af87-45c4-b2f6-38bcc2103bca", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55bd5878-3b00-4438-a1d8-8fee000ee1c9", "sighting_of_ref": "indicator--fd8c9f7e-a3e2-475f-9249-00d5bc7d15e3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--136de8c9-b96a-437b-81fb-eede40be0b06", "sighting_of_ref": "indicator--259108de-c930-41c5-a382-e108c63f615a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d20e655e-0240-43e1-9379-9cbbf2b5a788", "sighting_of_ref": "indicator--d48e6755-af68-4bed-b375-003831500c95", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--943415c0-9b19-4769-95a0-fd8ad8dd64fc", "sighting_of_ref": "indicator--85863ea0-1a67-4928-8750-7796b65fd277", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8de8e1d5-f58f-43ab-a571-7171c4104c1f", "sighting_of_ref": "indicator--e461766f-2715-485c-85e8-87eb27a1273a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a7436b5-e4e3-46e8-92b3-74ef62308777", "sighting_of_ref": "indicator--265d06b0-6253-4c1d-b329-57fba6440cec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b587963-2d9e-449b-89bc-4da1566fa754", "sighting_of_ref": "indicator--94d03ebd-3e61-4022-921a-42f99980ec72", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ddd7fc5-441d-40b3-9f26-fd78007488d9", "sighting_of_ref": "indicator--1b54bdb4-df30-4df9-a2f1-3f1cd5930798", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb475533-4b64-47ff-b351-a23b5689615a", "sighting_of_ref": "indicator--2740eacb-5a21-48d3-9bd8-df8eb2d02aed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a86958f-4410-4e00-9326-c8093442aed3", "sighting_of_ref": "indicator--27169f48-1d13-4e99-8bd7-ab0063b7d238", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d51134cb-e5de-4f5e-844f-532ef4c2cd92", "sighting_of_ref": "indicator--30c4b9de-79fa-4386-97bf-ff53fadc7a75", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd7d8f04-75b9-48d2-8476-7f2675e3a36e", "sighting_of_ref": "indicator--50c247f9-8938-4513-a5c6-55b78d93efcc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2de69239-43f1-4b28-811f-2a49ef00fad6", "sighting_of_ref": "indicator--610af9f2-2236-4884-95df-dae867e99e8d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8be3136e-ba67-4657-a938-aa91fbb1e10a", "sighting_of_ref": "indicator--610af9f2-2236-4884-95df-dae867e99e8d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1245aa86-cd85-45b7-9392-f41a0ede8113", "sighting_of_ref": "indicator--d358dfd2-59f4-4639-9505-d005b911ead0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29619246-84cb-4518-b5af-9568af972d4a", "sighting_of_ref": "indicator--d358dfd2-59f4-4639-9505-d005b911ead0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0807181a-c89f-4765-9a02-9f285d039a1e", "sighting_of_ref": "indicator--d53163b6-fd54-4739-8b70-4fc916c98522", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--080ec1af-16b7-4fb9-83bd-60b7357287c8", "sighting_of_ref": "indicator--583f26cd-dd46-4093-aae5-d3aee4a9b869", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd30fa7b-064e-4de4-a2f5-b5179e600426", "sighting_of_ref": "indicator--e19a0270-d15d-4924-97f3-1145aff3caf5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9a1c28a-6e8b-485c-828b-174d70766da5", "sighting_of_ref": "indicator--e989182d-b66e-4be0-92e8-258e4918998f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1c397ea-61e2-41ab-ae3b-cd95df296cb2", "sighting_of_ref": "indicator--95cb0703-02e1-4284-9413-9c2c0bd8caed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--904aee1c-77a4-41b1-913b-52228f6ccd72", "sighting_of_ref": "indicator--caa0f598-5fcb-49ac-a1ec-81863da24e16", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7232e0a3-77e1-4622-ab19-d10ee1429586", "sighting_of_ref": "indicator--1e8cb37e-5b20-48f7-aeff-134e5df93a8c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37fa284a-34b7-433b-be34-9e83fd20f4fa", "sighting_of_ref": "indicator--48d85367-8dc1-4e94-b5e5-7dd227080544", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90db3a27-950e-4afb-a036-6b901a7e840f", "sighting_of_ref": "indicator--b5025a24-83d6-493c-b27d-f7640104461b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b74a5a6-c229-4594-8dd0-f13bc0f76371", "sighting_of_ref": "indicator--8ed52d6a-b448-4e06-ba67-4148a43c6330", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b804b72-59d4-46ac-b974-8da1c13fd590", "sighting_of_ref": "indicator--d32c7dee-d8a0-44b1-aa21-57c64763083a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7fdedc7-eab0-4a68-adff-056c9231206a", "sighting_of_ref": "indicator--32107bef-1eb3-421e-a5a8-ee8aa9e7b26d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57aa8749-af1e-4c5a-9bbf-30a876384568", "sighting_of_ref": "indicator--2473ed7b-ca9c-495c-b752-bab0900ea22f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ed89405-7d9a-4a20-905c-093409266881", "sighting_of_ref": "indicator--17817a3c-f7a7-4dc8-a3ac-35dbcef8199e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--407f958b-6c61-402e-8b3e-cdac4db3c317", "sighting_of_ref": "indicator--1ea03466-c015-4b0a-8e4e-a4c98b2345f6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe558c66-2294-4f46-8e8e-6fb2a08dab0a", "sighting_of_ref": "indicator--1ea03466-c015-4b0a-8e4e-a4c98b2345f6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7a257e4-49dc-42c8-8a40-ac4cf98a3481", "sighting_of_ref": "indicator--80e593d4-1e54-4eb1-ba99-33c387735189", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47f74b49-8bcf-4d5b-90d2-3f4857fd25c5", "sighting_of_ref": "indicator--69edb109-6b9d-4a13-88cc-740a386c431f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbb290eb-afcc-48b3-91ee-5eb99e57fd49", "sighting_of_ref": "indicator--69edb109-6b9d-4a13-88cc-740a386c431f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85460ff3-1963-4e4b-a501-0b2a801a7b88", "sighting_of_ref": "indicator--d31d0fbc-be60-46c4-a94f-ab328f7f6c81", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4069da5-bff8-4a0f-8e7c-e01298a95bf2", "sighting_of_ref": "indicator--8e3fab9d-c3a7-4b49-8fee-12721f44313b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c61fa45b-ca95-4b6d-9526-19a1aa8887a7", "sighting_of_ref": "indicator--7db2451b-8b81-4bea-8444-4ab0b0f26212", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e802adf-6bd4-443d-b866-25906166e6f7", "sighting_of_ref": "indicator--6cd845b4-6961-4303-86b2-c2213d58c33d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1c6c005-892d-4e97-b141-3917d2ae0cb0", "sighting_of_ref": "indicator--bb93e6aa-70f2-48b0-877d-346d910e6ef5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--622ddc53-42e6-4b34-8faa-c2121358a0e8", "sighting_of_ref": "indicator--a0f3cbf0-6597-4ce5-a1fe-34267c25f1bd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d3874ab-68c8-4bc5-9865-0bbac70a7034", "sighting_of_ref": "indicator--43467d34-ecc3-4b54-9bdd-8deade14ac4a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f673c129-10f7-46ae-a3c4-b32c60434c32", "sighting_of_ref": "indicator--2d6c426e-ac30-467b-b48d-8c5c063b8475", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af47408e-ea77-44dc-a9d7-71670a7bfebd", "sighting_of_ref": "indicator--4841d766-8045-40b4-abe0-be44e5b28a60", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ead4080-ec2c-4d90-b85f-3b4bf29886d2", "sighting_of_ref": "indicator--cb9071d1-a395-47c7-ae00-d65d9bffc521", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfa438a4-f90e-4dfd-93e7-962b9b72413f", "sighting_of_ref": "indicator--cb9071d1-a395-47c7-ae00-d65d9bffc521", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2aabd3a-5547-4252-a79e-5814c1f9906e", "sighting_of_ref": "indicator--b2463053-3a86-4004-858f-77f2a1cbb97e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d892080-b9ca-4c2e-913f-bf7bbaed8c5b", "sighting_of_ref": "indicator--72db6fd1-c29b-477c-b30e-1dc68b23d769", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8b55502-39b7-4fde-8dff-b5ab4e874e34", "sighting_of_ref": "indicator--c6b68146-10de-4b5d-814f-84599e4c265c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cf545b3-811f-46cc-831c-9d0218f58b8e", "sighting_of_ref": "indicator--00cbdddf-7966-4dbb-8dea-928a1681f304", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89166d9e-3326-4031-aef8-3491a47bb1a1", "sighting_of_ref": "indicator--96cb6958-8690-48ca-ad93-57f53516aeec", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--666038f8-58b6-4913-b861-93f456dc00bf", "sighting_of_ref": "indicator--956142af-c748-4c04-a45a-bc9fb3d8c409", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ba44368-7d24-403d-a3d8-aed24c629a4b", "sighting_of_ref": "indicator--7d06ad40-a020-433d-b7b5-b457a7405ac1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8127ea1-83f8-4266-ac33-755a1b8e92f1", "sighting_of_ref": "indicator--400ce8c1-992e-426f-afb8-2e9303e0c34f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19f331db-94f2-496e-9b14-9162c727e7fd", "sighting_of_ref": "indicator--b8389f70-d421-483f-b4cd-b7ede4b319cc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ce8b2b8-9f90-4ea5-97aa-53be2b557c5e", "sighting_of_ref": "indicator--489eae9e-63d0-440e-8edb-93ef877a7e25", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c61832a-0448-43ec-906d-3b0fb6b59fe4", "sighting_of_ref": "indicator--ee98baa5-79af-4b24-ada4-4743347a461d", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c42da289-7417-4bca-9e38-f7c6b2bd7c94", "sighting_of_ref": "indicator--9ce3f7b4-7ed2-4603-882a-cbdca4c6e6be", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8967f63-a31c-4f89-8e52-ffad9a7ba03c", "sighting_of_ref": "indicator--9ce3f7b4-7ed2-4603-882a-cbdca4c6e6be", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37ff91c0-61f1-43b0-915b-e56afbc50e51", "sighting_of_ref": "indicator--10f63841-def5-407b-9ddd-baed7d30dca6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08f14277-9e64-47ac-8402-023b2d416f98", "sighting_of_ref": "indicator--eefe9ee5-e5d6-4166-aa0e-26f8e2b94d60", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fddc3869-e8da-4f08-812c-70e69d89571b", "sighting_of_ref": "indicator--4a9178ae-6865-410f-87ba-900393313b31", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d126e65-4819-4b68-a1b7-8b89881456f4", "sighting_of_ref": "indicator--78a8682a-5e41-44ec-9a54-58d8f85991cf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdc4ad81-5f7d-4a56-97d8-0e6d38e46fa5", "sighting_of_ref": "indicator--f728f609-092b-4b71-84e7-ac9eae0b0502", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba735e32-87f9-492c-99d9-48f02818b6cd", "sighting_of_ref": "indicator--2d759e35-9bf5-40c8-9942-93c6a71d9f73", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84e0926f-3c2c-48c8-8124-9f48c7afbf6d", "sighting_of_ref": "indicator--2acd792c-6fc6-4c53-b70c-cdc1bce10843", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccfa4758-d57b-441c-be8f-f24b1fa4c7bb", "sighting_of_ref": "indicator--913ec81a-944c-4feb-924d-5b3fc2697ec8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdeed33a-38a6-40f7-accb-9d0f7fc5bc3f", "sighting_of_ref": "indicator--913ec81a-944c-4feb-924d-5b3fc2697ec8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7377164-94ec-4b8d-9034-57d686ada806", "sighting_of_ref": "indicator--74d143d5-6322-41d0-a88e-b8add44581e5", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f6ecd24-699b-4f72-9650-5dd6ba6c10e6", "sighting_of_ref": "indicator--7740bfc5-6f87-474b-90af-f797f4250d83", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8c698f3-b915-4e97-b27e-b11df251bd2f", "sighting_of_ref": "indicator--6dad6fbb-f77f-40e4-8799-801b1827f155", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--445efe07-c11a-4d43-a003-1fb0ec9bb451", "sighting_of_ref": "indicator--04f03b41-3039-4cc0-881d-9e8f339e8c21", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7ace793-cb41-48be-8e13-4cbed6ab3a51", "sighting_of_ref": "indicator--07c31aa8-8554-4992-81c5-38eda0f0908f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89b6d51c-767b-4133-b5ee-1a7eea610128", "sighting_of_ref": "indicator--8d22af61-59dd-4fbb-97d3-63e081c4b331", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6c3f628-33ae-46f1-86f8-78fe5a6e6bc5", "sighting_of_ref": "indicator--5fde013b-22d6-47db-9b96-9a77ace465b4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--933650bc-93e0-455e-bb07-8ea26922d4dc", "sighting_of_ref": "indicator--3846a148-fdd0-403e-a781-3827e4140c9e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--678e6ecb-2037-40cc-9c2b-87cfcb0a0dd0", "sighting_of_ref": "indicator--baa4bb03-e8a0-4601-a722-b977127204d8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86b532f0-7f71-4fbe-b9b2-f20bf0279d6b", "sighting_of_ref": "indicator--540da561-bc9f-49a2-86a7-31ee09c5296b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcaddcda-5f95-407d-83ed-2c10b88e9e27", "sighting_of_ref": "indicator--c91d98e6-09d3-49c2-85ae-ba530d891f8d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d351b12-3c6e-4cbd-bfcc-e9336c90931b", "sighting_of_ref": "indicator--33d179a1-73ac-4e08-ab87-174dddcf89c8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba97354d-826f-41ae-a3eb-1a2275a197e9", "sighting_of_ref": "indicator--8f46ce94-da94-4432-895f-ada27aa5f624", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dcaf3a5-ed71-4f18-a225-ac7fe9d8b93c", "sighting_of_ref": "indicator--6a6d3469-3a0e-4fc0-8576-12355799fa65", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d63739d5-2225-420b-bf6f-b33a559219fd", "sighting_of_ref": "indicator--66da04a6-9847-4e81-b385-1d4a1d195f64", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b06463d7-0716-43b3-9457-334a0e873ee4", "sighting_of_ref": "indicator--fa4afde9-9aa8-4a99-a71b-29ea5c269e11", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e53a94ac-7d1d-4d76-bfe1-35175884d7ae", "sighting_of_ref": "indicator--9b932a1d-7d0c-416f-9e0e-9d7d0878052f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a60030e5-ef73-4f00-8b7c-6bb3f99e9e8c", "sighting_of_ref": "indicator--7f89ad9e-6819-4ddc-8830-c47a352bd24b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f90aef2f-1657-482b-9794-cb24753bbb9e", "sighting_of_ref": "indicator--7f89ad9e-6819-4ddc-8830-c47a352bd24b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af64d018-99d5-4187-911d-89964d779fd7", "sighting_of_ref": "indicator--f68f48fc-0e01-456b-b412-e60eea054da7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--232d7e35-405d-4afd-a424-a235fd6f1847", "sighting_of_ref": "indicator--679d354e-2ee3-46ad-924a-3aa72293cce5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9366cb9-d2c0-4636-8aa5-4c2d02ea69ce", "sighting_of_ref": "indicator--23a38782-161f-4b03-b0f6-350ca76b3276", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ef79578-4dd0-4ecc-bc79-13a52f088a80", "sighting_of_ref": "indicator--e40ba9c8-aa18-4f47-859e-121aa20e102b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6aad5a6-c757-40e2-8483-ba189c08f379", "sighting_of_ref": "indicator--e40ba9c8-aa18-4f47-859e-121aa20e102b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b572bef-18f8-4518-81b2-fd888baf343c", "sighting_of_ref": "indicator--a8316c36-375a-4491-b16c-2ddf910ad8a3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--037df26d-4706-4abb-9000-5b3d1f5240d6", "sighting_of_ref": "indicator--50200631-f960-42ae-93ee-92da549bea56", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6d7dda7-e621-4a34-a0ff-886408df794d", "sighting_of_ref": "indicator--70826838-bbd3-435b-a610-2e00339b0e68", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--539abecf-9656-47cc-b67e-de3d60d60c4e", "sighting_of_ref": "indicator--a3248d41-73f3-48f4-8e74-ce7f693f6227", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcb106f4-b1d4-4f78-8ba8-47ec1a7ea06e", "sighting_of_ref": "indicator--7708e27b-a818-40b9-ad78-a710a2a4e683", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3f1705f-c8d8-4712-868e-0010a45b00ae", "sighting_of_ref": "indicator--c20b5d0a-dc27-4cd1-bda2-48ce696a0c55", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66100c70-39a4-4ac1-ac01-b51a6a5b5712", "sighting_of_ref": "indicator--de7295b2-7690-44dc-b42c-4b71cb536034", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9744a4fd-1e1d-48e6-af0b-3a9231393417", "sighting_of_ref": "indicator--0d198956-4f92-44c9-b5f4-9217be53a34a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd38b846-4de4-4d77-ae6a-98d795fbb7bc", "sighting_of_ref": "indicator--0d198956-4f92-44c9-b5f4-9217be53a34a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfda82a9-205f-4cd9-9701-7758771991d7", "sighting_of_ref": "indicator--865158ef-29bf-4c58-877b-d27479940b55", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7836636-c6b0-4e8d-8485-949713539829", "sighting_of_ref": "indicator--865158ef-29bf-4c58-877b-d27479940b55", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4bbbc8b-f1c9-4713-b0c7-d5dfcb31f6d6", "sighting_of_ref": "indicator--2df1edf0-863e-4f8c-b9b4-e6c88026d3c7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17642db0-2475-48c5-8dd6-01bf3c8f2a8c", "sighting_of_ref": "indicator--348b8e2a-30e3-4286-bd29-11a64323a22c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1c6420c-8d4e-4ded-9f87-493d03b7d1a1", "sighting_of_ref": "indicator--348b8e2a-30e3-4286-bd29-11a64323a22c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6f5b186-34ff-41df-ae57-0f5adf0a0fbb", "sighting_of_ref": "indicator--de195f8b-376f-4ef5-aec4-4103d7e1f159", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--882a14b9-11aa-4ca8-a0aa-4ddeae51db59", "sighting_of_ref": "indicator--de195f8b-376f-4ef5-aec4-4103d7e1f159", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbe53dd9-a1f2-4246-ba96-306fca039817", "sighting_of_ref": "indicator--c71d0bbe-33de-4b93-8d67-d2ca206fd110", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b6b7e1f-0ebd-4bce-b179-9f111eab2d95", "sighting_of_ref": "indicator--e6681b26-5741-45bb-9dac-c6fa09889405", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a64d509-d752-4ae3-9705-87596a10d0a9", "sighting_of_ref": "indicator--e6681b26-5741-45bb-9dac-c6fa09889405", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d08d7fbc-4a3a-424a-bb46-4874df156b3d", "sighting_of_ref": "indicator--ddfa24d0-c8f0-49c2-b3d3-0b415c7b5942", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4d36d75-261d-4c99-8b36-356185c2b5ae", "sighting_of_ref": "indicator--4724b6af-a2c2-4f81-8b95-9fb52c1eaead", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4ad197d-54ac-4e5f-95ec-aad2f1c99be6", "sighting_of_ref": "indicator--dac7dd04-555c-4e69-95f7-59afc3d470f9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36b66339-d502-48e0-a434-21cfca395190", "sighting_of_ref": "indicator--9a97613a-12b3-401d-8b9b-9d42848edecf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a6f6b04-ae20-4dd8-843d-a210172c16e3", "sighting_of_ref": "indicator--5463b5d5-d91a-498f-97b9-19a9c391cbd6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdb70d56-41e6-4a0c-b9c2-0c52c0eae7ec", "sighting_of_ref": "indicator--04ab1618-d0cb-4b24-9766-89e2cbc62123", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1903c29-0e6c-4194-981b-dd186d235674", "sighting_of_ref": "indicator--37355929-94df-4d52-95b3-2e631f4bff52", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8db1e50b-f3de-498b-88b2-27749cbc4c7b", "sighting_of_ref": "indicator--37355929-94df-4d52-95b3-2e631f4bff52", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc35a742-ebfc-40b7-8cb9-52ef123e3e80", "sighting_of_ref": "indicator--9bcbc279-2855-4a84-aa59-28d0e62e8c7b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06e97553-f209-4563-a9f4-2b495943d885", "sighting_of_ref": "indicator--3a77eaeb-6190-45f1-ae21-03d3f6206a37", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--051ab3ed-0ba8-4835-9556-5465777a9698", "sighting_of_ref": "indicator--c317c504-846d-43ce-af5a-6bbab57b211f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0b08df9-40be-4b62-adc4-3736a1ef0f96", "sighting_of_ref": "indicator--247b8081-8ea4-4a30-954a-d14dafec94ec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5473389-7a0d-4f62-9848-b716f148dd14", "sighting_of_ref": "indicator--be0d591f-d954-4f37-9eca-eb79161e5641", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3691be0-48ce-4be6-ac16-b2e578af3dea", "sighting_of_ref": "indicator--f71aa9bc-31b1-4b62-aa68-41a71cc14a03", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8733b0b3-6acc-431a-aa3d-d3c507c03516", "sighting_of_ref": "indicator--9f5dba4f-081d-4845-9be7-3f3dd61aa15b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86f376da-4c67-4c08-8a25-80647bd08500", "sighting_of_ref": "indicator--9f5dba4f-081d-4845-9be7-3f3dd61aa15b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99500b8d-ab2d-4262-9e95-72593bee9f0a", "sighting_of_ref": "indicator--8dde707f-15be-4050-965f-8d817a908ca4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7eb7ee3-0c68-4e03-b128-2f3262efb04d", "sighting_of_ref": "indicator--6ddbb817-ad33-4781-b0b1-3fca547b77e3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da016df5-7803-48ed-abb0-3904624c4e99", "sighting_of_ref": "indicator--17d1c447-0918-46c2-851c-7ec62a712bcb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbae2b5b-52cc-4752-90e1-9bf0affe62d4", "sighting_of_ref": "indicator--17d1c447-0918-46c2-851c-7ec62a712bcb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97aec25b-c608-4b87-b972-1d618c41d5df", "sighting_of_ref": "indicator--503f399f-347a-4cb3-904a-98f847bce183", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40dd9b37-a5d2-4303-a2e4-157ea1ea0482", "sighting_of_ref": "indicator--bcc5dfbd-0586-41e2-b979-1bdbf9adcf67", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb219842-81c6-4b9b-ad80-04eaa9cc5cd0", "sighting_of_ref": "indicator--11bfc565-00c5-47c1-b7f4-fb640ca49387", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbd812f8-5cdd-4fc4-888c-97dcece8c2ae", "sighting_of_ref": "indicator--11bfc565-00c5-47c1-b7f4-fb640ca49387", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81f56e53-0829-43d0-8c00-1007fc6e8d1e", "sighting_of_ref": "indicator--e4d10d22-d40c-4988-bc96-b54f63d3f6af", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb115253-e305-4f4f-a0bb-19ea12f25b3e", "sighting_of_ref": "indicator--914b05b4-9711-472d-a732-847d641a3d34", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a77a0749-a3c6-4a6e-8bbb-f152e7f6a5b2", "sighting_of_ref": "indicator--49e34e18-c2f8-42d5-af31-8eb4411dffce", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7130d62-5399-4a48-9dae-ef2c5c79691a", "sighting_of_ref": "indicator--6b90b06b-c3ec-469a-9408-b1df373f949d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99656e4e-2bd3-4711-a513-dac489e6d1fd", "sighting_of_ref": "indicator--421cf8ae-89ba-4dab-8f13-3bb3c85a05f5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9c6353a-c328-48cf-9ec6-010d9041466b", "sighting_of_ref": "indicator--dab15fa7-a434-49d3-b273-92cbcb8bc90b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aed9ea1b-b12e-4687-871e-0603d532a7d2", "sighting_of_ref": "indicator--0907230f-4ea0-47ef-a77c-6a52a2b9e529", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d35d678c-9c0b-4aef-ab70-23f7b92f9121", "sighting_of_ref": "indicator--0907230f-4ea0-47ef-a77c-6a52a2b9e529", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0557104d-56a8-4134-a5f0-0fd9c7ce2966", "sighting_of_ref": "indicator--1ae61aff-268b-4ae1-b8e7-3dd13d4ca850", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5217bdef-f564-4283-852e-2a6e87ea351f", "sighting_of_ref": "indicator--901688c8-fb76-40ec-8b14-60f94c5a2f47", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--129497f7-2b89-446f-bf38-3cbc4cf720bc", "sighting_of_ref": "indicator--901688c8-fb76-40ec-8b14-60f94c5a2f47", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11a48667-d431-48f9-87fb-1679a114d5f1", "sighting_of_ref": "indicator--4601dff6-2fde-493e-9b62-27f50c01b4cf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34de817d-b0bd-48ca-9cc0-460042a3c20d", "sighting_of_ref": "indicator--4601dff6-2fde-493e-9b62-27f50c01b4cf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--105526bb-f85e-4382-a8b3-280bd66aad33", "sighting_of_ref": "indicator--c07cfe5b-1e92-4c60-abc8-289326cd4e57", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82a83a44-4138-489a-8936-ff7840cbc685", "sighting_of_ref": "indicator--73d1503c-020b-4460-a8c5-ebd24767c2f5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06d46ed8-3908-4f46-8e66-cf10fec5302c", "sighting_of_ref": "indicator--256e4a9f-6b28-402c-893d-9f997bb0ee0b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85e15aa1-56b5-4d96-9af2-cc9fd8b9b8ed", "sighting_of_ref": "indicator--256e4a9f-6b28-402c-893d-9f997bb0ee0b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f6d33f2-0423-45df-b6d6-542139992a3d", "sighting_of_ref": "indicator--a492a15e-6f93-49e0-9fdf-3a99a89e5579", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--269d28c7-13d8-47c9-aa72-73956ea18846", "sighting_of_ref": "indicator--a492a15e-6f93-49e0-9fdf-3a99a89e5579", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0206c287-afb6-452b-af7f-5037fb8fdee4", "sighting_of_ref": "indicator--c17c0ff8-8ec5-4ce9-969b-11989fde612d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c35e8fc-352b-4275-9229-b7bdcb4ec172", "sighting_of_ref": "indicator--68436190-1bee-49c3-b9bd-d9b97e32f8f2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--350230e3-94aa-4126-8317-b760810817ee", "sighting_of_ref": "indicator--11731c36-6a3f-489b-80bc-4189594d7a4a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--906326ef-8127-46f9-a467-63f17b3c5595", "sighting_of_ref": "indicator--11731c36-6a3f-489b-80bc-4189594d7a4a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--829be7e5-d659-4ffc-aebf-fe2b2d9f8f41", "sighting_of_ref": "indicator--0b4ac486-807e-4f04-97ec-85eebeea742a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d61e242c-2154-4ae0-8053-d3857d1fa954", "sighting_of_ref": "indicator--4db754a6-0613-4d5b-be6c-953363453f1d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16aed541-c716-4088-a04f-8d93bff7f082", "sighting_of_ref": "indicator--bc1a203f-2b75-42ce-a7b5-4f2fa2453e41", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cce3f96-d2f6-422a-aa77-9152abf8185f", "sighting_of_ref": "indicator--e6fda080-7203-4d07-8e76-e69fc554333a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fee2a47-075f-4fb5-b415-901f949f2b52", "sighting_of_ref": "indicator--b5734071-0a67-44ab-bf97-2de1e9a3ac87", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d80029ec-aeda-4d42-acc6-6eb5d2c55f16", "sighting_of_ref": "indicator--80cc2413-abde-4451-bc98-febe1eba4a8e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bb36aac-ff81-43c3-889d-03a7bd3d8029", "sighting_of_ref": "indicator--80cc2413-abde-4451-bc98-febe1eba4a8e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df42d88f-b104-4e61-b7d1-0bf87f0569d8", "sighting_of_ref": "indicator--3bdbc217-ac4f-4a29-bf11-578d4dc8551a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9404de2-41bf-479e-8fe8-28f97c103e10", "sighting_of_ref": "indicator--f258b0c6-6a53-4ae1-8036-6e1bce7d4e0b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94fbf6cc-a82e-4c33-9203-eaf9b427ab11", "sighting_of_ref": "indicator--3e22bdca-be2c-4c07-8422-a124483a02c6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69bbecce-b524-44bb-b676-b7aa8dfd76a5", "sighting_of_ref": "indicator--3e22bdca-be2c-4c07-8422-a124483a02c6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--867f7f74-115e-431e-855a-99d4c6eddcf9", "sighting_of_ref": "indicator--79cbf4e9-eab2-46a1-9025-a7d02087e844", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ca86ef4-0860-4a8d-8f40-9b5e7effe09a", "sighting_of_ref": "indicator--02c3482c-5fad-4bab-a2a5-7ff47078ca87", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89678b16-f34a-448d-82f8-cd35340abe0c", "sighting_of_ref": "indicator--2eafc680-53e5-4921-b83e-decac1ebef6d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc394422-0e0c-488d-afd6-2618afe2e357", "sighting_of_ref": "indicator--6e6835ca-372b-4270-9501-75a291d306fb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f819856-d090-4b44-8347-73c42961d79b", "sighting_of_ref": "indicator--321a2841-820e-454c-a3fc-bebca75f6e4f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bc5841d-7963-48b9-a412-dbf3c2a930d7", "sighting_of_ref": "indicator--fa56e07a-db93-4a1b-956d-10a496739558", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4470c66d-95ff-455c-8162-c539e7c9b58b", "sighting_of_ref": "indicator--fa56e07a-db93-4a1b-956d-10a496739558", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd398f93-a141-436e-bb5a-05a1fb9bb948", "sighting_of_ref": "indicator--459b5b8c-8601-4cd6-9a00-ad6a26c3d620", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a00a4b2-9370-429a-aa69-464ce15b4624", "sighting_of_ref": "indicator--c4ab30b8-674a-4bf6-9334-1d47f4a29357", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8d9c781-f4f2-49a5-9215-08f12ea6d193", "sighting_of_ref": "indicator--dd173590-2460-49d0-bdeb-bede100ca6b9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c04f0d2-e907-4df7-a0e6-5d72889d8e25", "sighting_of_ref": "indicator--7306b03d-b4a8-4440-bba6-6a3ad2bb1d52", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eb13e4f-a830-4e60-91e0-8f6d3eff9bf5", "sighting_of_ref": "indicator--76dc9e76-b43d-4da6-8cf0-75c2a6866661", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9c52c89-a741-4717-917a-d078422a8e0d", "sighting_of_ref": "indicator--c2dbdf03-e2a7-4229-9ca1-f5c13c9a3945", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50080e7e-a270-4b43-bfee-fe44dec9bbd9", "sighting_of_ref": "indicator--c2dbdf03-e2a7-4229-9ca1-f5c13c9a3945", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63f4352c-e015-4347-91f4-91f8423b38fd", "sighting_of_ref": "indicator--057581f6-7a57-4c17-a1d5-919e8e580863", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f6511dc-4020-4d0f-8b3f-f3622392ca77", "sighting_of_ref": "indicator--72c3b7c2-47a9-4c16-94c8-b1bd90d1f2bf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91d56816-ed42-42db-9079-9d44ba7412e6", "sighting_of_ref": "indicator--f85dbdc4-7ca0-402b-a455-57dd4841bfb3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b138945-ec46-420e-8a5b-4b14b8c7ea29", "sighting_of_ref": "indicator--08b82249-07e9-4d96-bf2f-f8c2e4285c79", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf5efc24-f7ca-4003-a6fb-0bd4072f169d", "sighting_of_ref": "indicator--08b82249-07e9-4d96-bf2f-f8c2e4285c79", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd69b4b5-0816-45fb-9d15-a91c4a8c0362", "sighting_of_ref": "indicator--2dfbb647-68be-446a-8fa5-79fc79c00c85", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26786748-0275-4ed9-92c4-c0337aec4f40", "sighting_of_ref": "indicator--2dfbb647-68be-446a-8fa5-79fc79c00c85", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dac42211-6ef6-46ba-a59e-d7e08386f594", "sighting_of_ref": "indicator--f872aec3-5926-4fd4-b734-66c697a9d7f8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d778a745-2aa0-4ec4-8b2c-62d2c75f7d0a", "sighting_of_ref": "indicator--d94757a9-071f-46b9-82c6-785505fd6446", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3c1bdf2-7724-4ad7-995f-7f765a791bb3", "sighting_of_ref": "indicator--ac57673d-1c3d-4b23-a410-8b4dd1ac1810", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18e8b619-1b67-4dc7-8ed1-df972628915f", "sighting_of_ref": "indicator--71e84552-1df7-4bc7-9bbc-122a53abd606", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea1a6ad5-14f3-4fe0-8204-d7ada9a3b031", "sighting_of_ref": "indicator--71e84552-1df7-4bc7-9bbc-122a53abd606", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8210104-8d25-4f9b-9fa9-14eaced8baff", "sighting_of_ref": "indicator--b75da907-6a1e-4d09-84f2-a9aa87b92fee", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c13ffe26-84ce-48ae-9d91-d02c7e7d2d61", "sighting_of_ref": "indicator--91ede994-336c-4506-b925-d6d60c8163ce", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--596a1c60-5323-4e7d-abc5-d765345fedec", "sighting_of_ref": "indicator--294a28bd-b6c0-4c6c-83a5-a70bde183f4b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fabbcf6f-5856-497a-9bb2-9d32943d0a05", "sighting_of_ref": "indicator--1e116313-1031-4322-bcf3-5876000a6646", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--994658d7-a13f-45ec-bf96-cc16766dd32d", "sighting_of_ref": "indicator--e33e2f29-c81b-4d23-8a89-8d19477aa5df", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7eb5fbb8-7b53-45f4-8e63-92c59954e011", "sighting_of_ref": "indicator--7db7105d-a13d-44e9-bf57-57cfe8d5a6ff", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcc7c34c-9c1f-48cf-a304-e1e780e6bf6d", "sighting_of_ref": "indicator--43e65eae-2c99-4491-811c-a3eac1884990", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c38b0465-94c8-4eae-9042-7e20c6d73bb7", "sighting_of_ref": "indicator--42776a47-1334-42bc-a49d-e2ee09aabd2a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d0dc026-fe64-4631-bf7c-ae9a16b90e0d", "sighting_of_ref": "indicator--eafce416-8c2d-4401-9e14-bce7feb0263d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58758235-580e-4ad6-9b8e-2a21971fecd8", "sighting_of_ref": "indicator--4d831d13-20be-47af-acfb-31cddf32d4a1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aba4d466-c91c-4814-a405-a524979b24d6", "sighting_of_ref": "indicator--6ad1c068-821f-46f2-a65e-edc5d102fb4e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af2d2878-439b-49ca-af3c-af158f9ad0b5", "sighting_of_ref": "indicator--affdec39-2a9d-472b-adaa-2691b5581e80", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49bd76b7-ca53-41b5-a2dc-59aaa4a34eb7", "sighting_of_ref": "indicator--2da79e2f-58ad-4267-8c2a-2d61553499da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--006b52a4-b6f4-487e-9939-3db33b5059aa", "sighting_of_ref": "indicator--3eda3376-c0fa-491b-bfcb-a7aa56e26e56", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f6cb32d-6e14-42a8-b690-38aafb4830e8", "sighting_of_ref": "indicator--140e992a-5568-4107-ac5b-91295fa9c293", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93a705aa-55d5-4999-9b48-042148bfa729", "sighting_of_ref": "indicator--73d3d916-e01a-417c-bce7-8ddc2fffd93e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47d2644b-bac6-4b62-a987-f02ea5ac902c", "sighting_of_ref": "indicator--73d3d916-e01a-417c-bce7-8ddc2fffd93e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12dc2d2e-c5ce-425c-807d-61f578c85f4c", "sighting_of_ref": "indicator--9c1c1da9-3f14-4260-9564-6e547cfa1e29", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5503865-eb8e-4c9a-b724-38b45f8847bc", "sighting_of_ref": "indicator--9c1c1da9-3f14-4260-9564-6e547cfa1e29", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40dd97fa-9a89-4853-ba4f-2992110ccd50", "sighting_of_ref": "indicator--c249884c-3995-479b-b11d-18f705b89390", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44ac788d-cd4a-404b-98a6-dca8b1b80f8d", "sighting_of_ref": "indicator--c249884c-3995-479b-b11d-18f705b89390", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--871b36a2-6f3d-46bc-845a-873af5223a9c", "sighting_of_ref": "indicator--cd074828-ffc5-45f2-84d2-eea518838c02", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcde1f55-f7b1-497b-813b-df664f1193ec", "sighting_of_ref": "indicator--cd074828-ffc5-45f2-84d2-eea518838c02", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ccfe55c-ce02-459d-b0a1-1cba601d2519", "sighting_of_ref": "indicator--e45cba21-e5a1-4909-81f3-75c29b271fc6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d27d4c5d-8e3b-4b6e-9e31-28a0e348e702", "sighting_of_ref": "indicator--e45cba21-e5a1-4909-81f3-75c29b271fc6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cd82b25-7a99-451c-911d-4e14f92cce8d", "sighting_of_ref": "indicator--7ce3c95f-abb8-4625-a0b0-794963029a31", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4aa441c-21c3-4fd5-ab94-0f55b211bc65", "sighting_of_ref": "indicator--02b7b502-8285-45d0-b10b-5a6980a90da8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93bab966-4b2f-4cfe-b1e6-d4fd7be16313", "sighting_of_ref": "indicator--02b7b502-8285-45d0-b10b-5a6980a90da8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50e22015-528e-4315-b102-b3a3520e7bb0", "sighting_of_ref": "indicator--ec3c815e-cd27-448d-b1b3-62afabaf1781", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bda40aca-02df-4565-ae75-0c6bc346101d", "sighting_of_ref": "indicator--ec3c815e-cd27-448d-b1b3-62afabaf1781", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c47c878-bdde-4119-bf4a-3cc5de2a4712", "sighting_of_ref": "indicator--30a3a1b3-ab8b-4563-92a1-f6d374f64e76", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5a101f2-d633-481d-b067-e033f985bf8c", "sighting_of_ref": "indicator--da69fd53-43db-4c01-ac04-6f909384e74b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f769836-b1a7-4047-ba89-1be695494c76", "sighting_of_ref": "indicator--da69fd53-43db-4c01-ac04-6f909384e74b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a77f35e4-a8e8-4e89-ad71-5aee02b4d005", "sighting_of_ref": "indicator--3206db78-2d4f-425a-9431-52227a67e00a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5139db0-f1a8-4ac9-ad72-73c3fa9973cc", "sighting_of_ref": "indicator--3206db78-2d4f-425a-9431-52227a67e00a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--770dda29-22bc-4a2b-add2-638c58129f05", "sighting_of_ref": "indicator--f29607ba-ec92-4f0a-9e51-443a13eeec27", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe1a88ab-6514-4ceb-8393-249476901ffe", "sighting_of_ref": "indicator--0cf1774c-1aae-4af5-b565-4c6ce9a9d163", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dab8d2df-fc9b-412d-91a8-215c23ca8be1", "sighting_of_ref": "indicator--0cf1774c-1aae-4af5-b565-4c6ce9a9d163", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d718625-0f98-4b3c-8fd6-948a5edab7ef", "sighting_of_ref": "indicator--d0ec3cfe-f597-4fe5-b62d-1d1cf8f8b21d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5a0d359-04b0-495e-90a7-fc97b5de85d5", "sighting_of_ref": "indicator--5683df7e-0607-47ba-b67e-eeabf25cb9b6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b365f6b-b738-4366-8c23-97b9a2e3815a", "sighting_of_ref": "indicator--c6553e31-bcd1-4650-b7ec-7b2509b542eb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72dbbec4-2617-4ecd-9c57-514d84ece72f", "sighting_of_ref": "indicator--c6553e31-bcd1-4650-b7ec-7b2509b542eb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1caf7bdd-edab-4022-9959-31770918b6aa", "sighting_of_ref": "indicator--b83ea79c-25e9-4a72-91f8-930b2197e625", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0453fb6b-7bb3-4762-9c9a-82a18d58afdc", "sighting_of_ref": "indicator--65b90c28-6fb2-471b-ae27-30ba950f69f5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df06f8e5-85a7-426b-9d4b-a44f5e7db93f", "sighting_of_ref": "indicator--65b90c28-6fb2-471b-ae27-30ba950f69f5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e5c1e81-a708-4340-bf5b-840ab02a57a0", "sighting_of_ref": "indicator--afff9ef0-a10c-4ae5-b41a-3c114580b148", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfdf9a89-c240-4c08-89c6-ea299b3ccfdd", "sighting_of_ref": "indicator--afff9ef0-a10c-4ae5-b41a-3c114580b148", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cb7605b-3765-4982-adcf-632566244eb8", "sighting_of_ref": "indicator--43d05898-3f16-4fba-8d21-a75af922c71c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d851bf4d-4085-43a9-b7d9-ffbf2e2ec6b6", "sighting_of_ref": "indicator--40572dae-8871-4433-866b-00ef8a507ca6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fccf25d-21c0-421b-9ada-617cb1d5daf4", "sighting_of_ref": "indicator--a0a80220-3904-45bb-9dcf-9337a749dc58", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f98c7caf-5163-444e-90e1-5e17ccfeb703", "sighting_of_ref": "indicator--2af53557-5847-47be-8fbb-573f1fdc6c7d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--008c92bb-9b21-4259-9cb9-0035c86876f0", "sighting_of_ref": "indicator--81648ca9-512c-4c55-bfc9-895a4fd48ae8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50a0e894-99d1-4ec5-bde7-059c2b029b36", "sighting_of_ref": "indicator--fe053fd3-461e-410f-bde7-3834211a7cd6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a4464e6-64b0-4a29-adc9-c11bb702e24b", "sighting_of_ref": "indicator--bd89ec4d-18da-4cb0-8127-4890191af8df", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a38fed2-cda6-49c5-b1b5-4eabc0d83ed3", "sighting_of_ref": "indicator--4c83cee1-f706-499f-8bb6-834b0c47e516", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82ef475d-1b97-419b-87c3-33ee4f4dff95", "sighting_of_ref": "indicator--c505c58f-8969-435d-b3d3-b16fc2e84126", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ab95fb5-9f85-4be7-a25f-e3c0a3ad4ba9", "sighting_of_ref": "indicator--18e33b55-d9d0-44de-8e62-ca5c89a8c048", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e223193-2175-44c7-99a4-7a0e4949aec4", "sighting_of_ref": "indicator--d021258e-066e-415e-a9be-27ba3cf07cbb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f762990a-76d9-4106-a095-0ca6733d1aca", "sighting_of_ref": "indicator--e396370f-2ebf-48fd-ab35-5ec28fd41b68", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e547042-0f63-4f0f-9483-da88d01d11e8", "sighting_of_ref": "indicator--186fc2a0-e9e2-4f6d-aede-68c5e962b6a8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7803e8eb-62b6-47a0-a064-c5a5cb783fee", "sighting_of_ref": "indicator--f05433f8-8849-47f3-a64b-2ffc972b57cc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97ec6b15-388c-4f04-90fd-ba9ba18eef46", "sighting_of_ref": "indicator--f05433f8-8849-47f3-a64b-2ffc972b57cc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--371ba1dc-14e1-4433-9f04-9884cd908adc", "sighting_of_ref": "indicator--0a030862-cec4-46d6-9d95-7b5d988484cd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b15379b-8019-4816-86ce-1874c960ab2c", "sighting_of_ref": "indicator--0731e1c1-4387-44c5-812c-ca3bf56e5214", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8f56142-3709-4166-94ff-106413887ff0", "sighting_of_ref": "indicator--690b1739-bcb5-4dfe-9853-f9c1805fcd13", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbc882bd-b641-448f-8dec-c6e4e30d37b2", "sighting_of_ref": "indicator--ede384cd-a4d4-4879-8704-4f097abbe472", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a115132-5977-4de1-a3f7-5cae71020a7e", "sighting_of_ref": "indicator--02888d6b-6c98-4199-b6a8-f2cabd015435", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1b55fc2-4c9e-492f-ac65-1cab0bb6a2ec", "sighting_of_ref": "indicator--833b0b53-9ef5-4a8d-8f76-42762618d644", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ce87b78-d87e-4c71-ae60-50bc36e64d91", "sighting_of_ref": "indicator--2ccef552-6c9c-499e-8b53-92264364cdba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bfc3cd4-aea0-4553-9da6-0dcc44da2dd6", "sighting_of_ref": "indicator--9ea5808d-cbe9-4ba4-abb5-8428ce395f3c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac4e1fb1-ca8a-4b0a-ae13-c14f046c1b49", "sighting_of_ref": "indicator--14382334-c9ff-4828-bde4-5b81fc9ff3d9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68c30216-28b7-477c-846e-2aa6f003303c", "sighting_of_ref": "indicator--893cf551-1aad-44f1-896c-11ca167484ab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80159bc1-891f-4b4d-b673-0333dd91ce5e", "sighting_of_ref": "indicator--cbf8859f-d0fd-4769-b63c-3e098ec38a4c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f2e55ab-b77f-4c6c-8b21-48c6a5060974", "sighting_of_ref": "indicator--67a6d6e7-2384-49fb-bb69-4a99fd7ee070", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c42df04a-27c5-4db1-8436-0c5fee23c2bd", "sighting_of_ref": "indicator--f8af81e8-9470-4e2b-adf2-7b4d7180883c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5326ba2d-e35f-49ca-b85d-8fc0bc799c19", "sighting_of_ref": "indicator--64a34a2f-66f6-4088-a3b8-ea45fb0ec3ba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34ceca9c-a1bb-4231-8ef9-b5061fb8bd1f", "sighting_of_ref": "indicator--35704670-dcb7-4ea3-97ae-9a687400793d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0db29432-0237-4be5-82ca-222292999ced", "sighting_of_ref": "indicator--2e7d54e9-5ea9-42a0-b12f-c4330b9d28cf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17ba0309-c141-42b3-8736-77bd14d23c1c", "sighting_of_ref": "indicator--3c7a5e30-f5ca-44a6-acee-9124361b0854", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16ecb2e2-5428-490c-8da5-c704e724886f", "sighting_of_ref": "indicator--3c7a5e30-f5ca-44a6-acee-9124361b0854", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26af27df-b135-4d7d-9509-874c979741fd", "sighting_of_ref": "indicator--e89e48a6-9c66-468a-9137-8e0168e42643", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16041cf1-903c-4811-a2c9-e70fea253db0", "sighting_of_ref": "indicator--5e9ef3d3-29cb-4e02-8a5c-b77af22d4e15", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e661af8-133c-48f2-adba-e0cdbcc84741", "sighting_of_ref": "indicator--5e6729da-c518-4e72-9e4b-ce17b01adec2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7417b54-eefa-4eb0-b8c3-66d4e7d6c2a1", "sighting_of_ref": "indicator--5a71fda4-85bb-4bb7-8b5e-1686e2ad92b9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1599b713-d769-4c8c-af26-d93526209104", "sighting_of_ref": "indicator--629fe9cf-6838-4218-bde8-cfad8d9bddc1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5260c89-fe1e-4d90-bb63-652fdf9d987a", "sighting_of_ref": "indicator--084a21e2-84c3-489b-8ea1-5c06482c2ddd", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--256b28dd-f798-42a9-93e7-4ada4db20110", "sighting_of_ref": "indicator--b05f8edd-15ba-4b17-8038-3bfd61d417f2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b15ce85d-92da-474b-b368-f6ff4227fdf6", "sighting_of_ref": "indicator--fcf0979a-a734-4d0c-8d92-b0c6e6ca43a8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86fb3874-63ff-4e7e-ab01-47fe83e464ec", "sighting_of_ref": "indicator--5b954b43-179d-420f-a210-3a59524fb851", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--645d1f68-1450-4e62-bead-290351e8dea2", "sighting_of_ref": "indicator--947a1b57-c48c-4f51-9f9f-93915c08919c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--223b53c3-b76a-4e53-9d6c-73ebe355eddc", "sighting_of_ref": "indicator--2b885087-bbe6-4669-b916-e70b589ffb33", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67fcf157-d9a0-47f6-8b14-0ffd92286b14", "sighting_of_ref": "indicator--c9ef8de4-3b13-493e-9809-11d8c3a2a9cf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73bc5f51-93d7-49c8-ad9c-706918777b2e", "sighting_of_ref": "indicator--c9ef8de4-3b13-493e-9809-11d8c3a2a9cf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db49f0c9-5c36-40a1-87cc-95a52a0fb655", "sighting_of_ref": "indicator--61bc5ab0-d927-4109-bae1-16c142b12e9d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66322229-5e84-4c7e-a95c-f2dfdf51bfc5", "sighting_of_ref": "indicator--61bc5ab0-d927-4109-bae1-16c142b12e9d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61385dc3-a2be-4c08-b927-51fb9588d11d", "sighting_of_ref": "indicator--1df3a263-b385-4ec3-b2dd-4af39836e505", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbbee950-2c2c-4c99-a324-6f27cc1396d4", "sighting_of_ref": "indicator--1df3a263-b385-4ec3-b2dd-4af39836e505", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--132e7627-3559-4db3-b001-a0db3d1ed7ca", "sighting_of_ref": "indicator--c6c7b12a-55bf-490a-97d3-e785b84911ec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d706f364-3de7-4dd3-aab6-7fe815979e19", "sighting_of_ref": "indicator--c6c7b12a-55bf-490a-97d3-e785b84911ec", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eba54e7-93b3-4821-b275-66c82fa5ddbc", "sighting_of_ref": "indicator--c3b58e46-e17d-49b0-89be-b68548ff987d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f593c494-846f-4b23-826c-64960a0377aa", "sighting_of_ref": "indicator--c3b58e46-e17d-49b0-89be-b68548ff987d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--beb8971d-6f1c-4ce9-99dd-58156b934ccd", "sighting_of_ref": "indicator--b4ff4f81-1a10-46dd-bf00-515c9b5d31fc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4965e0d1-9881-4a9c-9301-8b943a830bba", "sighting_of_ref": "indicator--b4ff4f81-1a10-46dd-bf00-515c9b5d31fc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1793833b-a22f-4cde-a0dc-9c1349e20ba7", "sighting_of_ref": "indicator--2846e343-93f4-456a-ade2-351b7cf06689", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0bbc0d6-3a52-49a3-8498-cbd2a07bf2f8", "sighting_of_ref": "indicator--836857f0-1c32-401c-8195-7a33cb5ae55a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--558bc429-71cc-4d3e-977b-9e24027a8e26", "sighting_of_ref": "indicator--be694e53-2f53-4711-b6b5-e53fa82f34f7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb5155b1-6c8c-4e79-ab78-6835e1e8ba87", "sighting_of_ref": "indicator--322fbafc-e7ed-49ec-924b-ba9c0052b2ad", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d6ece51-eab8-45d7-aa86-c17e1162ee41", "sighting_of_ref": "indicator--322fbafc-e7ed-49ec-924b-ba9c0052b2ad", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--335f18d5-f72c-4be5-bf85-934dbb163fde", "sighting_of_ref": "indicator--b40a3b55-9e03-4807-957f-fa750a84816b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3609458-bc1d-4138-870c-0f79947f1970", "sighting_of_ref": "indicator--b40a3b55-9e03-4807-957f-fa750a84816b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66eecb36-4564-4f09-932f-824dd0054a19", "sighting_of_ref": "indicator--c257a784-dbf9-4e80-92b3-0db7808c5e3d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb735573-6f93-4a6a-a48e-5dd269bcfe27", "sighting_of_ref": "indicator--58b466fd-61b3-4cda-a9d4-cd01ea5bd031", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fe0270d-379d-41ce-823a-839c71b595c2", "sighting_of_ref": "indicator--1252f724-bd7c-4656-990b-560f9324d969", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e109aee1-51b3-435e-af82-360d507af19b", "sighting_of_ref": "indicator--91554c0f-3003-4040-8d51-1473f217547a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f25d098e-e06a-487d-95f2-85e2e072e939", "sighting_of_ref": "indicator--4dbb6e8b-f5b9-4112-8948-06ba88be1495", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a44af2f3-2de1-4877-829a-c816e4bbafaa", "sighting_of_ref": "indicator--9d39a1ec-9e54-4a58-a720-d2909f99fa60", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90fea67d-5bc7-41e8-87da-892f9f2a0d89", "sighting_of_ref": "indicator--fce04b3e-0110-4e3e-9b6b-08f8ca866d6a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91edb9b4-84aa-4cd6-b42f-f01e7c484c42", "sighting_of_ref": "indicator--fce04b3e-0110-4e3e-9b6b-08f8ca866d6a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--271d29c6-6384-4d61-bb9f-4e2698ddab70", "sighting_of_ref": "indicator--d8cab6b2-17ea-413f-a218-8ef1aa0a947e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7ee3d2b-2505-4fb4-8110-16b81da72ffc", "sighting_of_ref": "indicator--f6bb33a4-568f-41d3-b436-a2470fe3b2e8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fc6af83-0422-410b-907b-1b8f7a1fbe5a", "sighting_of_ref": "indicator--f6bb33a4-568f-41d3-b436-a2470fe3b2e8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adf8c3ad-844a-410a-9571-71f39c84bfce", "sighting_of_ref": "indicator--f5fc2873-aa0f-4d31-a89c-097b36762eb0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e82db704-ce9a-4517-8d99-841ccfe38c3e", "sighting_of_ref": "indicator--29ac1897-da99-4200-8265-b33b0aec5c4f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34614bf8-dc79-4445-a0db-502d318827b4", "sighting_of_ref": "indicator--4ca979d1-4fce-4aca-a53d-0313d74cadc3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--536d5ceb-0727-4892-aae8-5af1b16cd175", "sighting_of_ref": "indicator--59adad58-3d20-4390-8b97-4bb7951faf92", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7871bbcf-76b9-4f3b-9da5-076fbc98fb70", "sighting_of_ref": "indicator--5460ac20-7821-44cd-b960-1d85d9d4d064", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52b363cf-49ce-4e0c-a72b-8fbbe089ab32", "sighting_of_ref": "indicator--b75edcdb-6cd4-4987-b8e8-d4502c624429", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aefa1a21-8b68-4395-aa6f-b0725acde641", "sighting_of_ref": "indicator--e2231cc7-f39b-451a-913c-7bcecd550359", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a80bef2-2c70-4e40-84a7-f301cfcdaf5d", "sighting_of_ref": "indicator--1ddea052-a530-4dae-aa06-490e180c35e2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f82425b-4261-4b91-a934-a3fc3d5f8ef8", "sighting_of_ref": "indicator--1ddea052-a530-4dae-aa06-490e180c35e2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bc50d1b-7eaa-480f-82f7-01ac703ff647", "sighting_of_ref": "indicator--fca4c6d0-6d11-4206-af4a-f49f58ae860b", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cae029d-d919-4b0b-bb67-2529402081e8", "sighting_of_ref": "indicator--581d5be2-d391-4294-8819-028055fc3d89", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41f48dae-aa56-4a6d-91ff-729f1c63d93a", "sighting_of_ref": "indicator--bd3d058e-2bff-48d5-a5fd-24716b3447bf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01b7ebb5-4057-490a-86b4-34c953a4ea06", "sighting_of_ref": "indicator--ac99c280-f339-4b76-80d5-3317f7c2ee46", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b81aabe-2981-4b97-ab9b-559402274dad", "sighting_of_ref": "indicator--c19d8b12-31a5-4c7c-81c0-80d9fa5a93c4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf912511-2e7e-48b2-946e-a908d8681110", "sighting_of_ref": "indicator--c26bf769-5423-4857-bccf-a37dd64ea024", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4858976-96c7-4a2b-a3e0-1c49baeeffdf", "sighting_of_ref": "indicator--7a902eea-f0e4-400e-9855-473c31e00902", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abf52d99-cfcc-470f-b3ac-0da093788f19", "sighting_of_ref": "indicator--7a902eea-f0e4-400e-9855-473c31e00902", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a8e0fd1-9b0b-449b-aec7-c12519e5b131", "sighting_of_ref": "indicator--625b9d8e-80e1-49e1-8bab-bf49e3372c68", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b35524d3-654d-4283-b8cc-fceb3c85de8d", "sighting_of_ref": "indicator--d699ac69-6346-46db-91ba-f0d48ec0078f", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b262547d-f64c-49c5-9d7e-b760c7e9e298", "sighting_of_ref": "indicator--df4e9c1c-7c60-4900-8bff-af56f7aefb93", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44cad15b-fa29-4ffe-8729-584cdb719eda", "sighting_of_ref": "indicator--85cb1932-20c9-49f7-8d27-1a6f4011c069", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42faba03-d73e-4e6b-8150-d20c803fa9f9", "sighting_of_ref": "indicator--598915b1-fc1d-4e04-95dd-e99d9ab1284d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e01c2a7b-0eb1-4c28-9345-cb52b75539e1", "sighting_of_ref": "indicator--d569af63-15c0-42c5-981d-f30751f4fb14", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca91e698-9c51-4f23-a499-f34e47d1165b", "sighting_of_ref": "indicator--15ac81a3-1a2a-441f-abff-5d9fa8dbfccb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce713d26-34ba-40fb-b2e3-c966fd9fe6fb", "sighting_of_ref": "indicator--15ac81a3-1a2a-441f-abff-5d9fa8dbfccb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34890bbb-c3ab-432e-b571-f1010b15f58b", "sighting_of_ref": "indicator--63190ff9-9003-4551-a4e6-aaf89cd66627", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50e60c76-8ef3-4eb7-8292-eb1c2ac384ed", "sighting_of_ref": "indicator--0805841d-7edd-4399-a3db-a5d22b63642b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f9040c4-8173-4d6e-a2ea-27fe6e0c2d9d", "sighting_of_ref": "indicator--96c8f7e9-d49b-4d63-a951-abc3fe1f78b2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7285d13a-f9be-4083-89e8-6f320d978a60", "sighting_of_ref": "indicator--e4f51964-ea27-42a3-9793-d851758d721c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c534f721-f3b7-4794-aa88-12ed399b3d33", "sighting_of_ref": "indicator--43a0f54e-75bd-4302-a6be-0bcf5ac431c0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd6a3ae3-335e-4cf5-92aa-5e99a4e1b542", "sighting_of_ref": "indicator--a0de49f7-4bad-459a-8a8e-fcf2dfb55adb", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ccc5b05-e4b7-49a5-b3da-161b4015196c", "sighting_of_ref": "indicator--e4eb6de3-f065-4970-9a9d-c1534ef5734e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e441ffe-1c0b-45ec-89ad-4a29b03fac5b", "sighting_of_ref": "indicator--ea1e7cd7-5de7-4df2-bcdd-2beebc484018", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8f97931-50a9-4aa9-aa5d-e7d433bb1a3d", "sighting_of_ref": "indicator--aee8044d-79cc-4331-a5e7-169aea377b5e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3408b3b-4f25-4e6d-af3d-ddf52f2e6836", "sighting_of_ref": "indicator--14f2ce80-5d14-4799-ab05-45205f05cb7b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8edf2bfc-8c06-4dca-8f6d-321ad3a8db71", "sighting_of_ref": "indicator--199dcf3c-e828-4f99-adbb-b7c6e69bc948", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76e75dbe-8cde-4baf-afee-b742cc4bcff2", "sighting_of_ref": "indicator--1a2971ad-52de-48e2-b0af-177058246bea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1683c583-0f51-4541-83ca-b793e121de0b", "sighting_of_ref": "indicator--a5cbb506-aabb-40bc-8307-f0bd31f3118d", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c1bd275-99de-4d77-8c95-674408068838", "sighting_of_ref": "indicator--d5df2e15-a85a-4c30-9fbd-db7682f7062e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef4ff5bd-2555-4c27-94fe-023f05a87718", "sighting_of_ref": "indicator--7c07acab-8e28-40fd-85c8-8fafea7a3e75", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dd7b902-6df5-4d65-ae9a-20a4fcbeb807", "sighting_of_ref": "indicator--366f7e55-a15e-46aa-8e2d-943fe4d1adca", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b588eae2-a07b-4716-97d8-ed3352b6128c", "sighting_of_ref": "indicator--87ec5e87-5971-4f44-9013-a9b5169c92b1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfb18d18-76e0-455a-acdd-71398bf2f6c5", "sighting_of_ref": "indicator--e08ba9ef-ec54-447c-9480-3fab852c80cf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--850268f6-9b63-440e-9e94-442c765bde87", "sighting_of_ref": "indicator--e08ba9ef-ec54-447c-9480-3fab852c80cf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63e4da2d-ead4-4d91-a060-78635c8a8659", "sighting_of_ref": "indicator--131e7220-a78f-427d-bd9f-6409adb92b91", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c545f85e-d66f-4e10-abc4-7b4826e1b4d6", "sighting_of_ref": "indicator--16fb6cc8-e482-443d-9cd7-385a61d1c0b5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21abb4d4-fe7e-4144-a60c-07f126981f91", "sighting_of_ref": "indicator--16fb6cc8-e482-443d-9cd7-385a61d1c0b5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90b11d1e-1dfc-481b-8b57-4c9a0fb31ff8", "sighting_of_ref": "indicator--3e3f712a-4510-44a5-8c32-25f6a1c70020", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--076b96f6-23fb-4b4a-877a-674c154e4412", "sighting_of_ref": "indicator--8c43ceec-b79b-4d08-a1de-2af07076b2c4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2debee1c-a325-4296-b36c-0d40af7b3bad", "sighting_of_ref": "indicator--3660686f-8bdf-4b81-a13c-3f8914e38a74", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9f8aa84-4fda-4975-9945-f5e099a3bdae", "sighting_of_ref": "indicator--3660686f-8bdf-4b81-a13c-3f8914e38a74", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8401e0f0-67f4-44cf-8fe5-355aeea9a1cc", "sighting_of_ref": "indicator--a6e20c72-68dc-4f1f-ab29-c0cc354eee3c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a034cdd-7271-48fe-840b-ecb3aade7ab3", "sighting_of_ref": "indicator--a6e20c72-68dc-4f1f-ab29-c0cc354eee3c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfccc2fd-033a-4401-a343-2ad2589712a8", "sighting_of_ref": "indicator--ea314936-bcd1-4cb3-88a6-6e08b196ec04", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5aa64fd6-79e6-468f-afdb-9b4b67bc4ed5", "sighting_of_ref": "indicator--293fa372-f087-478c-b2d0-0fa31fb8cdee", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a4bb563-1947-42e2-8040-aaee6c9a0a7c", "sighting_of_ref": "indicator--dbbf3c07-f4cf-4933-a9c7-2ef561cd1ac6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cf7589e-16b3-4357-892e-9a0b84aab3d2", "sighting_of_ref": "indicator--7170ada9-205c-42f4-b6e7-244aa0a52c27", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d4dfee8-0f20-4a3d-b756-1a1a8b805b89", "sighting_of_ref": "indicator--4a0d438b-103e-4564-a8df-28f0dfcfb9db", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be415883-7e43-4cc0-b057-82fbf52683e5", "sighting_of_ref": "indicator--cf52b35a-1e7c-41c6-a690-9237734e534e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6730142-5fb8-4610-a6fe-cff00b47c7fc", "sighting_of_ref": "indicator--f5238e08-0f8c-44fd-893f-d2f65d7a8c32", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--223b99c5-2660-4a1b-86fd-0061164a31bd", "sighting_of_ref": "indicator--69479640-95e7-4815-969f-e90e1e9cfd90", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d4ff1d3-c573-499b-a32c-e977e05ad2be", "sighting_of_ref": "indicator--5f858db8-512a-45ce-b9e2-1c0f3b416088", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f09ce4e-eaaa-49be-a533-cd4a961f8e35", "sighting_of_ref": "indicator--5786c88c-b258-4b4c-8c39-23ef68ede381", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd3dc956-3abe-4337-b6a7-dbaefd433475", "sighting_of_ref": "indicator--89915d88-5e66-4b66-a2c4-6573911572fb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eff68f6a-128c-457e-8b7c-5ad58814c57b", "sighting_of_ref": "indicator--4b8f92f7-59be-4eda-b16e-76c025211c04", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29f71aad-5906-4836-9570-0dc3b19e34d7", "sighting_of_ref": "indicator--4b8f92f7-59be-4eda-b16e-76c025211c04", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22480cc0-f972-429f-aa51-0b6b3e0aae01", "sighting_of_ref": "indicator--4b8f92f7-59be-4eda-b16e-76c025211c04", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0cc9b28-986d-4d37-8c3e-493271b484f3", "sighting_of_ref": "indicator--e7612550-e8fc-4157-b947-176b06765b73", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3b269bc-5c0d-49ec-9da0-5d1437eab783", "sighting_of_ref": "indicator--e7612550-e8fc-4157-b947-176b06765b73", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e93d2ed-be6b-4bea-8bc3-abba27308bf5", "sighting_of_ref": "indicator--e7612550-e8fc-4157-b947-176b06765b73", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1ee34d8-d096-418b-b76e-dc868c0a208b", "sighting_of_ref": "indicator--8f9eee96-fd41-4d5a-97b3-6249739ae69e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcb121ba-a59e-4d76-b981-f04e584f75ba", "sighting_of_ref": "indicator--5e43629e-2277-4746-8dfa-aa3f1027772d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7634ecc3-db3e-4b1f-b361-f04ec39c2d60", "sighting_of_ref": "indicator--593e715c-492c-413d-a888-63f3736ddf53", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f40d321-4df2-4081-ab68-90fc6c08b553", "sighting_of_ref": "indicator--f8113f97-08f8-42d3-b586-86a6cc4a8de6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fd4999a-f46c-4603-9c80-7606941c6c48", "sighting_of_ref": "indicator--b965b445-522b-4cc6-b09a-6f94d3fa46b3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdbe6213-058c-43cf-972f-5f6e1fd4c28f", "sighting_of_ref": "indicator--9ed9a7da-bcb3-4387-b31e-756b7c2c6b11", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7439a5a8-204d-4fe5-8436-9c2dc9576ab9", "sighting_of_ref": "indicator--3bbc6462-9f10-4aac-9a63-ea09042316b2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c2903ef-5f00-4ab7-87e2-f0759089c77b", "sighting_of_ref": "indicator--8f5935e1-b37b-4c77-a12c-05cc565b7ee7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6e76c74-a8cc-49bd-bcb5-9205aa4be29a", "sighting_of_ref": "indicator--7faaf7d5-9b5c-4b48-964d-e0f49e8f5d97", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3445eee6-edec-4db4-849e-3696556e4e7f", "sighting_of_ref": "indicator--673de82e-e272-45c0-b0ee-4fd1bdcbfc59", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1491ede4-8ff8-4958-a982-29fc98717754", "sighting_of_ref": "indicator--cee60735-5e88-41f3-b340-e0fdf4022a4a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c95de0c7-1ff9-41bd-baa0-2084b5b856d1", "sighting_of_ref": "indicator--41595fe4-bebb-4882-aadb-9164c4385898", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--647bb8be-fc8b-4430-b661-ec246bb1c68c", "sighting_of_ref": "indicator--9331746f-041d-4025-93fd-c0633c132aad", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a93ea99e-2c3f-464c-934e-a1b03e495ef8", "sighting_of_ref": "indicator--8a89ffb4-e03f-4167-ac82-eea2f2c6609c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cd29e48-88e0-4223-8c74-de33bee4f504", "sighting_of_ref": "indicator--607eee20-f417-4d32-9f30-f339dc5e8194", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be19f844-efec-4da6-aed6-b93955b0aa13", "sighting_of_ref": "indicator--8cfaa3ef-8a6b-4a0b-878a-d7cb45cba594", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32af45c0-b9b8-4ccf-a81f-33f7cd90e33c", "sighting_of_ref": "indicator--42b86971-ed46-48cc-ba3b-b981d0ae308c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55e976b5-9d12-4d0e-959d-d036e7a95743", "sighting_of_ref": "indicator--fc824761-a466-43df-b1c3-dc03c6d6b0d1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4db80f8-78e4-421b-b12b-757927b22820", "sighting_of_ref": "indicator--12216b9b-84c9-4a01-ba06-8c97bcd279dd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e53122b-d64c-4d7e-bf9c-1a0cde64124e", "sighting_of_ref": "indicator--79245bfe-d383-4e35-965d-e2948be65fc3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d50fc428-95ba-40e6-a5ca-8c2f6459fa0b", "sighting_of_ref": "indicator--3272cff1-3f55-42a5-8e27-a3eafc5410ba", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5991c73c-1dc3-4164-8487-7119aa6ae94f", "sighting_of_ref": "indicator--e013f832-7d8b-44d7-87bb-8d07a1a98ee7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0351c13d-69ce-4f7d-bad1-aa731ff1366a", "sighting_of_ref": "indicator--cff29ad1-126d-4599-b136-d2ca74635cf3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--941a524a-444b-41af-887e-3e0222afc9ef", "sighting_of_ref": "indicator--e5704ac2-ed0e-4b94-bd7b-5a2926831fff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--324658f6-5abc-40e1-96bc-81fa5f36d2ed", "sighting_of_ref": "indicator--4108a9b2-87b4-4299-bd2a-f5e387023789", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5002366-1dbc-48c2-8b8f-2f7a4e1562b5", "sighting_of_ref": "indicator--fd6538d0-cc8a-4ae6-8d5e-2bc923d2955f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d43e96cd-4df9-496a-9b0b-ac59c8c91283", "sighting_of_ref": "indicator--9ee586e0-cc33-4186-95da-692f1fb8c186", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e9d5e65-0db0-4bcb-9cd8-0b9ea07f6a95", "sighting_of_ref": "indicator--ef1aea4e-c7fc-41e5-8174-6f79decba3dd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7593a9c8-af1b-4050-9c9c-03033a2fe4a7", "sighting_of_ref": "indicator--c70d5d97-56b5-4e08-964d-5b4983e0413a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df47089b-8f4a-44a9-a4ae-7c875ed83b0a", "sighting_of_ref": "indicator--ceef7eb3-c7ef-441b-b14c-0b9806da77eb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--878785f4-bcd7-48bf-bbfd-9bc0f5967db4", "sighting_of_ref": "indicator--ceef7eb3-c7ef-441b-b14c-0b9806da77eb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d481c91-fa2e-476c-b73b-24b0dd2c077e", "sighting_of_ref": "indicator--1d5512c7-e419-47d2-a584-a9b6cc2fc8ec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f530a58f-5cb8-476a-aa4b-2dd0942502a6", "sighting_of_ref": "indicator--bcbeb7b3-2cd8-400d-8622-e1fb546ea51c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e15d7dca-e5a6-48e3-9073-b768af1ca9a2", "sighting_of_ref": "indicator--8bf5ae1d-c59d-42c8-84e2-212e09bb210f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67a680de-07e5-49f5-a6bd-7a2db4ab30b2", "sighting_of_ref": "indicator--10321154-01fc-4fb6-a97f-b15e1c9b0e38", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--535dcca6-5b1a-4362-9098-dc1ad7f55e60", "sighting_of_ref": "indicator--e562d9a6-f1b8-4243-a34f-d29796d1286b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce7f3378-0ed8-4c32-a439-ab91888a51c0", "sighting_of_ref": "indicator--0b6a69b7-3a9c-4084-bd5e-dcb5261f3fb3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b7c8e59-2f20-4170-bef5-af9e94734305", "sighting_of_ref": "indicator--818df662-ffcb-4739-bc3c-efd85566b0d1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b193568b-ca5f-402f-91c2-a0169fc8d1b7", "sighting_of_ref": "indicator--6076e848-b5fd-456a-9c92-1aa260926d28", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e746db79-feb6-48b7-b85a-328d4c7cec7c", "sighting_of_ref": "indicator--88cb34f2-e077-4376-91d9-444220f97038", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e1ca491-c09f-461d-bd82-2aa19f3f485f", "sighting_of_ref": "indicator--265419a0-f617-4a73-8c6f-438b49c1b0e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c9a542a-5b59-4c1f-8162-30dc84fd035d", "sighting_of_ref": "indicator--a5ff79ce-bf81-4e68-9c71-a9e500827e1a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec9116dd-e580-478e-ade8-59ee06084908", "sighting_of_ref": "indicator--a5ff79ce-bf81-4e68-9c71-a9e500827e1a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4edbcb97-5dc3-42d9-b240-81d0f37f60e3", "sighting_of_ref": "indicator--fdc01f6a-a144-4ef8-bbe1-75cc827a2968", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f84c4228-930e-4daa-ac02-aab51015c757", "sighting_of_ref": "indicator--fdc01f6a-a144-4ef8-bbe1-75cc827a2968", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a66df4a-2fa6-4db4-82cc-69aa2c5a7051", "sighting_of_ref": "indicator--ac7595f9-30a8-4c2d-9cf1-059819e48f33", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7d12bc3-b210-49b7-8578-cf1db840d922", "sighting_of_ref": "indicator--ac7595f9-30a8-4c2d-9cf1-059819e48f33", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--974f5499-2e20-4722-b2e5-14cb3f6927b3", "sighting_of_ref": "indicator--4b70b785-01b5-43ef-9f73-d35762ad9ec9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd04a408-e4ee-415b-9ca9-01098a12cf19", "sighting_of_ref": "indicator--553623cd-55e2-4ee7-816a-6f681725463c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0db7c84f-4482-4006-a665-62cef59a7bb9", "sighting_of_ref": "indicator--90f0a8aa-ce63-4b62-b894-3a51a9c2590b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4dbf127-faad-4250-af53-8d00bf10036d", "sighting_of_ref": "indicator--90f0a8aa-ce63-4b62-b894-3a51a9c2590b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fb2dc6f-48c4-4e4b-97bc-594be12d83e0", "sighting_of_ref": "indicator--cf12a416-44df-4f20-8dee-01ba02d48974", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6148f39-8c77-4f22-ad88-d73216a7ee25", "sighting_of_ref": "indicator--94eeea51-0916-4e63-9c73-495a900fb186", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f0446a8-12ce-4c43-a051-134e35badda7", "sighting_of_ref": "indicator--9568d16c-64e5-447b-82ed-8a5d38c7400b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ab2ee22-bb63-468e-902c-b9146822f361", "sighting_of_ref": "indicator--1f158786-d9dc-4b0f-932e-c70280d7e2d1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c26cc234-7ce8-4d56-a8b1-94e7d1ce0fbf", "sighting_of_ref": "indicator--44bc2206-e3a4-43d5-9df2-8a1e0ca40177", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84318bba-af40-45a4-a9bd-b5cd00312f85", "sighting_of_ref": "indicator--d9a3b7ce-100d-4452-b541-890d0f7f4dac", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bfd9930-6f66-422f-9398-d4e64cad7f9b", "sighting_of_ref": "indicator--29f4907d-9cae-4c1c-a05f-5d3fc1392034", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8b5998e-1c14-470e-b6ee-472cf84b421d", "sighting_of_ref": "indicator--3dd4d75f-3b03-4d11-8695-639e4cb0718d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90f4b0a6-87eb-4231-956a-a00160ceaf7a", "sighting_of_ref": "indicator--3dd4d75f-3b03-4d11-8695-639e4cb0718d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86743303-7eaf-4033-82c2-1885a2154119", "sighting_of_ref": "indicator--beb2be32-0337-4ec5-beb3-1d89fa46f362", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97155c51-f8d4-4193-8a88-7209db509c29", "sighting_of_ref": "indicator--9befbd82-390d-4918-9434-18089007d742", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93ef0b6d-3a73-4bff-869b-00892710a577", "sighting_of_ref": "indicator--9befbd82-390d-4918-9434-18089007d742", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bed8b13-1a03-40e7-b35f-4299f1c9d813", "sighting_of_ref": "indicator--100a56c6-1e9c-4cf6-ab49-e3196159f47a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--519f8a63-a1fe-439e-8a99-05fed9766230", "sighting_of_ref": "indicator--a879348e-5d20-4a38-a1e7-3823a9667fff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--144f8c1b-425c-496b-b3ba-798c505040e3", "sighting_of_ref": "indicator--a879348e-5d20-4a38-a1e7-3823a9667fff", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dfc198e-e38c-4585-a4ef-caa8e5626095", "sighting_of_ref": "indicator--b8571388-a813-46ab-8b4e-d3b81615b6db", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df8543ee-f813-4ae3-a09c-a04942412ec2", "sighting_of_ref": "indicator--b8571388-a813-46ab-8b4e-d3b81615b6db", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5efea697-0c4d-4406-bf2e-811bec01154e", "sighting_of_ref": "indicator--07b27f5e-2514-46b2-bd1b-57fb26c44a6f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e519746-5fe6-4142-ab97-3203d31ee7e3", "sighting_of_ref": "indicator--af4c119b-610c-40ab-9758-df1cb258703b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--468b5fa5-6864-427a-9ff5-f1220b10a0bb", "sighting_of_ref": "indicator--af4c119b-610c-40ab-9758-df1cb258703b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5352a777-1142-46f3-b320-cc7fc960dd51", "sighting_of_ref": "indicator--b30cfde0-7591-41a5-927c-d14f9caf92a8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d826d07-413c-4780-b8dc-ac302645d0b5", "sighting_of_ref": "indicator--b30cfde0-7591-41a5-927c-d14f9caf92a8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3e2fce2-22cc-4362-809d-be5c71e8c6a2", "sighting_of_ref": "indicator--8154e3e8-a1da-4d14-9e0d-6b2453b93af8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fff10fc1-08b1-4f60-9800-4f471487a6ab", "sighting_of_ref": "indicator--8154e3e8-a1da-4d14-9e0d-6b2453b93af8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--caa5f154-64c5-4a8c-96e2-f25b831a09ba", "sighting_of_ref": "indicator--e0f6b73c-6d7a-4525-98fd-a6b7acce15ab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2d9439e-daca-4bb1-aa4b-c8b1b51a7b08", "sighting_of_ref": "indicator--a536371f-2cfd-48a8-8ad5-75e656c1d38f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9911a8ae-7189-4581-a052-8d6629602aa2", "sighting_of_ref": "indicator--96bba6b1-ecf9-4b21-b376-949b18684b03", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4857d74c-cb29-4bcf-8171-9ee461897ae6", "sighting_of_ref": "indicator--1a0852d6-71b7-458a-b40c-0f180ba66d2c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a7ae980-5492-43bb-a9fc-1818d5c1e3ed", "sighting_of_ref": "indicator--02988116-a942-481d-beed-46edd0c85d4c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb743476-b3c1-46f6-929b-a7d7bb814673", "sighting_of_ref": "indicator--a5ef793d-eb71-494f-8e7c-cc7f6cc22b4a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35e04dae-918d-4b6a-a439-2b8971e59d7d", "sighting_of_ref": "indicator--34685c10-8f2a-421b-aae4-2002f723f833", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d53a6c0a-84cb-4ed3-b536-83ce33a324d5", "sighting_of_ref": "indicator--29326a19-3d24-42f1-ab17-50208543782d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cf02010-cee9-41a7-8c97-37ddd7107396", "sighting_of_ref": "indicator--29326a19-3d24-42f1-ab17-50208543782d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8f71373-68ff-45f4-908e-36d0effbd34f", "sighting_of_ref": "indicator--45e25e08-dd6f-4da4-bb56-2da01cf8947d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--610ed165-6a3d-49de-b782-29aaecfed8d1", "sighting_of_ref": "indicator--f57227fc-68f0-4afa-b061-26fed141236a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f79e3c53-375f-47f2-b5c6-4ab08aca48c0", "sighting_of_ref": "indicator--f57227fc-68f0-4afa-b061-26fed141236a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05638e21-96ea-41e3-b44a-2e4350ffa53f", "sighting_of_ref": "indicator--afe6fbe0-b495-4be2-a361-2dd2fd467649", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6abebef-43fa-4826-a3a5-cacbbd916dda", "sighting_of_ref": "indicator--403af9f5-fb28-433f-b400-df7b77a944d9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01e7e748-43c6-4470-a410-c320ee8648f8", "sighting_of_ref": "indicator--403af9f5-fb28-433f-b400-df7b77a944d9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--539879ad-05c8-4635-87a5-fba1305f2adb", "sighting_of_ref": "indicator--71257c29-0158-403a-9a06-fd165f6e92af", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28c368e7-2bce-4123-ac26-155853dc8c81", "sighting_of_ref": "indicator--f1ccd469-758e-451c-8136-6d06c888bbca", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45f3f5b3-7b8c-42b9-b83b-aac0dec48cc9", "sighting_of_ref": "indicator--e060b208-04e2-4dd1-9db6-127babfdc2ca", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb2ccfd8-ea6c-40a7-aa52-6c11f3ad3471", "sighting_of_ref": "indicator--38d50f13-56c4-4273-bd58-652672a18145", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7145ddb9-2489-411b-b252-7ee593ffe073", "sighting_of_ref": "indicator--5e8a3155-580f-43d8-b1b2-8de7f3b88a07", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f6b25b7-2d03-4d9d-aeaa-81dec6660159", "sighting_of_ref": "indicator--90daa9c5-b818-4cce-b6f0-ccd98409e5f3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c92a4d4c-91d3-4ec7-867e-873c99c7d453", "sighting_of_ref": "indicator--aee145d0-e226-4c27-be22-d282f2bd1a81", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a7d0494-aa4d-4515-8240-9dece3ef99c2", "sighting_of_ref": "indicator--82c0bfa3-8d72-43f2-81a6-d047025dec80", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd5ac73c-1bff-4768-8d6a-3daf4bdd0521", "sighting_of_ref": "indicator--0f7927ea-c93e-4d2a-85ae-4216133db9a2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--613f991e-03ba-4bd3-97ce-45d68e908aa3", "sighting_of_ref": "indicator--4eb680a0-a8a3-4ee6-a01e-81b8bc2d86d5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1c16e95-162f-40a4-bdb4-e8ec0cdbd94d", "sighting_of_ref": "indicator--04857a4d-d526-4eab-8e61-cf788f916392", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc5cbd5b-5ba5-476d-a12c-5738bd957b38", "sighting_of_ref": "indicator--04857a4d-d526-4eab-8e61-cf788f916392", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d22cf68-ddc9-472e-bfbb-980583f4f88f", "sighting_of_ref": "indicator--7bd9df27-0936-4c9a-a359-f6086d2d6947", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4ba6101-243f-46fe-9ca8-e325e428944e", "sighting_of_ref": "indicator--cdcda54e-5426-460b-b3f7-325490d01c1c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9c9fef9-ac2f-4e70-93d3-4aa234405b27", "sighting_of_ref": "indicator--cdcda54e-5426-460b-b3f7-325490d01c1c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38d159e1-a657-4e8d-8600-96f547d17503", "sighting_of_ref": "indicator--8a8046e6-d854-45ba-b9b3-3c0155d32e1f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec90bfdd-0098-42a1-a59f-07726bf88238", "sighting_of_ref": "indicator--8a8046e6-d854-45ba-b9b3-3c0155d32e1f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55e2a4fb-74a2-4329-9e38-92fa8df9b322", "sighting_of_ref": "indicator--46ab0053-4189-4966-9ffd-a8d1b963eb1d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47c3a545-cef1-4f5c-8b1e-dba8ac503263", "sighting_of_ref": "indicator--a75994d2-25df-4b8a-90fa-c040190c2594", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--114d81fb-8e3c-45b1-81de-890e8702de74", "sighting_of_ref": "indicator--758b8b2b-30ef-49d7-86ce-42a4f49dd3e3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55aba4d8-bc95-405e-9e2a-883686a151e5", "sighting_of_ref": "indicator--f3bdfbec-8366-4036-94ad-4c3c41824e67", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1efac07-c0d5-4c14-8fb9-8b10bea9b00b", "sighting_of_ref": "indicator--f3bdfbec-8366-4036-94ad-4c3c41824e67", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcdaf274-84c1-417a-a75b-7c385dac0445", "sighting_of_ref": "indicator--84886230-c97b-4972-8ea1-62a45b1212ff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5d0111e-cf8a-4ac0-a350-9e0fe3e6e322", "sighting_of_ref": "indicator--ae0a1e73-86d6-4f35-abff-561ed79163d2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ceb1be1c-21b0-4b93-8996-e447b7121096", "sighting_of_ref": "indicator--88625693-c1b5-4231-a41c-286099959aa7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edd28048-9632-4541-8097-0c3f91c0341c", "sighting_of_ref": "indicator--e364136e-efdd-4805-9888-f35f84954940", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a048eded-378f-46a5-aea9-4467630c3e22", "sighting_of_ref": "indicator--b75ed59b-e3a0-4d34-a93f-3324e017efff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93df08ca-808e-40d4-816f-290cf2f41d97", "sighting_of_ref": "indicator--b75ed59b-e3a0-4d34-a93f-3324e017efff", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87f0ad89-0056-49ed-b56a-81b4bdd981eb", "sighting_of_ref": "indicator--f59c5f31-5cf9-4446-a21a-7f297bef81d8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0493cded-5b3d-4a99-9605-85a80593e4b8", "sighting_of_ref": "indicator--f59c5f31-5cf9-4446-a21a-7f297bef81d8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d4053e9-fce3-4a73-91b7-c5c0c36893cb", "sighting_of_ref": "indicator--375308c5-c977-413a-a157-c7cd82e7b4e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5946bf32-d58a-47f1-b701-72eb5c8784d6", "sighting_of_ref": "indicator--375308c5-c977-413a-a157-c7cd82e7b4e6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf0c99b2-a85b-441f-8b00-d43a1db4c952", "sighting_of_ref": "indicator--e93bb9e0-b821-4a90-bd31-5c76ba105385", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09c6c017-5f84-4cfd-b58b-057a54ac62f7", "sighting_of_ref": "indicator--eefbeca7-16bc-4576-8a59-997e93ae923d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dbda9b1-d5d6-4d10-a56d-fb8f60dad7c0", "sighting_of_ref": "indicator--00123454-3b1b-47f2-bcca-029d2c7b5645", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f26929a-5f38-42f3-8a41-2a9665e47b32", "sighting_of_ref": "indicator--00123454-3b1b-47f2-bcca-029d2c7b5645", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b738b05-f858-464d-9ae0-c881cdec8ef6", "sighting_of_ref": "indicator--699f921e-ce6f-489d-a80d-44191c0c4ed9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60c22294-a14f-4ad2-8b80-76065d563b7d", "sighting_of_ref": "indicator--8901b957-0255-4b7f-b3ee-e6512b68eb58", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcb4ded8-c5d3-45c2-8753-850ebe6f234d", "sighting_of_ref": "indicator--a69866ff-03f1-4fcd-85c2-996de3f873ff", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3947370d-6a23-4196-97ee-7489224901fa", "sighting_of_ref": "indicator--c2597a88-3807-4cb4-ba99-80ffa3407d62", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b7c56ab-ca2d-4198-a15a-14479b4cf91a", "sighting_of_ref": "indicator--c2597a88-3807-4cb4-ba99-80ffa3407d62", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0feff8c5-e185-4a29-a780-c44963a2ded1", "sighting_of_ref": "indicator--78cb30fd-7a7f-4358-9f45-fa9cffc6c2e7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c288a9e7-7d60-4441-9b09-9fc6b72b2afa", "sighting_of_ref": "indicator--7389aa2b-c084-48b9-8768-36700928da3c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f541f5e-3403-47b3-bcf8-dd312d1a2012", "sighting_of_ref": "indicator--7389aa2b-c084-48b9-8768-36700928da3c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c0e2f1d-37ab-400d-b6c9-e6c33f35fd5f", "sighting_of_ref": "indicator--9dc91123-f79e-48ca-979b-bdf7003395ca", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--580b25ca-db28-465f-8b2b-aa72e9ac3e54", "sighting_of_ref": "indicator--9dc91123-f79e-48ca-979b-bdf7003395ca", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fecff7d-899a-4d26-8b9c-f37a1cbb0929", "sighting_of_ref": "indicator--eba8970b-07e0-4ce0-ae36-1ec83e7e0cad", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6565b0d4-df77-4533-9bcb-6fddbee0a83d", "sighting_of_ref": "indicator--1fb750c3-31ff-47b1-9bac-3f3a09c94576", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5da5e368-b92d-47d1-9f4e-4a06c2e22955", "sighting_of_ref": "indicator--941c00d3-9ef7-47e4-a89b-5d89e5552c2c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66acc1fa-0fd1-43dd-9ca0-da0f3c8ed36a", "sighting_of_ref": "indicator--b09320cb-8428-4747-b533-7d21bdd251b6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8984b458-6b8e-4571-af3c-852bdee12934", "sighting_of_ref": "indicator--7b73f092-ddc9-4271-b48f-8de5d467fbcf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f2ea2fd-a093-4181-8f80-1dd7c91c61d5", "sighting_of_ref": "indicator--c89a11f1-7396-40ac-81d8-fd80c4402ddc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af72be3e-4b02-4fe4-af8f-2ee365e3e6c0", "sighting_of_ref": "indicator--c89a11f1-7396-40ac-81d8-fd80c4402ddc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d3c8e2c-13bc-4bc1-98a3-349d972cb411", "sighting_of_ref": "indicator--194dfd22-69b1-4fdb-b462-2f093160e6b1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f5c211e-2503-4fd4-aee7-4f1d291f8449", "sighting_of_ref": "indicator--194dfd22-69b1-4fdb-b462-2f093160e6b1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80214baa-51fd-46ab-8d5a-015b9ac76b94", "sighting_of_ref": "indicator--834ad36c-2cc5-4fd6-b206-40ab1865e32e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--044ff91b-2561-4573-bc4d-ce28d3db06ee", "sighting_of_ref": "indicator--c6375b05-dbb9-4593-a99d-876496975e4f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af6e5fd2-9ffc-4914-a3f2-9b580b87a9ae", "sighting_of_ref": "indicator--9dbaf387-097f-4989-baed-69ebb5a0cf34", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5894c35c-c478-4ebb-94d5-25cfab0c1005", "sighting_of_ref": "indicator--0c156c87-bfff-44a2-915c-0f8cb8983329", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b56e1609-d119-4323-8d65-4b36e8cb1adf", "sighting_of_ref": "indicator--664e71ae-58d8-45a4-8516-a4473314e1ac", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76f60c72-5f5f-449e-bec7-a1425991d6b6", "sighting_of_ref": "indicator--efd80a44-8d1a-4afe-9499-db366fb9be4c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e2a6c66-9905-4cc7-b51c-6f6e811cdc04", "sighting_of_ref": "indicator--c4195840-87dd-4b1e-b483-1152f4d5ff82", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b52710f9-6d95-46bb-b52f-d796c7487175", "sighting_of_ref": "indicator--efd61d3c-704d-4aa0-b9ee-3d46787fcf55", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--266b506d-0a6a-42ed-9770-cd4b3e9def33", "sighting_of_ref": "indicator--5a0c332f-68c8-429f-ba99-3924691e07f1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d79b23f-fbba-42d3-8c81-4abfd7a03111", "sighting_of_ref": "indicator--16cb8677-624b-4f28-9bd5-1748340cf44e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cd10d4e-80e3-4d6c-8e5b-acb7d9054eca", "sighting_of_ref": "indicator--16cb8677-624b-4f28-9bd5-1748340cf44e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4af5088b-aba5-41ca-a7e4-07622a5c3fc1", "sighting_of_ref": "indicator--9ad9abc5-fa54-483e-a16c-050fba68a4e5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cd9b001-6977-48ab-94a7-db20f96b0077", "sighting_of_ref": "indicator--f978d304-be9b-4602-8fb8-c354a9e9a561", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--038d1a91-0322-460f-adbd-28bda13bfed7", "sighting_of_ref": "indicator--c6c1ac78-5aef-4e5c-9dd2-436cddeea68f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--daf3dbfa-aedf-4c8d-ae05-f5932a7bdd72", "sighting_of_ref": "indicator--c6c1ac78-5aef-4e5c-9dd2-436cddeea68f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--696d3dc9-9189-47f0-b5e4-c3f331e0c278", "sighting_of_ref": "indicator--ef3196b9-64b2-4766-bc12-6735eb9cef66", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dcea204-8de3-4b46-a3ae-821a8dadba8c", "sighting_of_ref": "indicator--5e0a98f6-88e4-4509-be09-0f48b6c5c384", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08b4aee9-3ab8-41cc-832d-8972c1bbb3a1", "sighting_of_ref": "indicator--5e0a98f6-88e4-4509-be09-0f48b6c5c384", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2cb0e0f-0505-4537-ae02-f0f703e0f146", "sighting_of_ref": "indicator--b88d75be-64c9-4818-8855-09f6b3c58493", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0723d743-3d85-4117-a860-2308545395f0", "sighting_of_ref": "indicator--e1b6e3c2-f773-4406-8442-1dab014fa972", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--861daf01-07fa-4369-a848-28fe3fa8620f", "sighting_of_ref": "indicator--1a5951dd-0970-442f-b50a-232ae6d370b6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da9a8fe0-5882-4f0b-a8e1-4432875c5944", "sighting_of_ref": "indicator--1a5951dd-0970-442f-b50a-232ae6d370b6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3acfa14e-5685-4924-96f7-2a70089a395f", "sighting_of_ref": "indicator--349a3493-bbf2-443a-aa80-2a41569888a7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ff1333f-e4a9-4173-8f77-461f6bf9f2a3", "sighting_of_ref": "indicator--63a2acd1-d918-407e-b0e0-6fd47ed40b8d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43dad27f-3e8a-46b7-918b-0dd3858ce158", "sighting_of_ref": "indicator--63a2acd1-d918-407e-b0e0-6fd47ed40b8d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16e6dff6-2491-40d1-ae24-7fa64913538b", "sighting_of_ref": "indicator--e391c1ef-db82-48d5-be45-225418122b78", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46d3be08-2e7e-4696-8b73-eb09e29e0b06", "sighting_of_ref": "indicator--e391c1ef-db82-48d5-be45-225418122b78", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8eab0192-6a3c-4d33-a82a-e3cdd1e7a165", "sighting_of_ref": "indicator--eb2f0979-1e05-48a6-b4aa-9858dbc96f29", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e28cd01d-6235-467c-aec3-0af7546b2932", "sighting_of_ref": "indicator--dd79fceb-81e7-4c6a-bfae-4f944f816b59", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19303ebf-e9f5-444c-8c6f-a97e720263d8", "sighting_of_ref": "indicator--dd79fceb-81e7-4c6a-bfae-4f944f816b59", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a26c6abc-b778-40e7-bd3c-5d7114c5c695", "sighting_of_ref": "indicator--33d7e491-5876-47ef-93fd-be0955e5d17e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12800461-73a5-4781-9de8-e6ffe9aa042d", "sighting_of_ref": "indicator--ed618554-2e6e-4c4f-bc36-97b040578e7e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e7f08a8-bb5b-4711-83d2-fed27fda4bb0", "sighting_of_ref": "indicator--a4643c9d-8273-41da-a015-1343149447c5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5252105a-d0d3-4532-8bfe-d0b91fe32883", "sighting_of_ref": "indicator--a4643c9d-8273-41da-a015-1343149447c5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73e7c465-3eb3-4224-b7bb-0c11da805337", "sighting_of_ref": "indicator--102beccd-56d4-4efd-a328-b4a8a4fcbcb9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87618df8-f5e7-4254-a925-00c2795d986c", "sighting_of_ref": "indicator--78b037cd-ad27-439d-996a-af09db65806c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--109f41e0-b558-48fb-8f96-fc3064f3bdda", "sighting_of_ref": "indicator--b8a62823-c062-4318-a4f0-3f3a2bfbded3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c341b94a-b96e-4ca8-be4f-34db2a86357b", "sighting_of_ref": "indicator--85a49753-d233-4ffe-997f-49d93b7ca209", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f610299-9f9c-4c43-bf1d-68b725862f89", "sighting_of_ref": "indicator--1a234cd3-0161-47e0-af7d-fcbb2f49d4e0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9b47317-25a1-46e8-9e5c-6e04bbb910b1", "sighting_of_ref": "indicator--5ece70bf-1afd-4f06-955e-658427edbcf4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc0b0a4f-fd60-48c5-bd3e-b3334020d1cc", "sighting_of_ref": "indicator--52a7697e-85b3-4078-b616-c802897208bb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7eb4c4ff-30bc-42c1-8746-e87197e55072", "sighting_of_ref": "indicator--ad9097a1-ea4b-44be-a345-b7ac6800ca7b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0732f6ec-b8ab-4931-a258-b5ff30a4240b", "sighting_of_ref": "indicator--4631020e-5a9a-458f-8050-a5e740711046", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d050ead6-2c64-4244-ab54-e1f13ad6bd72", "sighting_of_ref": "indicator--ea64232b-cd83-428b-9e38-c8bf1b7cfdd8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbfff127-3dff-490b-9c7f-5e08e22b60f2", "sighting_of_ref": "indicator--b32dc9e3-ac6e-46ee-9bcc-6f29d320d31c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a51479b1-31d2-4bf3-8aed-87ebb88c8b75", "sighting_of_ref": "indicator--3d00a8ac-12c9-49e2-9f08-8a858c219014", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d1dcc02-4662-4e10-8b75-076a0cea77d4", "sighting_of_ref": "indicator--2314e2a2-b65c-44e9-bbd8-aabd71e83954", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe1f87e7-4e5b-40c1-823c-e973dcb2a469", "sighting_of_ref": "indicator--e259d744-d769-4867-9a53-1eab94e1fffd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02a8bcdf-8255-4a74-b1bf-f113db84dbcb", "sighting_of_ref": "indicator--67daca06-fe37-4e40-9293-76c28274ac53", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a11b4d0-824a-45bf-a4c0-4c02101f0e20", "sighting_of_ref": "indicator--2558c395-4b4d-46c0-898c-d8a36375a0bb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c60701f6-6960-4d8b-b265-fcdcccb94e5f", "sighting_of_ref": "indicator--ab920a9b-17fe-4f32-925c-53bf98e8ee85", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe8ac093-07ba-4911-838b-b7e44d4d30dc", "sighting_of_ref": "indicator--5ba10fd9-b19a-4023-93ed-1212bff25b55", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--887616a1-3a4c-4b40-987b-f393c5ffd97f", "sighting_of_ref": "indicator--0776dbc5-7839-4ed2-b685-6c7e8ff94eaa", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10ca3a7c-fa9b-4a5f-99fa-d5b58c8a24a6", "sighting_of_ref": "indicator--05af2bd1-5ecd-45c9-88a1-0bdc0309a32f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35156355-56c4-4035-bf55-5cc164cb3e62", "sighting_of_ref": "indicator--4448b9d6-80dd-4944-8cd1-1c55bef0a222", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0962fcb-bafe-45c5-940c-478da113ec0e", "sighting_of_ref": "indicator--5ac02e36-776a-4875-8be7-f7681a8978e5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d408e524-d452-4413-b1b4-b9537d027d93", "sighting_of_ref": "indicator--8d0de90b-eb42-46ff-b96d-42675206fc16", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afec4ce7-f63e-4dda-bc0e-f0c074be2ac7", "sighting_of_ref": "indicator--46972c3b-0b66-4f04-9592-1448453e06b0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--290dd484-99ba-4d17-aab6-a15f20d06f2d", "sighting_of_ref": "indicator--0a5eb85b-1644-4a8d-ac85-ec8b03e0feb0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06f0dd57-53bb-48dc-89b4-32aafa658253", "sighting_of_ref": "indicator--00392688-6d45-4cd3-b2eb-bd04d4d63f56", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a500bb89-0620-44ac-bdaa-187b2947414b", "sighting_of_ref": "indicator--6d06ae2d-1115-4e0d-a16d-c9d4d53bf703", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eb8ddf2-0dfe-419e-a88e-db6d9bd5c3b8", "sighting_of_ref": "indicator--fc123c8a-3d67-465d-a0c3-21ca0e9ab339", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6efbbac-7555-4f80-afb1-9bbbb21734b8", "sighting_of_ref": "indicator--1eb97387-44ea-4b3f-9a45-b246b5109c41", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecb1bb6f-5340-42d2-a773-7dfffc7cabcb", "sighting_of_ref": "indicator--56d0c148-8abe-4fe5-a71b-274214c9d70e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9afbc965-0cf1-44e4-9479-7af7455cb1df", "sighting_of_ref": "indicator--2846e13f-7005-4f43-8ab1-44d416d1d405", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b83746c-a384-4cde-b5f5-10c09840c4d9", "sighting_of_ref": "indicator--fdec616a-1193-4581-8828-15745767379e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1059703b-379c-49c5-9bf8-4d6aced589d5", "sighting_of_ref": "indicator--1b36858b-31e9-412b-856f-96ec1ac3a9bb", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46653ec8-edef-47f5-9180-8c1377ebf3bd", "sighting_of_ref": "indicator--c684d5e8-bfb3-446e-862a-55c6cfaab64f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--950b0c1c-393f-46a7-a2f6-95bda3e0b18d", "sighting_of_ref": "indicator--28f12005-3346-468c-aa8b-0091f44891f8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--793d5cbc-4ddf-4e37-b2d0-2ed3048fd9be", "sighting_of_ref": "indicator--f4e0847c-1f69-41cc-9f1c-c06b4656e0d6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a5c178d-20d6-4082-b0ad-bb68b072a899", "sighting_of_ref": "indicator--b6ff6613-5fdf-4360-97f6-79bbfd02edc6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40465bc1-ab6e-41b7-b98f-d7860fe8c5f4", "sighting_of_ref": "indicator--c9fb8ad1-3323-4c46-8369-2dbc8b3cec7f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ce951bb-2690-48a2-ad7b-81442e58fc32", "sighting_of_ref": "indicator--4e8a62c3-af58-4cad-8fca-e375ab71211e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7f0c109-975e-49f4-bc03-b4328e9b40d8", "sighting_of_ref": "indicator--4e8a62c3-af58-4cad-8fca-e375ab71211e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a2bba90-fa94-4628-8010-e454cbeb5477", "sighting_of_ref": "indicator--463be211-8f83-401a-9b23-a7e8ba66fa74", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a821385-3eda-4cb5-83fc-2e19a4a2481f", "sighting_of_ref": "indicator--ee784d79-8045-426e-bbdf-fdf953868bd4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5afafc9-ee10-4117-b3d9-c97e8184b743", "sighting_of_ref": "indicator--ee784d79-8045-426e-bbdf-fdf953868bd4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a509f78a-31df-4889-a7f7-edc691b4fef5", "sighting_of_ref": "indicator--dff3c328-81af-4d7e-ac60-65766cd0898e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--160f7a88-9cc4-4c16-8c3e-2be1a6db3c2d", "sighting_of_ref": "indicator--6ef2d9e9-23ad-48bf-ac17-068bdf18d1fd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--392ebc59-4cd0-4f9c-b25b-449fa79c5bdc", "sighting_of_ref": "indicator--93d05ae4-5cc1-4cb7-ab72-a2e220444f02", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0758dc1-84e4-41ed-b5e7-4a733498d93e", "sighting_of_ref": "indicator--93d05ae4-5cc1-4cb7-ab72-a2e220444f02", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f2d3bdf-cc69-45dc-ae89-ae492e62d680", "sighting_of_ref": "indicator--d09a9a0b-180a-4d14-b0ab-6891077cf1bd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6901160e-5d9e-4372-b941-0b80611783a2", "sighting_of_ref": "indicator--9b564bbf-d651-4385-9f4e-cb75a3531e7f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed32cac1-92dc-49a7-9f4d-6c0da49eab00", "sighting_of_ref": "indicator--45e30fb8-ed81-45b5-b697-2ab9bebe1ed2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f53219ef-0055-4906-afa9-8a20dc34cec0", "sighting_of_ref": "indicator--45e30fb8-ed81-45b5-b697-2ab9bebe1ed2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbb5dd51-2f66-4172-bfb8-6d33acc33752", "sighting_of_ref": "indicator--2c102c6d-ae8c-4b85-a0c6-b74f5f10f063", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e14a2d9-1fce-4b32-ab47-c4612e88284b", "sighting_of_ref": "indicator--2c102c6d-ae8c-4b85-a0c6-b74f5f10f063", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db9fd544-8f7b-42d0-aa72-845b3a7f60ae", "sighting_of_ref": "indicator--c4b79361-bf8e-475f-a355-15e0e418361d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e95f691-4f22-4673-a234-387fdc500f9e", "sighting_of_ref": "indicator--77cae88e-4818-4dca-8e6e-0ac9c39d99e8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c283456-4f1f-4ccb-8c8a-9933e5db6f3b", "sighting_of_ref": "indicator--77cae88e-4818-4dca-8e6e-0ac9c39d99e8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9741a694-069c-4d9a-83b9-a78ddc125678", "sighting_of_ref": "indicator--bc22f2df-6208-4761-838b-7cb8414a5c6a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0fd3feb-65b3-4260-a038-4ddc99228a61", "sighting_of_ref": "indicator--bc22f2df-6208-4761-838b-7cb8414a5c6a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1608cc2-2377-422c-b7d3-7aa7e3d92114", "sighting_of_ref": "indicator--64d02ee4-66bd-4ca8-989f-d4d582e19556", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34e38151-f045-4d83-9ef0-e2de5a7bb270", "sighting_of_ref": "indicator--3541d613-8bdd-4553-a958-bd896274a555", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95e385e4-9426-4c01-8c22-1b2a5be75f0c", "sighting_of_ref": "indicator--1e448f27-5266-49f8-a6f1-e9c564f12979", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74df2c96-16aa-46b5-be04-6d984592826e", "sighting_of_ref": "indicator--43dd813d-253c-4c24-899a-4a2e50935d1d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23712dc1-7b12-4884-8332-a011ce44da84", "sighting_of_ref": "indicator--01639248-6778-46a7-8551-9f251571b04f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba065633-e88e-426c-a53a-6c7c6a3ba3fc", "sighting_of_ref": "indicator--e158678a-b2e7-4be6-97eb-3cf3082e5802", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef07850a-2783-46ce-93b0-7aa253fab598", "sighting_of_ref": "indicator--e158678a-b2e7-4be6-97eb-3cf3082e5802", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc0e9821-a744-455e-97fa-f57e027d0cb4", "sighting_of_ref": "indicator--9483b61f-37a3-461a-beee-cd6d2580c2ba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77674a48-56b1-44f9-838d-1635f0795586", "sighting_of_ref": "indicator--3ef5c200-d24b-4eb3-aa1f-2d16b154ba0c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efb1f8cd-708b-4b39-92e4-87e10f4cc616", "sighting_of_ref": "indicator--3ef5c200-d24b-4eb3-aa1f-2d16b154ba0c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cbd9394-7752-4c8a-bbba-3afc9717c5a6", "sighting_of_ref": "indicator--08d66171-3fe9-49f6-9050-7b02d2020788", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a26d338c-6044-46b2-8077-3e5a66fdb2a5", "sighting_of_ref": "indicator--87ed4db1-b096-41dd-ab1b-19aaa2bb2e39", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3126c273-476b-4aaa-b2cc-7f3f8caee6f6", "sighting_of_ref": "indicator--faca9ab6-6f64-408c-9043-18498dcfa08b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7e64c6b-6860-46c4-8ccf-c94dec1fecc5", "sighting_of_ref": "indicator--8c728dae-a885-457d-a683-4e5cb98aa838", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89ff5468-1491-43e0-a903-1105d7286908", "sighting_of_ref": "indicator--cbcd4678-1b43-4086-820e-fd101f69b9c9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f3e4111-0b37-4d48-99f1-5a5799542f0e", "sighting_of_ref": "indicator--cbcd4678-1b43-4086-820e-fd101f69b9c9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--298be70f-4cc5-4942-8fd6-28af96402c93", "sighting_of_ref": "indicator--247478cc-5426-4106-a7ac-9896fff27288", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9fe29c4-885a-48be-9448-40672d84d2f4", "sighting_of_ref": "indicator--c7b5f20e-2842-4d7c-a90f-65fa15e9d356", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--698217b6-977c-43f0-a1c7-bef2686f1999", "sighting_of_ref": "indicator--09f4653f-008f-49da-b058-b8135d1dda1f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29664ebd-fc05-4fc5-ae0e-58d670c4c866", "sighting_of_ref": "indicator--518d47f7-cd24-4030-a9ff-294fc2ac3692", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0725074-cdcc-4245-b483-e5d5f83b0f67", "sighting_of_ref": "indicator--6e8c25a3-b952-478d-8d90-50a294747330", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3be2dc16-90f3-4608-804c-8b67d1ce64eb", "sighting_of_ref": "indicator--171c9c97-02d6-4883-a01e-09f6a9a21b85", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12126ff6-0c11-42db-b05a-a21f720ac652", "sighting_of_ref": "indicator--0986a2e9-fc2f-44bc-9d53-d63707bcca88", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--692d2042-8a87-4b5f-9bf5-16c9c704dadb", "sighting_of_ref": "indicator--1e9aefbe-5a48-4f2d-a857-b53b664fbff8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--780f6a2f-d9ab-4c1f-bc6f-7e19df0f80a9", "sighting_of_ref": "indicator--b3dfe421-4e0f-4ecb-85ea-efb059451678", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14089997-673a-476d-a778-ba8d0b35b96f", "sighting_of_ref": "indicator--854551e6-f55a-434a-b40b-7bbc68a52dd7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--230e147d-cbc8-401c-aefa-e1cd00fa220c", "sighting_of_ref": "indicator--0ebbc850-242c-4dc0-9cab-c2583af99305", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be639800-33c7-4d86-bfaa-6c93093f64ed", "sighting_of_ref": "indicator--aebf2b94-61c7-4773-ac78-790a92bf53bf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--436838f4-cfbd-447b-8947-b37ef2711fb8", "sighting_of_ref": "indicator--aebf2b94-61c7-4773-ac78-790a92bf53bf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e71aa64c-b557-4130-aa9c-9c3d1b30faba", "sighting_of_ref": "indicator--55b72e05-3591-4707-9c9f-c8e335940db1", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02b40d79-1f51-481c-abdd-2d753fd4b6ce", "sighting_of_ref": "indicator--55b72e05-3591-4707-9c9f-c8e335940db1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8d80054-c20d-4efd-bafd-5a6756578717", "sighting_of_ref": "indicator--55b72e05-3591-4707-9c9f-c8e335940db1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d8fec1c-9ba9-448e-85a2-dd190332e350", "sighting_of_ref": "indicator--20d8606a-679f-4bfa-8e91-bdd1d27e2817", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da46cb74-0445-4f95-ba68-625eb38f1926", "sighting_of_ref": "indicator--20d8606a-679f-4bfa-8e91-bdd1d27e2817", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea14ec60-d8e8-43ce-8e0e-c4e038dca8fc", "sighting_of_ref": "indicator--27fdc402-8c0d-4515-9561-1048fb006d66", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a0fb7ee-3468-4502-91b8-c0891ff40833", "sighting_of_ref": "indicator--27fdc402-8c0d-4515-9561-1048fb006d66", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7a5879c-1960-4d38-bcc0-cc017a43a80d", "sighting_of_ref": "indicator--96551dd5-992f-4f6f-8612-fb7729d3b148", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68fe7b69-4afa-4b4d-8f70-145146262a51", "sighting_of_ref": "indicator--96551dd5-992f-4f6f-8612-fb7729d3b148", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05113808-5b21-4bf5-a324-83e9280b8f24", "sighting_of_ref": "indicator--00897efb-17fc-4dd7-98c1-9a0acc3f090b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ec3ca12-db3b-4dce-a6e8-3d074055bcb9", "sighting_of_ref": "indicator--247436ca-9a0d-42db-b388-64b97bc25c84", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cda4a390-0641-4f23-9872-64b51db867e2", "sighting_of_ref": "indicator--000f1579-852d-47df-9ff0-f2595658fb8f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ac6914d-c893-4b57-be63-79dada0e7e93", "sighting_of_ref": "indicator--620cdd45-708a-4f32-99df-be0783b2851d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34e683bc-3b7e-4367-8531-953edb830963", "sighting_of_ref": "indicator--cd2abad6-8904-4d28-9827-83c26f1e61e8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2e6e219-3366-4774-a855-8cef2d9d3a7c", "sighting_of_ref": "indicator--29978461-4d2a-4e85-b665-996c64c14df8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c817e10c-13b1-4a5f-ac5b-d8146df8d35c", "sighting_of_ref": "indicator--29978461-4d2a-4e85-b665-996c64c14df8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d710bc56-9940-40ef-b925-07664e13da3a", "sighting_of_ref": "indicator--bbfc0ec7-6bf9-4450-94b1-0f0de44d0777", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--914e83db-9ef8-4a6a-ac40-aa26b23cc8b5", "sighting_of_ref": "indicator--bbfc0ec7-6bf9-4450-94b1-0f0de44d0777", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e87cdd6a-dcae-4619-ba5c-951c2e55776d", "sighting_of_ref": "indicator--e4dec4b1-098e-4365-910e-6951adb20556", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb44f460-c33e-4c34-bc8f-4c521204cf7b", "sighting_of_ref": "indicator--a1480cd0-e27c-45cc-a0e0-08cb25ce1449", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6b6469c-9213-43a8-b020-c972cd0ad278", "sighting_of_ref": "indicator--a1480cd0-e27c-45cc-a0e0-08cb25ce1449", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b715a2a-d8b2-4408-b8e4-0c3137b2f5ef", "sighting_of_ref": "indicator--6b57f88b-8b1f-410d-a3fa-88f433f6838b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d56fa9e6-638c-47e2-b67c-572e65f310a5", "sighting_of_ref": "indicator--37e9a581-4ea5-43ed-8fc6-8c7042abc4e2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1ce48c4-bd27-40c7-8242-d8fa4b4104c4", "sighting_of_ref": "indicator--37e9a581-4ea5-43ed-8fc6-8c7042abc4e2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e97383c-231f-4131-bc22-815854a49a13", "sighting_of_ref": "indicator--f6a95eeb-ecda-4f61-9e1c-33d5225a3265", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ed8954b-2266-4dbc-b839-7032e813648b", "sighting_of_ref": "indicator--a81f8af6-5b15-46ed-9868-84b2d32b9467", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49e833a6-fb15-44ff-bc10-af7c2cc5d8e4", "sighting_of_ref": "indicator--7017a2b7-3e92-429e-8a98-2f30775747a0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88762713-f6e8-44ee-906b-d2bde583b16c", "sighting_of_ref": "indicator--de60b77b-0b5f-4ab6-81b0-161a7a415599", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90078287-9d0c-476f-a5f1-be8b3d4cd9b5", "sighting_of_ref": "indicator--7b699cb2-f469-44ac-a8ae-3e2a68577a33", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af3c1de5-9bf7-4129-aac4-8370754dc983", "sighting_of_ref": "indicator--beb60ce1-2dfd-4601-a5ca-e7d793c8ce0d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da1a5da3-0cc4-47b2-98ec-f09087a5c690", "sighting_of_ref": "indicator--beb60ce1-2dfd-4601-a5ca-e7d793c8ce0d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7fd2f52-5801-401b-ab14-8e9adac7e131", "sighting_of_ref": "indicator--610485eb-0ef9-4b8d-a93e-9d4db9b5226c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5513087d-9201-4a73-b858-1ddcbb4376f8", "sighting_of_ref": "indicator--02295e72-eaa0-41d3-9065-ed1480b0e456", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22626f2b-1e3e-4ec3-ae68-9399fd59caa6", "sighting_of_ref": "indicator--a379e43f-22c1-4225-afa5-ce8e47fbcc3c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21f5d489-d026-462d-a7b8-3facc7726cf1", "sighting_of_ref": "indicator--df26d445-6d9b-4bbd-862d-de7fab979d25", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7ed1d44-bf35-41e1-9f47-987fee7065fd", "sighting_of_ref": "indicator--fa7c033a-6aa0-4d8c-ac1b-d3629bb64a14", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--982e5b91-6faa-4fd8-9489-684a859d9028", "sighting_of_ref": "indicator--c7368c61-306c-4921-8888-92682f7925e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b50f47e7-3e6a-4454-a273-d6e3fcd4055b", "sighting_of_ref": "indicator--34b4f486-e168-4544-8f5f-93f09aefcfb3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--499d4083-4c4c-4784-9f99-f4662f06e044", "sighting_of_ref": "indicator--fa808ecd-fafa-4a73-aa97-9ac35b4a0d5d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ec632cd-f4bb-4678-9198-832ccacd183f", "sighting_of_ref": "indicator--136491be-d714-4754-b297-b3cbf1100639", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3015986c-f67b-4f33-a878-102641d2d198", "sighting_of_ref": "indicator--99f6fca4-5613-4729-b2c7-b746c8c17908", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cfde312-23e2-4b00-8f1e-5472ab1f51c9", "sighting_of_ref": "indicator--36fd5ce5-7418-42f3-8a54-6e0435ce3ff4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3516d61-269c-4e4d-9d08-2b616660600a", "sighting_of_ref": "indicator--32869f93-30e7-4d77-9783-73495be7ca08", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d9a1ec3-e20e-4734-a704-90ecfdb76fc7", "sighting_of_ref": "indicator--0d1e7c5b-3716-41b9-9b35-64832588a2b9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1079e02b-3318-4ff9-bc0f-50b10066d217", "sighting_of_ref": "indicator--9d11fd02-43bb-454a-95f5-cd7881d0fdbf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfebc8e2-d575-4240-8996-c35d12cf0528", "sighting_of_ref": "indicator--343ef2e8-1a14-4030-86d2-e6f673d3dbc8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff71d253-89ea-48f0-9ab8-b69ee6068c9a", "sighting_of_ref": "indicator--8b778cbd-978a-4f6b-ab09-b561b20fbf8f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb480660-f55f-4e2c-8f27-52e909093936", "sighting_of_ref": "indicator--efe68672-6c8a-4ecb-8e5f-b8cdd3d2c438", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7471deb0-758e-4a71-8af8-74a04aa91abe", "sighting_of_ref": "indicator--0545d6ac-d866-4484-9acd-e8729030007d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cc1551e-11aa-4ed1-85c9-7c6333ecaa6f", "sighting_of_ref": "indicator--0545d6ac-d866-4484-9acd-e8729030007d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5f597f3-a87e-445c-bb73-91cb0bd6a662", "sighting_of_ref": "indicator--64ed0439-fb3f-4626-9340-5800d061dd6d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e35fad9-3056-4fbd-9776-6918646fca94", "sighting_of_ref": "indicator--1799b320-0998-4ab9-a993-0b1936364115", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66d8aab9-c1d7-4997-b619-525f1cbf04b8", "sighting_of_ref": "indicator--1799b320-0998-4ab9-a993-0b1936364115", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1324aedc-18bf-4ec7-97f5-2bfcf1a5537d", "sighting_of_ref": "indicator--93485f38-e28c-452c-99cd-dbcfd18b77df", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57072823-a17c-40c0-8c44-15e481f27968", "sighting_of_ref": "indicator--2fd3f534-6707-41cb-b800-e7f03a06a497", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--416d1253-0d91-4d03-9392-3f001af453d5", "sighting_of_ref": "indicator--61726493-4d15-467e-a868-95e358c73674", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f388abf2-5dbd-43e0-b093-e3d3e82185e3", "sighting_of_ref": "indicator--6171799a-f8d5-47bb-a3ee-10578dc51706", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad159fd1-b3dc-4b3f-945b-f5406c4ed5b0", "sighting_of_ref": "indicator--34268c34-2f9d-4b57-979d-9d5c9078d929", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56d77828-476a-404f-b1a1-ff363780c72d", "sighting_of_ref": "indicator--34268c34-2f9d-4b57-979d-9d5c9078d929", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--662263eb-eb4d-4113-bad0-adcd842e78d5", "sighting_of_ref": "indicator--863b3fab-70e9-40be-9822-a57f3a8c7b74", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05c42aa0-7273-4a92-8f6e-a29b528ade6e", "sighting_of_ref": "indicator--863b3fab-70e9-40be-9822-a57f3a8c7b74", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--defe8e96-c767-4de5-969a-a19a32e3df81", "sighting_of_ref": "indicator--7384c067-76c4-4c04-9844-36549e3fd99d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a339346-4085-41f3-baac-2f5b1fbd1a23", "sighting_of_ref": "indicator--7384c067-76c4-4c04-9844-36549e3fd99d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4181326c-881e-459f-8fa8-6fef2cf4f360", "sighting_of_ref": "indicator--9f146f9e-9d8c-4302-a1c0-1468c31ca402", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d5490bc-ddac-48bc-ac7c-5d62b0cd6fd3", "sighting_of_ref": "indicator--9f146f9e-9d8c-4302-a1c0-1468c31ca402", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--356f146d-d7ba-47a3-ae13-19ec9f344a79", "sighting_of_ref": "indicator--81cb73c9-38e6-41e9-abfb-6aab5d8d4a90", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf993700-6820-47ce-8233-00e378f1109c", "sighting_of_ref": "indicator--5cd67df4-0fec-4b71-bc05-dc237da290f8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b49d1946-908f-434f-bded-294c874ca24c", "sighting_of_ref": "indicator--6b8cb68a-2ac0-451a-95a4-b213cb1eaf6e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd508729-7dcc-40b6-899b-f1d707a2e738", "sighting_of_ref": "indicator--f3120e5e-c753-44a3-9fba-221d2ff2d9f5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c9540ba-db19-493f-b497-3a542172868e", "sighting_of_ref": "indicator--b974474e-1ab0-4d92-92b7-644559e19d33", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--547919a6-9c36-45e9-8f2b-24065e9fe329", "sighting_of_ref": "indicator--b974474e-1ab0-4d92-92b7-644559e19d33", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c62936e7-3424-4e2e-837c-ca183bcce2ee", "sighting_of_ref": "indicator--da2a1d2b-34f1-4c44-a52c-7dc03b25d59e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--674309db-0795-4963-89ba-9049bad7dfb1", "sighting_of_ref": "indicator--db352eaf-44b7-4eea-a98c-aa1cd79a701f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5040dfb3-eeb5-43e5-b44f-235ea36ece49", "sighting_of_ref": "indicator--e965db6e-206a-4d5c-bc16-f7a83c017d23", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1400f03f-796f-4ddb-817c-515f59626c50", "sighting_of_ref": "indicator--ff7e003b-28e3-48cc-b23f-0470d77aa9c5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b24e1d9-7a21-4c38-91a5-c3e48107f39b", "sighting_of_ref": "indicator--ff7e003b-28e3-48cc-b23f-0470d77aa9c5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9cda0a2-e265-4b1d-bad8-3ae2afb7cfdd", "sighting_of_ref": "indicator--8d2d05e3-32f9-4a56-9de4-9d352354ce18", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f1e9800-3979-46a3-95ea-cf113b5f806a", "sighting_of_ref": "indicator--8d2d05e3-32f9-4a56-9de4-9d352354ce18", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e31dcf3b-368c-40b4-8491-4a7ff1a16ef0", "sighting_of_ref": "indicator--56405129-73f4-4114-8064-2c77b6f2b71f", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0177fb4e-bede-4153-9ad3-930013764947", "sighting_of_ref": "indicator--26618470-e197-409b-a68f-a4b6d4d0bbac", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d374a05-4fd5-4e4b-9ff7-4e439941850f", "sighting_of_ref": "indicator--2ab24ace-2034-403c-a450-8cb776fdc7e4", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb5b5371-1f4e-443c-9054-f96ce0c58cee", "sighting_of_ref": "indicator--90dd7b05-f5fe-42bd-9fd4-fcc32ff23595", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79a0d582-8d84-43de-8c17-91ffbe066a55", "sighting_of_ref": "indicator--d26e3a40-04bb-4ddc-8936-0d920a93ab22", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e0bd0a4-8105-42d1-a41a-65aa97790ad7", "sighting_of_ref": "indicator--7eddcb15-665b-44d0-94a4-9348823f4dde", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd186571-66dc-4794-88aa-0e441bbd5720", "sighting_of_ref": "indicator--9384871a-bfad-4746-b79f-2fdbb6d4383a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11db4c67-5f5b-493f-a27d-93e84c27d3d9", "sighting_of_ref": "indicator--48926649-a131-486d-b774-1ddc4f5c3177", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94a936f0-4c69-4a3f-8d43-91347fdde5b4", "sighting_of_ref": "indicator--4387f899-8bab-4294-9948-6ebcbdc904e2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56c8f89b-74af-43c7-bd64-c9584f74a7ec", "sighting_of_ref": "indicator--d9295d5c-859d-4861-923c-2c3b43c74f29", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f63949d-693a-43e2-bfce-b4c5a8134c0c", "sighting_of_ref": "indicator--153dd6e3-9563-4913-b545-fcc66cb87213", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1705a74-0b6d-4207-a193-c3fdd6faae91", "sighting_of_ref": "indicator--153dd6e3-9563-4913-b545-fcc66cb87213", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c98a842-045d-4340-b7aa-ad4f8099ecf6", "sighting_of_ref": "indicator--a4884e03-a965-42b0-a1c7-c1e4b13b96b0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8200a92f-ccc2-43e4-9dc1-0fc1e1514dce", "sighting_of_ref": "indicator--89e368e3-0625-4bca-b77e-f7ec3e126e80", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--794883e9-6258-4e20-a283-b1976a94ca3f", "sighting_of_ref": "indicator--89e368e3-0625-4bca-b77e-f7ec3e126e80", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88db4eec-891d-415d-bee4-72c20d1fff8b", "sighting_of_ref": "indicator--33caf150-ed6f-436f-a1ac-0e38c5ad78d3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c4582f4-9aaf-4300-9d85-7ef7e6401fc3", "sighting_of_ref": "indicator--64d68435-94b1-40f7-9885-5c539481aab0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76cbf128-c68d-46e1-b7e4-b81863227fc1", "sighting_of_ref": "indicator--84491b1a-83ce-401b-95b8-cf12d8291afb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b899c1e-b9ba-4641-b5fb-6e89bf638ae5", "sighting_of_ref": "indicator--9d4b98c9-f63b-4c7f-b378-4a773d391791", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c4d7e41-e532-4f9f-94fc-6b5d6c9bde05", "sighting_of_ref": "indicator--ad3c9f3d-138b-46a8-9fd5-042123d04500", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--295e4943-deeb-4c20-a2c3-92087b4af2dc", "sighting_of_ref": "indicator--efc8a8cc-d787-4728-8c78-6db55dfc6d48", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5c01b2a-f152-45e8-9eef-b24b919de2e0", "sighting_of_ref": "indicator--efc8a8cc-d787-4728-8c78-6db55dfc6d48", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfbd739e-1bf0-4c4d-8824-96471a9e2886", "sighting_of_ref": "indicator--6d6ccbaf-d4de-4954-9fdd-0184874862a4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dbece85-65e0-4a5a-bde3-c01380f94734", "sighting_of_ref": "indicator--6d6ccbaf-d4de-4954-9fdd-0184874862a4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10e77baf-e75e-4f6f-a37b-120b6f6820c9", "sighting_of_ref": "indicator--a398bada-dc68-4a1d-8c14-f4f229809b34", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42e17ad5-f487-446f-bf46-08746a359eb2", "sighting_of_ref": "indicator--f2b1d218-39ef-41c5-b48f-6475c023daf2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aebe3ab4-3509-437d-bbab-1f51ec691270", "sighting_of_ref": "indicator--41278d85-348b-4f9b-aa88-f8330b068916", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4df3386-88f4-4a0e-b138-63803e2f5f4f", "sighting_of_ref": "indicator--41278d85-348b-4f9b-aa88-f8330b068916", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a5d233d-8f36-4a88-8b10-9109549eabbd", "sighting_of_ref": "indicator--4934087b-fc1f-4799-a3b3-bb8a4fcf71b3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e97ff16c-a004-4c0b-ab2e-eedaa7b3a34d", "sighting_of_ref": "indicator--4934087b-fc1f-4799-a3b3-bb8a4fcf71b3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3de22a41-d468-43c8-b705-44920b95e686", "sighting_of_ref": "indicator--66752c16-4208-4606-bc19-40f9f753761c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--565f7ca8-4840-46d1-8a3e-58ff06d5e0f6", "sighting_of_ref": "indicator--a82d7a01-53c1-4747-a107-82b10f07002d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31343f88-33ef-4eca-a644-e53dacf31e10", "sighting_of_ref": "indicator--8085bdd0-365a-4ddc-a0f7-c82cd242d496", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--152dd86e-7774-4a70-9652-e80cdc5cb255", "sighting_of_ref": "indicator--7a493a23-0db6-4a92-bf82-4c716782edf8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d33f1315-029d-4cff-bfeb-e778d016bfe4", "sighting_of_ref": "indicator--979c6800-e426-45e2-8dff-cbad798d00dd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15247052-632e-40d2-bc4c-301713a72ebf", "sighting_of_ref": "indicator--979c6800-e426-45e2-8dff-cbad798d00dd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6586d618-5efd-4a00-abfa-01a9733d8d91", "sighting_of_ref": "indicator--acd85935-6f6f-46af-978e-9ba4a0f2d55a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--894c2434-64af-48f0-a0c2-a6962f61f0c6", "sighting_of_ref": "indicator--99bdb915-3840-4dec-aa15-4fc0c1477866", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--257657f7-71a5-425f-8b03-b88ce2a30c11", "sighting_of_ref": "indicator--5453698c-8a3b-49bf-a108-8fb017bebe59", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e6a5d39-ba24-4d87-9197-dad945e31655", "sighting_of_ref": "indicator--39061e38-f0f5-4bc1-9787-f93cf5f65c33", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--519e3976-fb46-4216-b0a8-f331b3ba226d", "sighting_of_ref": "indicator--91d7f500-19ca-4057-8dd5-59619defa59e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9514252-848d-4f03-9abf-3dc81fa57ae0", "sighting_of_ref": "indicator--1125ac52-db00-4ebc-9d06-de044cf1d3df", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f19f7e8-8a0a-4947-aab2-63294fb3c4b8", "sighting_of_ref": "indicator--48bc039b-e817-45ea-9881-f09654b3ac91", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5b99090-b601-4e03-a322-cb92eec763a5", "sighting_of_ref": "indicator--30fd4535-cd85-45ee-a03a-178b68fe14e9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78f95253-e50b-409c-8b06-0b56e3ed4455", "sighting_of_ref": "indicator--61f5963c-d185-40ca-9dba-23b8eb69e942", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b6732a7-c9d2-4e5d-9012-2b54f41c7662", "sighting_of_ref": "indicator--61f5963c-d185-40ca-9dba-23b8eb69e942", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e835ed3-e9e5-4ded-9066-3b4353930af1", "sighting_of_ref": "indicator--65add945-9d54-4372-8e40-8d9ab0d46543", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4ebc420-09f2-418a-92f7-584736d56be1", "sighting_of_ref": "indicator--65add945-9d54-4372-8e40-8d9ab0d46543", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7207d14-c5e8-4d82-9086-e659784f3de6", "sighting_of_ref": "indicator--26a52279-fae2-42b4-8b12-b6ebc60c29ef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a462695-770a-4a68-8e0f-c7308258d6b8", "sighting_of_ref": "indicator--26a52279-fae2-42b4-8b12-b6ebc60c29ef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82950595-119e-4d03-84fd-428774d721f6", "sighting_of_ref": "indicator--60c31ce8-d955-429d-8577-dfe4cbd7412a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c9f610f-dff3-4959-8e74-a0c909ada412", "sighting_of_ref": "indicator--563da8ea-d892-44da-b6cd-dad2ba56bb35", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--707d8901-3306-4be0-b669-4b2ea0e09718", "sighting_of_ref": "indicator--98b5fb2b-817e-426d-b171-8604ef33407a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a10a8474-5ef5-4649-bb73-23a4903cb725", "sighting_of_ref": "indicator--c2ae0c09-e5b5-47f2-97ee-4c9f67650710", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad748022-90d3-4f1c-bb0a-790216d0edea", "sighting_of_ref": "indicator--81ac3f67-1b47-4ef2-b86a-559c4e334940", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a463045b-bc51-4d63-acb3-cb2af6322743", "sighting_of_ref": "indicator--81ac3f67-1b47-4ef2-b86a-559c4e334940", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72c49a3d-5458-48a8-8bd1-5dfebbe15619", "sighting_of_ref": "indicator--e6ca267a-0e3a-4755-81f5-955f1e3fb884", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2663e5ec-9a7f-46b9-a02e-a01155132bdc", "sighting_of_ref": "indicator--6c7598c9-bb7f-451c-a000-78ba3550a505", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75b4b3fb-426e-470d-a0e8-ccfcc423bdc9", "sighting_of_ref": "indicator--9d1e80e5-7a87-46e7-8516-9fad171371f5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e39d31e9-5610-44a9-af3c-700027f44807", "sighting_of_ref": "indicator--9d1e80e5-7a87-46e7-8516-9fad171371f5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cbae427-acce-4fc7-9b02-12a01ccdbe14", "sighting_of_ref": "indicator--be76b750-c40e-4ccc-9df2-0acb14233965", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2ac4453-d5a9-406b-9ddd-83b61bfd9099", "sighting_of_ref": "indicator--caf1b5ab-9147-4e72-a534-cb61b17f549b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--339188d8-ccf6-4491-8aa0-6265c19a4bc3", "sighting_of_ref": "indicator--783f1a28-a028-48de-8e00-27c55e1eff7f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2b9ec01-3bc1-409d-b679-84ef88993272", "sighting_of_ref": "indicator--f76c722e-e51d-4d10-bc09-911033fcab2d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c7a8e4f-8e32-4cd9-892b-1a2d56c31795", "sighting_of_ref": "indicator--8d926516-d6fa-4544-8729-92db2f43e55a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca98a56a-1e60-44e0-9862-82dc5338ccb5", "sighting_of_ref": "indicator--10aada7a-9e75-457e-864b-d2eef88955da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48e1a6fb-87c8-4c0b-82ed-4a5098441f44", "sighting_of_ref": "indicator--10aada7a-9e75-457e-864b-d2eef88955da", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2aa7238-991c-4615-932e-ab7ff049d9a1", "sighting_of_ref": "indicator--f63a733a-14a5-4546-aed8-89147746d86e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c3db138-406e-4ac4-9a72-6e6c7e29bfd6", "sighting_of_ref": "indicator--67b42611-e6eb-4b5d-a9b9-7feb7cdcccff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe002d49-2407-4185-a465-00980662a6a7", "sighting_of_ref": "indicator--67b42611-e6eb-4b5d-a9b9-7feb7cdcccff", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78d0c372-a5be-434d-9b08-8c048bcb2e1a", "sighting_of_ref": "indicator--7ddd0f25-39dc-4e99-a710-0dc80713dcaa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c29f0c3-e0b4-4d39-9074-1fa50f137a36", "sighting_of_ref": "indicator--7ddd0f25-39dc-4e99-a710-0dc80713dcaa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ad800da-5656-49f6-8f6e-d0a7ea2fc807", "sighting_of_ref": "indicator--de34f907-661e-44d1-a37d-75d3a80c8eb3", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--238a077b-2db1-4618-9ab2-9dc5f6b87959", "sighting_of_ref": "indicator--de34f907-661e-44d1-a37d-75d3a80c8eb3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a4ea3e3-9091-4fd8-a11e-35d47dd7d7d4", "sighting_of_ref": "indicator--d6942ec4-611d-47e0-b973-bdd134b4c3ff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c154db6-4643-4327-908b-2cddec0f73b7", "sighting_of_ref": "indicator--d6942ec4-611d-47e0-b973-bdd134b4c3ff", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--422accc0-51f6-4b68-98fc-817fe9a1a246", "sighting_of_ref": "indicator--f8b8ee48-4a5a-47d2-b987-d7a5d5fc2c5b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1511237b-6a02-49a9-bb4f-5eeb7b1ed992", "sighting_of_ref": "indicator--2d95027e-34e8-4fb1-b3b1-16f1960b00be", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13fd5f36-57ab-422a-8036-e7216b448881", "sighting_of_ref": "indicator--2d95027e-34e8-4fb1-b3b1-16f1960b00be", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2bb0ca7-30c6-410f-855c-8d4d30a280aa", "sighting_of_ref": "indicator--901ae743-8113-4dc5-80b4-fb7a4716d81f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea990ca0-9310-4319-b4c2-f9444ef59a13", "sighting_of_ref": "indicator--901ae743-8113-4dc5-80b4-fb7a4716d81f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc430664-d767-48d5-9c36-d293cb618bd5", "sighting_of_ref": "indicator--fd77bf25-6195-4647-b198-33850d451cb2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c19675e1-2abb-43c0-8fdd-2ab8f9c20363", "sighting_of_ref": "indicator--fd77bf25-6195-4647-b198-33850d451cb2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84ca42ab-d615-44e6-94ba-ef01657ed3f2", "sighting_of_ref": "indicator--e62001b7-3345-4368-a212-67882176e99c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9cce9bf-cfbf-485b-a027-dfba238186f8", "sighting_of_ref": "indicator--e62001b7-3345-4368-a212-67882176e99c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c53b7305-8193-403b-b72a-cf2932ec73b0", "sighting_of_ref": "indicator--8e1f79bd-4c6a-4344-bc56-28eebeab7378", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--070e396e-fe95-42bf-84f3-1e37216f4859", "sighting_of_ref": "indicator--8e1f79bd-4c6a-4344-bc56-28eebeab7378", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--769560c2-8450-4ee9-9384-ffc8fa8c9aa1", "sighting_of_ref": "indicator--486dc322-b107-49e0-aab2-2b8eb487776e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad3bb274-d721-4511-8677-67534da9d086", "sighting_of_ref": "indicator--486dc322-b107-49e0-aab2-2b8eb487776e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65d1a702-3fd5-436c-b161-dcc21b260765", "sighting_of_ref": "indicator--da5d2ce5-a1bc-45d4-8b44-d4c3d15565a7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d70b30ee-72c1-463e-b754-3b7e42be8818", "sighting_of_ref": "indicator--b5a9e65e-b012-4e5a-a09b-567a08ea0b80", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53b41c5a-d8d1-43aa-8926-66f17095fe98", "sighting_of_ref": "indicator--7df0722a-46da-45f9-aea4-65e17261c742", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da0274bd-d9a6-4acd-81dd-db586c186310", "sighting_of_ref": "indicator--fe71592d-a386-4142-89c9-f9b2a8851e12", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--738754f1-7369-4591-95ed-65cc4263ef2b", "sighting_of_ref": "indicator--fe71592d-a386-4142-89c9-f9b2a8851e12", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--048351ff-dca7-43e9-8181-20ffa9163ffb", "sighting_of_ref": "indicator--2405dba6-ecd2-431d-933d-3e58e39c2ea2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0e244b2-e419-4383-b8fc-88c50dd653b7", "sighting_of_ref": "indicator--2405dba6-ecd2-431d-933d-3e58e39c2ea2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--420eab23-0386-4f26-8e98-460751b23fc7", "sighting_of_ref": "indicator--320a2d4f-fd73-43a5-80f0-c196af59c019", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--603586f4-5f6e-4b82-9f31-664ce8e79aae", "sighting_of_ref": "indicator--be891f98-442a-4e4b-9c1f-284d0820bc12", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9f60e00-1e46-4054-ae8b-0c482f9a1598", "sighting_of_ref": "indicator--969b9405-39ed-4d8b-a869-ed59d0f5ba23", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--428bcdf9-552e-4b25-90a3-957d2c6bfcf4", "sighting_of_ref": "indicator--969b9405-39ed-4d8b-a869-ed59d0f5ba23", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--835db29b-c76c-4434-9e39-ac29c3ace022", "sighting_of_ref": "indicator--2b5e4256-61a4-4bb2-819a-842d1670e4be", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82394113-f50a-4647-8d41-2a59fad4f1e5", "sighting_of_ref": "indicator--23d2ad22-a425-4499-8a3c-839e88c04249", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dabbdd8-499c-4a4a-812a-d66016cb2e86", "sighting_of_ref": "indicator--23764e34-7b56-4d3c-a457-ff0c7842d0c6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57f7345d-6f03-4856-ae6e-07e7db4689c5", "sighting_of_ref": "indicator--214bee49-39b8-4bf8-8ac0-1125a69294cf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dabc765-9076-4cc7-ae08-0d188e4bb5c9", "sighting_of_ref": "indicator--b8472814-f60b-481b-8d98-992c62df5115", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0bc61c1-1474-4517-87c0-3e271d61b7b4", "sighting_of_ref": "indicator--e20fcc95-44a9-42b8-8c4a-9f2dd4f335b4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9009799c-0397-456b-a79a-ec979bdda2e7", "sighting_of_ref": "indicator--e20fcc95-44a9-42b8-8c4a-9f2dd4f335b4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--762beacf-582b-4893-b4a3-40ca28c9483d", "sighting_of_ref": "indicator--d3c1c8ac-9326-45a4-870b-bb275b6c3426", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21dde9e4-454d-400a-b98a-35101fb8697b", "sighting_of_ref": "indicator--d3c1c8ac-9326-45a4-870b-bb275b6c3426", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fdc10d8-907f-4474-9670-0d1c4f5ead6b", "sighting_of_ref": "indicator--bedf941e-b1c4-4cec-a7b6-f7d4807185a3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3b5bf01-2c48-4e76-92e5-49826314151c", "sighting_of_ref": "indicator--bedf941e-b1c4-4cec-a7b6-f7d4807185a3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e7def59-2113-4cfa-9fc6-a749d8e08fc7", "sighting_of_ref": "indicator--7a5fb71d-82c7-4b52-a00a-bb42d31f5977", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf8a683c-8ab7-4efa-ad54-75e939f955fe", "sighting_of_ref": "indicator--fde46749-4afb-4efb-9372-01ebe1940796", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b18ea51f-4d07-4da4-bc88-228d881f7e00", "sighting_of_ref": "indicator--2b479b6e-a405-4e22-9707-4f16e571de02", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04d71869-b25a-41a8-96fc-6abc9ae47683", "sighting_of_ref": "indicator--2b479b6e-a405-4e22-9707-4f16e571de02", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c631c9a2-6136-47ba-af4b-45eda716d739", "sighting_of_ref": "indicator--86ca217c-fb3b-48d0-8859-8b96d76f61da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c83a3daa-a432-46a4-aad9-c54b0bc29006", "sighting_of_ref": "indicator--86ca217c-fb3b-48d0-8859-8b96d76f61da", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57881da4-58f8-4f2d-9d94-b274eef2dacc", "sighting_of_ref": "indicator--b7a9f3aa-a5c2-4216-9704-b60310a72ed7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--534b40fd-8b9f-4883-a274-466deea0c9ab", "sighting_of_ref": "indicator--da9d159a-8660-4793-820d-e039054a313d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53c903f1-26ec-495a-9411-3ca74f12be41", "sighting_of_ref": "indicator--fb4431cd-e805-4ca7-abac-28c0acb41b9b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6beac0d7-d7c1-4d71-b113-181cec729e0b", "sighting_of_ref": "indicator--fb4431cd-e805-4ca7-abac-28c0acb41b9b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71e92169-9a45-42f3-a19c-31004d0a38b5", "sighting_of_ref": "indicator--0e4f7270-8f2e-4aa5-b4cd-af594702bbf1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6b3f1c8-cbc6-4b18-a9b3-172a0795d7f0", "sighting_of_ref": "indicator--e43373b3-c24b-4915-bffb-20597c97202b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fee1d406-f7b3-41cd-b595-3ae6967f565c", "sighting_of_ref": "indicator--a9239eab-d2b4-44d1-b8a8-fbb62a8da2e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87f0ba43-e8a9-4ad9-8613-3bf8c8180d66", "sighting_of_ref": "indicator--a9239eab-d2b4-44d1-b8a8-fbb62a8da2e1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd4a5769-1109-406d-9d69-e2bbc8423905", "sighting_of_ref": "indicator--d871ca06-8e32-40f6-913a-3af4814a6393", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f13e2f89-461e-49d0-aebe-1a3976390f63", "sighting_of_ref": "indicator--a75f13ac-62ca-4cc7-8240-9eab3f547b6f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a4370c7-e22b-4c43-bd95-e849ded1bce9", "sighting_of_ref": "indicator--5f5b0d66-95c8-40bd-8717-2c628849f800", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2ca3d71-ef1d-4bcb-84fe-d10203368d8f", "sighting_of_ref": "indicator--5f5b0d66-95c8-40bd-8717-2c628849f800", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e9cace1-c4ad-4b0d-882f-196ef081637f", "sighting_of_ref": "indicator--434e710e-938a-4e6d-b7a8-943d83d50718", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9318de9-acc7-4ec9-a307-1779674e692b", "sighting_of_ref": "indicator--dfb30dc6-2736-4cc6-b0bb-df3ae3c9ff5e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdfc439a-73cb-4dd3-bfc2-f7b3b31b9d01", "sighting_of_ref": "indicator--3b43ddfc-2e0d-4da6-978a-8ae106f79113", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8e278c6-ac6d-4944-a068-d5369792febb", "sighting_of_ref": "indicator--4088da08-2ecb-43aa-a3ba-60f2c3664f59", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5aa1a2d3-428d-43ca-a776-dd89d03e1f1e", "sighting_of_ref": "indicator--5ff6ba25-0a25-4791-b0c4-7001d18e938b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--052f20c7-916c-420c-bd69-639892916e18", "sighting_of_ref": "indicator--e389cbb7-2951-403a-b7fc-7db75b86bea4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb4c6f1d-17e1-4d75-8bfd-d3baa16e5194", "sighting_of_ref": "indicator--65f618b7-e710-4be6-a487-067a257da543", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09c80412-9d5d-4c36-a5eb-34a396497936", "sighting_of_ref": "indicator--b22eaf5b-5e3d-4bc4-b871-ef1e6f2d8763", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09b182ce-e806-49ab-aeb9-ae148016cbd1", "sighting_of_ref": "indicator--b22eaf5b-5e3d-4bc4-b871-ef1e6f2d8763", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b15b1cb9-90eb-4627-802f-185dc0a45b85", "sighting_of_ref": "indicator--2b4ea3f6-ec51-46be-9d7b-968265c9e31a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0fc79d2-9b1a-47b3-bf6a-5831cff112f3", "sighting_of_ref": "indicator--39d129cf-51ba-4ad4-8227-3e4e4eca4f4a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8637403-a555-4b5e-94dd-6aefd29f0f78", "sighting_of_ref": "indicator--d0696088-bf11-43e8-b6cf-b69c6e60fb5a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--320a65c6-886c-4c99-a9dc-dee604694f6a", "sighting_of_ref": "indicator--719f3727-ea34-4cd4-bd61-a22540882a06", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac0f08b2-e6fd-4205-8bc4-81d5169c2dbe", "sighting_of_ref": "indicator--719f3727-ea34-4cd4-bd61-a22540882a06", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b34f87a-833d-4f35-acbc-8d8da6707f46", "sighting_of_ref": "indicator--ea45979e-103f-42c9-a04a-4579b2f6c62d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3718a021-f6f2-4e32-9419-b30818411e67", "sighting_of_ref": "indicator--ea45979e-103f-42c9-a04a-4579b2f6c62d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6fd2c60-fb2f-4f94-9ef6-02c8deca2897", "sighting_of_ref": "indicator--fbe5a72b-b2ed-4a20-8060-f1da6b9bf572", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--928a5e78-7841-497d-8868-98a959c0b590", "sighting_of_ref": "indicator--fbe5a72b-b2ed-4a20-8060-f1da6b9bf572", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea31b237-71f7-421c-9b60-e46dbd15f907", "sighting_of_ref": "indicator--39fdc319-a472-45b6-859c-af24f3490b0f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e13cf3df-2f18-4858-8882-233dee3df806", "sighting_of_ref": "indicator--39fdc319-a472-45b6-859c-af24f3490b0f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0852b74-fb84-43de-a405-59ba1adb5815", "sighting_of_ref": "indicator--211fa6d2-8bb0-4237-b9bf-6844bd93ed5c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8793dd51-43b7-45b6-9358-bf64cff92963", "sighting_of_ref": "indicator--430ca9eb-bcd9-4bda-aad4-624da5f6d6a7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0c7d735-3573-4ffe-9401-f7e5f903fbac", "sighting_of_ref": "indicator--27857ec4-f3b8-49d5-8926-0b4aa48b1ee4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96606ce2-b98f-47af-80f5-0df1bba5ec9f", "sighting_of_ref": "indicator--53bbe818-1595-46a5-bff7-5589af1cc63b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a78a778c-f133-441d-8ca7-3c3e4c22b633", "sighting_of_ref": "indicator--9b5951f2-bb15-49eb-b75b-f25ca1c2c00d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66358ec4-9589-42e0-81fe-058b82d27361", "sighting_of_ref": "indicator--bcae7e2e-6e1d-4ba0-8958-76517a03bce9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35aeee2b-5392-40da-a6e6-ea3093b3d7c9", "sighting_of_ref": "indicator--77ad31d1-0dd8-475d-88a5-a2bb03d81eca", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--167f4f52-a882-4425-8527-bf4989656a41", "sighting_of_ref": "indicator--77ad31d1-0dd8-475d-88a5-a2bb03d81eca", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16d8dcad-dbb7-46c2-8888-aba75b85d5d5", "sighting_of_ref": "indicator--6f0fd4a8-380b-4f7c-9b4e-6915d3b62135", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12bf6363-f4cb-4aa5-af74-d4af22415533", "sighting_of_ref": "indicator--9a81591d-f3bd-4953-a90e-1babeddd8f75", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da5e35b6-3256-425f-80d7-91d351b6a1db", "sighting_of_ref": "indicator--84dffcde-c16a-469c-b8b2-683da2fa4962", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3617dfc8-c2d6-498d-9562-af7e342f3f18", "sighting_of_ref": "indicator--275d5fac-db2a-43a6-99e1-0e0805a12c51", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c5e4e0b-2e89-4619-af46-a2fe109885a6", "sighting_of_ref": "indicator--e968dbb5-5367-4133-be2e-38ee02fea70b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b3febd7-a70f-400f-b446-91f66b0f2386", "sighting_of_ref": "indicator--e968dbb5-5367-4133-be2e-38ee02fea70b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ec87ced-7afa-4f87-a24d-a3d04db9659f", "sighting_of_ref": "indicator--a6d5073d-9457-402e-a6af-6ad1fae7586b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90b4e697-a364-4899-858e-f441008b9c6c", "sighting_of_ref": "indicator--a6d5073d-9457-402e-a6af-6ad1fae7586b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccc9065e-8a98-4a1b-b4f8-9507859f9737", "sighting_of_ref": "indicator--22998ba7-f4e8-409d-947b-e86ec57aaca6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46624ec6-65cc-4c4f-bf64-65f8246c4a99", "sighting_of_ref": "indicator--fa4878cc-4b55-4e7a-bef0-69a541e55142", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--519e3ce7-196b-4911-b409-90ce2503da8a", "sighting_of_ref": "indicator--fa4878cc-4b55-4e7a-bef0-69a541e55142", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3c64534-9dc9-4ccc-bd8e-05aa65da53f2", "sighting_of_ref": "indicator--c4274d7b-9a3f-44ef-9163-04a2abb503d6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd51dcd6-ad34-4364-878a-0323b0b28aa8", "sighting_of_ref": "indicator--53a28c29-6f44-4d2c-a1ee-f1a4d45a7891", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2553b3a4-4612-4572-b71e-45254e249b99", "sighting_of_ref": "indicator--53a28c29-6f44-4d2c-a1ee-f1a4d45a7891", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a36f5f62-b6da-4bb0-a5e1-8e3161d0caba", "sighting_of_ref": "indicator--cc1a2177-02ae-4c74-b486-f7b83c842a57", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc3f1fad-8903-41f5-92ec-d1a86764e90b", "sighting_of_ref": "indicator--cc1a2177-02ae-4c74-b486-f7b83c842a57", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6d7baef-d688-4d58-89c0-f41fed4dec2b", "sighting_of_ref": "indicator--23fbd2d4-3944-4e39-a52b-7dc0be8fa2c2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dfcd7b7-5968-4484-9fdf-60330505f2e5", "sighting_of_ref": "indicator--874bf4b0-05ed-470a-81af-2f0b28ed38d2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7016546e-db56-4310-9c45-0d9ced50b53b", "sighting_of_ref": "indicator--5028b0e5-5af2-4ff2-bb87-a58349b8cbb2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5750d35-f942-436a-b410-c84dc5d3c2af", "sighting_of_ref": "indicator--8513c2f5-47eb-4a81-92a6-0ad5a5a30898", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5869629d-743f-4a56-a3af-bd10b51d6dc3", "sighting_of_ref": "indicator--8513c2f5-47eb-4a81-92a6-0ad5a5a30898", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74b375dc-766b-460b-80c3-ed69b43c13d7", "sighting_of_ref": "indicator--8ca90669-9109-4de1-8b8b-0a90d438102c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93dd1606-095e-4541-a57b-535b95ec18d9", "sighting_of_ref": "indicator--bf7e13ae-3608-4ceb-9c3c-c5c54c0bbedd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b5a6e45-f32d-467f-8e73-a7889bc8188a", "sighting_of_ref": "indicator--946f16b0-9ba5-4430-819a-0dda8a1eb271", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6507b804-37da-4ec5-9415-3bba3c29b68d", "sighting_of_ref": "indicator--946f16b0-9ba5-4430-819a-0dda8a1eb271", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--586f5107-9412-4e13-8856-1c368c08bec6", "sighting_of_ref": "indicator--f69b6451-6796-45b2-b517-cb40b0582065", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8f95a36-b229-47d4-a026-3edaac780a9e", "sighting_of_ref": "indicator--f69b6451-6796-45b2-b517-cb40b0582065", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e970d47-d6d6-4643-831b-e6b4a9d1e1ac", "sighting_of_ref": "indicator--5055f519-3a1d-42fc-bdc9-1e6dbda9a4cb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--223d7e4c-e97c-4b00-87c9-d8cc9131b064", "sighting_of_ref": "indicator--bacf999a-e039-4f04-9f26-80fa475c17e4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8516bd29-3ff2-4830-86ba-f2f82fb59e50", "sighting_of_ref": "indicator--1e1800e2-d12a-42a4-a203-d0e54c6f8373", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--021948e3-36d6-4042-afc3-04fc632374b7", "sighting_of_ref": "indicator--c0a084b8-3097-45d5-b7b8-13b230261263", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e1ab391-7d5b-4c97-b7f8-346869eb9cd8", "sighting_of_ref": "indicator--f2634918-a2bf-4e70-8ce7-5162fe0b646d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3217722-c090-440a-a085-f397ec2f3de1", "sighting_of_ref": "indicator--5beb1088-bcd0-49aa-968d-997760f08b9b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39f840e6-e4b9-4764-bd30-887d875b1785", "sighting_of_ref": "indicator--a6c5a5ab-e1b5-4dfd-94a6-252ba0157336", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--338ecffd-e275-401c-869e-d6cd744c2c23", "sighting_of_ref": "indicator--09f8db26-1fc6-4fcb-9ec8-4fb4c465ca43", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ee69c06-e52d-49c3-b4bf-16d23b7336fd", "sighting_of_ref": "indicator--2d1bd5c6-e613-43ff-8455-ac497e4b6579", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebd8f996-f1b5-4073-ba19-eb656cf2f409", "sighting_of_ref": "indicator--2d1bd5c6-e613-43ff-8455-ac497e4b6579", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f20d6da6-e996-49ff-b7eb-608fe832bf67", "sighting_of_ref": "indicator--b6c8abd5-2bf2-40cc-a6ed-2e0788df4551", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b76a2fb-433e-48af-8337-2c4899896fe5", "sighting_of_ref": "indicator--20ed9ec6-d765-448c-b6e1-339f8657b6dd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d0f4a0b-a60b-4f49-a9d1-afd6db9e7384", "sighting_of_ref": "indicator--a0ba9f47-771a-47c9-96ef-846fde55741f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a97abc7a-79cd-4ba8-90f0-233be06c1184", "sighting_of_ref": "indicator--a0ba9f47-771a-47c9-96ef-846fde55741f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8b7a515-1d9b-4fe3-946c-6a40c7161d7e", "sighting_of_ref": "indicator--d7777c64-99c2-48b3-af21-3d0c3d57c41e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30ea49d6-bd32-4b2e-a450-dddf5632391c", "sighting_of_ref": "indicator--2592a093-6e34-4daa-8f68-83bde43c02e7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2977648d-96c0-4560-9eb7-255ea7216d8f", "sighting_of_ref": "indicator--2592a093-6e34-4daa-8f68-83bde43c02e7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdd08cb3-59cb-4333-b13f-19343a7e812b", "sighting_of_ref": "indicator--2f83c580-c23e-474f-be2c-56cf4f59a1d0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--883a40f3-7840-42ad-bb12-3150d60bce7d", "sighting_of_ref": "indicator--5afb3be2-ed5a-4560-8de0-573b11cee149", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cd348ea-d4dd-45be-8fed-0419021423c8", "sighting_of_ref": "indicator--d8ad44dc-940b-4be5-8bb1-43e8f147d6a2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cee79d87-a063-4e13-ac88-bcf886b67e7c", "sighting_of_ref": "indicator--863153bd-36ea-4b15-9882-21aeb9440df9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4555628-283f-4c2b-90c6-ee1b5d060ac9", "sighting_of_ref": "indicator--dbccaf0a-d97f-4cf9-9046-5a26cfe945eb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d048a863-095f-4436-b75d-1d8ca6fa430d", "sighting_of_ref": "indicator--dbccaf0a-d97f-4cf9-9046-5a26cfe945eb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--930207e2-3fdf-47cb-987f-0b6dcd1b3243", "sighting_of_ref": "indicator--85999562-0050-4ae8-ae9f-ea652d780574", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d69915ab-3d6e-4a32-a722-336017739a22", "sighting_of_ref": "indicator--63b2b112-8d76-404c-8ebf-e75d83770c62", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a4133b2-a912-44c6-99c3-9c733c7cead8", "sighting_of_ref": "indicator--e47b3048-3bb2-4cf2-9137-e4a9b42b6c85", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37dc3cd7-6b53-47be-8364-8c0ae468cfb0", "sighting_of_ref": "indicator--e47b3048-3bb2-4cf2-9137-e4a9b42b6c85", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f27fb035-a2a8-4afb-b651-dd6899a78973", "sighting_of_ref": "indicator--4a163790-f34e-443c-b5f8-d705d2e87bab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cf02bc7-fa83-442a-a0ac-13b614806a3b", "sighting_of_ref": "indicator--c58130e8-4dc2-4e12-bfea-0a86795a4b09", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45fa1137-6b65-4fbf-b6c5-2becf2eec5a8", "sighting_of_ref": "indicator--c58130e8-4dc2-4e12-bfea-0a86795a4b09", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28752039-a253-4fd3-889a-7234a9dac68e", "sighting_of_ref": "indicator--02e80861-cbd8-4d91-9083-bb6f00165565", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f22f7fd9-31b8-4006-92c8-18e144e0c8d8", "sighting_of_ref": "indicator--02e80861-cbd8-4d91-9083-bb6f00165565", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07b19c6a-0799-49ab-b6ca-62f9cfbabceb", "sighting_of_ref": "indicator--27317ca5-fb9d-4ac7-8f25-526472f48622", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8b2c1d4-ab45-4cf2-ae62-55e38df83c6b", "sighting_of_ref": "indicator--702eb558-542f-4784-949f-464dc409721d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--877e3d1f-1972-49e5-9a72-d8f5d506b3c0", "sighting_of_ref": "indicator--d1e74221-2959-49f7-867a-18c7ff894c7d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ad30058-97c9-4a56-aa9c-9e5a300f8911", "sighting_of_ref": "indicator--d1e74221-2959-49f7-867a-18c7ff894c7d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a56cf88d-6a0f-4f3d-a62b-5e641b6805af", "sighting_of_ref": "indicator--f386073b-65a1-4b07-9805-3fc9e50f1ce9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a446f332-ed4d-45fa-9f9a-12a849be23eb", "sighting_of_ref": "indicator--f386073b-65a1-4b07-9805-3fc9e50f1ce9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--195cd498-2642-47ee-8cfe-4aff50061417", "sighting_of_ref": "indicator--e7bde680-2a05-44b7-96e3-7a100eca159d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd992947-7f4c-4818-8742-bdd117b7e060", "sighting_of_ref": "indicator--36db638c-438f-4183-87bc-967346413784", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--549cdd49-e9cb-4084-8b70-1667043779e7", "sighting_of_ref": "indicator--7ba81413-d53f-4613-b37a-b58bb0e02b60", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3913696e-72e5-4abf-afa5-b179eaea1c70", "sighting_of_ref": "indicator--7ba81413-d53f-4613-b37a-b58bb0e02b60", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd5061a8-7511-434c-9d1b-35155523ee06", "sighting_of_ref": "indicator--51dac38c-09af-4c70-b67b-81bda1ec68cf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d285b346-998d-46e1-b826-aa4e4fd502ed", "sighting_of_ref": "indicator--33e9de8f-e489-4252-b126-7910d4304310", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b997b985-467c-4510-adab-476e20006b07", "sighting_of_ref": "indicator--3b9dea29-808a-49de-8e38-ce9b154e926d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--974978c5-5e77-4879-b545-fe41cd128acb", "sighting_of_ref": "indicator--69ff5a60-d291-4184-a780-19e8efff40b6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebacc519-9ed6-46fc-95e7-ae85eaca266c", "sighting_of_ref": "indicator--c692d34d-b35d-4ef4-a0e4-173f153eca4c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aece25bb-4f79-4dc1-877e-b0c59093d3e4", "sighting_of_ref": "indicator--c692d34d-b35d-4ef4-a0e4-173f153eca4c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--489c4974-7c47-4d9f-b787-26858c5d7561", "sighting_of_ref": "indicator--5e6b3d7e-3196-4890-ab89-88cc95782676", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b490a60-e7a0-4635-9018-3f5f63cfaced", "sighting_of_ref": "indicator--5e6b3d7e-3196-4890-ab89-88cc95782676", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81ae18ce-4f0f-40cb-bc85-1497d69ac48b", "sighting_of_ref": "indicator--0fbbb477-a6ad-4716-8326-7adc22e1985e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e4c11c4-59ff-4605-ba52-b9dc3aae621b", "sighting_of_ref": "indicator--f70767c4-b6d3-4199-b010-8643baf4086d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f54d882-fda7-48e6-8495-6961426f53b9", "sighting_of_ref": "indicator--d9089706-5b44-4252-8d5a-d7cccd043963", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb40c5e4-9601-45a9-b7ff-33b1ee4cd16a", "sighting_of_ref": "indicator--d9089706-5b44-4252-8d5a-d7cccd043963", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--929b2dfc-da0f-420f-931c-591ef51946f0", "sighting_of_ref": "indicator--073a2edb-171e-46f2-a585-3fab5f5ac6fc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ae6ea63-6746-40cf-989d-3d9e4456c4c7", "sighting_of_ref": "indicator--30dfec1c-e89d-42b6-8ec4-85ab5661b3da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ae8eb1c-4669-435c-85b2-e0c94550feb1", "sighting_of_ref": "indicator--30dfec1c-e89d-42b6-8ec4-85ab5661b3da", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66c08e59-5417-4f5e-9d2e-f4005d68c967", "sighting_of_ref": "indicator--1c4f5461-bde0-47a8-8c97-5837cd175f50", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f9bc080-d2f1-4b80-84a8-6aef07b0e77c", "sighting_of_ref": "indicator--36ad797d-116f-47b7-b889-7d3e66e48d16", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--950aca12-9612-4ce8-8f67-e8ac5a22a2ee", "sighting_of_ref": "indicator--36ad797d-116f-47b7-b889-7d3e66e48d16", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8b3f1a5-298a-4f80-9f21-ab1cb544dbf4", "sighting_of_ref": "indicator--b4ea29b0-dae4-4c73-816c-052ff4c2f963", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca574006-9429-4f85-a1b9-6c41f7184ca8", "sighting_of_ref": "indicator--8075fc23-3d56-4e55-84a7-5c4ed0974052", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83a51e2a-a644-4cee-b262-535f613591e4", "sighting_of_ref": "indicator--090ce52d-02cf-41bf-85e8-83ce087c4b6b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90d3ea70-0efa-41de-b50c-61ccf7639d34", "sighting_of_ref": "indicator--2bcaa115-61f8-4827-9925-e23be3f112c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d887c185-4b4c-4b4e-829f-907dd46d7ba0", "sighting_of_ref": "indicator--318f2fcb-1e4f-409e-8644-9b43f4b3a7e8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f33ed0b0-a09b-4c5d-b5d1-03b787a4b4da", "sighting_of_ref": "indicator--318f2fcb-1e4f-409e-8644-9b43f4b3a7e8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--959fa14b-ef1f-4874-9bfb-96f4b94987ac", "sighting_of_ref": "indicator--c331f7a3-7125-489e-a0ae-a17fc628db05", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d64c1358-7de5-4f13-90aa-ded8f6ba5982", "sighting_of_ref": "indicator--1ad3b648-3d20-46e1-9035-297c3b7fcb05", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2db913f4-bb0b-424e-bdd8-5b5a613dce96", "sighting_of_ref": "indicator--12c1582d-61f9-4db2-a8c4-e7df59aa77c9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9dd6b4b-58e1-43b6-b182-fe0474edd6ed", "sighting_of_ref": "indicator--df22e13c-96cb-4af0-bd8f-1bafa3c53d73", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90d271ef-4a25-4f9b-a444-df436c85ffce", "sighting_of_ref": "indicator--df22e13c-96cb-4af0-bd8f-1bafa3c53d73", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a171906-cd92-4348-a934-ffc56aaede68", "sighting_of_ref": "indicator--0de1295d-8199-4f61-92c3-f41dd4a9c964", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23776de7-a570-4bd2-a9cb-60c038ca1daf", "sighting_of_ref": "indicator--7213d71b-b744-4879-9e33-90caaa17926c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ce3aa6d-e994-4f1f-9b84-09ce7f55240e", "sighting_of_ref": "indicator--662e8d15-6e0c-4f08-9c93-208a527a5647", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a1a2bf7-bb95-485b-8b86-a8dba022ee72", "sighting_of_ref": "indicator--662e8d15-6e0c-4f08-9c93-208a527a5647", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--055e40ba-3155-4d83-9a5a-8f3aa73ca921", "sighting_of_ref": "indicator--9717a8ba-21e9-4345-8c9b-f883a528384f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae909c93-c659-4ef3-a206-15a0de8d868f", "sighting_of_ref": "indicator--e68d3b02-01ac-48d9-a09e-ffc97fd8c582", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6a2d7ac-bbac-4cd2-816f-896d5792d655", "sighting_of_ref": "indicator--fa54fdda-969c-45b9-8ae8-3b6fc36fded7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b18fc45-7db6-4b6f-939f-740ffecb7740", "sighting_of_ref": "indicator--fb4f0fb1-2fde-4a6a-9686-59a556388a29", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09dac08a-e0da-4f2d-a332-146f38e63816", "sighting_of_ref": "indicator--90487f0c-29c8-4b8d-ab2c-56a64fe6eda3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34291faf-88f5-4db6-bc88-1ef2f63364b3", "sighting_of_ref": "indicator--8cb3f324-1b28-4189-bc37-eb17306ca4cd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0730d9d-cfe4-4fb8-a827-75e6d3ee9f50", "sighting_of_ref": "indicator--8cb3f324-1b28-4189-bc37-eb17306ca4cd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--708a66ac-0f06-4fe9-9c38-681f76d8f2b4", "sighting_of_ref": "indicator--94df2c6e-b95b-4c3e-ba51-9bfc982ea1f5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ebd3c75-b3f9-4f23-aee9-e751b6ef4283", "sighting_of_ref": "indicator--e1965aaf-3e11-4b75-a5e1-713e80dae125", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16a8ce23-d3e4-416a-be2b-ba15d37ac0ed", "sighting_of_ref": "indicator--e1965aaf-3e11-4b75-a5e1-713e80dae125", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e2ef681-36c4-4147-ad40-d9b7e127aa05", "sighting_of_ref": "indicator--402b835a-74e1-4d6a-8ca9-1454e19d0285", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e56e4ffc-3554-4fd2-bb70-990cd72473c1", "sighting_of_ref": "indicator--a067191b-91b8-4883-91bf-a7d41bac7dd4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1453ca3-8122-4595-b239-052d64f877d2", "sighting_of_ref": "indicator--8c24b3dc-419a-4c6e-9b51-4f0e7e8ea65c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ceff50f-58a6-476c-972a-b435057b632e", "sighting_of_ref": "indicator--36c7c9d3-6b3e-4323-94be-e314213c1cdf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--106932d1-4718-47b8-8d48-5069c099d4fd", "sighting_of_ref": "indicator--36c7c9d3-6b3e-4323-94be-e314213c1cdf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa98f616-3f3f-44b5-9a09-517c32558e78", "sighting_of_ref": "indicator--0e1fba43-2ef3-4a89-9f1a-e3bd550b87ec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a9124b7-6a27-475a-b4ed-0c938a9cd33b", "sighting_of_ref": "indicator--0e1fba43-2ef3-4a89-9f1a-e3bd550b87ec", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5498a62-da4c-4ba4-bc0b-f90106e129f1", "sighting_of_ref": "indicator--5139e78a-edec-4132-b5d2-2eba74bc019a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--084ccea3-8c0e-49e3-a346-b2d232238e78", "sighting_of_ref": "indicator--36408565-450c-4932-9ca8-dda765624b61", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb27b455-853c-4901-aba3-ad3bf25d9b0e", "sighting_of_ref": "indicator--36408565-450c-4932-9ca8-dda765624b61", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--724b458a-6772-4e44-b44c-9119b087144b", "sighting_of_ref": "indicator--bdf83737-0a31-4f4a-a367-89b1f04d849e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--615db064-27d7-41e3-a5f5-ded1a5f8166b", "sighting_of_ref": "indicator--01c69094-00c4-4b37-8874-6be97f2e93b6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23833041-715f-4349-b1f7-805d4dade3fe", "sighting_of_ref": "indicator--b21a8e5e-0087-4255-9997-ad5824d930c6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12f1bfd5-14ac-4c63-8015-09e2fda2f97c", "sighting_of_ref": "indicator--b705cda8-dae0-4e86-b02a-1082ac29bfd1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--481369c3-31cf-43e3-996b-53bdcc283f87", "sighting_of_ref": "indicator--8e9981b2-ae69-4800-88b3-b9521cca050a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--291c9f32-235c-4cb4-a808-2311cac9de9c", "sighting_of_ref": "indicator--0f49ed40-ddec-48de-8e94-e987c35062ca", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2bb8300-425b-4309-a9b7-94af3bf90c0d", "sighting_of_ref": "indicator--0f49ed40-ddec-48de-8e94-e987c35062ca", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0cb2ea6-16bc-4d45-8081-707fd0d65990", "sighting_of_ref": "indicator--efefd721-8d05-454a-989e-6ee387d95824", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f615222-ecaa-46a6-9d49-da7f345c7e6d", "sighting_of_ref": "indicator--efefd721-8d05-454a-989e-6ee387d95824", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b6f2f58-dcd3-40bc-b2f1-d7875248e46c", "sighting_of_ref": "indicator--0a558194-9486-4adf-8cfb-448ea98827ce", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81fe1f56-ce7c-4d65-9ec7-2912243ffbaa", "sighting_of_ref": "indicator--9fe0222c-f3d0-4d76-921e-3619cfca7ca8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da7763ee-d753-4139-8955-f22a010471a4", "sighting_of_ref": "indicator--9fe0222c-f3d0-4d76-921e-3619cfca7ca8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3b65994-a4f5-424d-839a-c0b73c9f5f4c", "sighting_of_ref": "indicator--4b95c636-8ecf-468f-bcca-c02a675ba899", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a430f9d-c00e-4b10-b0be-0cbfde98e4a3", "sighting_of_ref": "indicator--4b95c636-8ecf-468f-bcca-c02a675ba899", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9cf2ef1-84f7-4372-8930-32d613136bef", "sighting_of_ref": "indicator--362ad921-bd81-465b-bb33-5bea1d5d8ddd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c717bafe-abe6-4b1a-a0a6-d18c2042d3a2", "sighting_of_ref": "indicator--459c1a18-e1e7-4ed0-8da5-1554302493c0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2e16bdb-5cb9-490a-b959-1174926e729c", "sighting_of_ref": "indicator--2a5efd61-7155-479a-bc2c-76b59cd1950a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ef025f7-414a-4de4-a6ec-4d845c37c429", "sighting_of_ref": "indicator--25c43b13-d24f-4b65-abc8-a31d664269de", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6057b409-5080-48d0-b0d1-539c0794e1d6", "sighting_of_ref": "indicator--65e03eda-8f0c-4a20-99bd-489878943281", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46b69092-3412-42c6-a2e8-1c4dbe3c6957", "sighting_of_ref": "indicator--65e03eda-8f0c-4a20-99bd-489878943281", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a162d98a-0796-400a-99b7-48fb3a4d312a", "sighting_of_ref": "indicator--a2e04dbc-402b-4c92-9eac-3ddeab6fcc96", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97a1060a-2d0a-4b92-a5fd-c2cebc802434", "sighting_of_ref": "indicator--cd4d8bba-f4a9-4117-8b55-e88e2af4d868", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--952cda92-1cd5-4b20-8e93-f05db58c5199", "sighting_of_ref": "indicator--2d415738-b411-4112-8edc-4283a845219c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5cb507b-eeca-4e8c-86d1-6de50e24bf65", "sighting_of_ref": "indicator--2d415738-b411-4112-8edc-4283a845219c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bddf0f87-9a44-42e6-9705-5c72e8adbbb2", "sighting_of_ref": "indicator--063a0e2a-3d6f-4809-b9a9-7e1f91958b0b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7260d20a-ae70-452f-816c-14ef03699427", "sighting_of_ref": "indicator--b5f37779-5a6b-48fd-bea4-7c37c46b8a37", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b92fbdfe-e878-4089-803a-a43733fc8c0e", "sighting_of_ref": "indicator--247a1b87-dce5-4252-ac08-817ff7c01ce0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdd55655-ea8f-4f9d-8df3-770ce0eafc5c", "sighting_of_ref": "indicator--a140b520-5fb1-418d-9f3d-1501bffd5bb7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b24cb6f8-d06f-4915-bfbe-3e955895d53b", "sighting_of_ref": "indicator--9fd93337-43bf-4bad-93f5-24cf370b0616", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcb40e24-2802-4984-8e59-85c217f7b96a", "sighting_of_ref": "indicator--9f5eeec4-d1b5-4f2a-b396-844de1208e4d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d5e1869-0e95-4b54-a267-480739a1954c", "sighting_of_ref": "indicator--19d67f4f-40e5-436e-9a33-6ad8e72aa020", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9f43018-c70b-454e-bc0a-52a6a8e5c521", "sighting_of_ref": "indicator--6b02bce6-f953-44db-9e6f-c9f85049a06b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b4da21e-8e88-48f8-b59b-e8c7e90aaf47", "sighting_of_ref": "indicator--87f572f8-a04d-43f4-b1d3-4ed24c8956a6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5423d202-a54d-469d-8e63-bbacc479061b", "sighting_of_ref": "indicator--87f572f8-a04d-43f4-b1d3-4ed24c8956a6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a21c5d3-dc0a-497f-9319-58a3e1bc2576", "sighting_of_ref": "indicator--f81ca757-9682-4a1d-8792-fabd8f418ca5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f8285cb-b7e2-4697-b196-099d74e6cde0", "sighting_of_ref": "indicator--f81ca757-9682-4a1d-8792-fabd8f418ca5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2452f34b-34df-4542-b092-23e4ec56d5f8", "sighting_of_ref": "indicator--22c7fb41-85a0-4ac4-8fac-30504e2c1663", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37f1c915-5605-45fc-9ee5-d47de87252be", "sighting_of_ref": "indicator--22c7fb41-85a0-4ac4-8fac-30504e2c1663", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--869d4157-af0c-40d3-8a5b-c09a1cc4669b", "sighting_of_ref": "indicator--812ef713-9366-425b-9042-18f28676ceb0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e46a32a4-d764-407b-967b-fa2ebf129b27", "sighting_of_ref": "indicator--812ef713-9366-425b-9042-18f28676ceb0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2db967fa-dac7-40f8-872e-9f32409da200", "sighting_of_ref": "indicator--e727512a-ab2e-4db3-8d12-8482a2626222", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25eb55e3-9bc1-4e7a-8d17-63533810cbd1", "sighting_of_ref": "indicator--78f4f1ba-0652-4de6-8295-8963a22f9759", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2911c769-4e52-4fb1-a10e-17b882092332", "sighting_of_ref": "indicator--7e83ce6e-9a00-4d4b-80ba-728e13e4e6c9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8969106e-e2a6-41f1-ae96-7a3be7c13774", "sighting_of_ref": "indicator--7e83ce6e-9a00-4d4b-80ba-728e13e4e6c9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afe7b145-661e-49b6-a0d7-5cc7fd2045f1", "sighting_of_ref": "indicator--a24a99da-42a1-4c1a-ad30-9a0ef677e61f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8469650a-a097-44cf-a356-daa84296d0e9", "sighting_of_ref": "indicator--0f17b8be-5cf2-4504-bb83-fc118061a9e0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17eb557e-f2c5-459f-9885-9c2794ab18b8", "sighting_of_ref": "indicator--e6495387-9929-4f29-9d8c-f923ad811303", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7349f413-4c43-4fa3-bd9e-5b371fee9b77", "sighting_of_ref": "indicator--c1f00e97-dcb1-4445-b3b2-42c7a5ec8887", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--713ace04-7e09-4b2a-ab00-1f4af07533e8", "sighting_of_ref": "indicator--25108ee4-4f2c-44c7-ae88-c0aa627d69b0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--749beb50-a8ce-439a-9202-280142bd964f", "sighting_of_ref": "indicator--74a555ce-9160-4e57-94df-20b7b3a1387a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00087530-043c-4d17-b619-68352dd33bb7", "sighting_of_ref": "indicator--1d3235b0-7edd-4fbf-bb49-098eecd9bf08", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e6a7761-be7c-47a4-bc85-11a7d71829e6", "sighting_of_ref": "indicator--2231444a-c2f3-48d4-a89f-60fbac7ab00a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6290021-abf9-43cb-a06f-c5efa82fc1af", "sighting_of_ref": "indicator--c10f42e2-3fb6-4869-bea3-76d60cff0b5c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b1ca871-ab00-4281-af38-1d992eaed65a", "sighting_of_ref": "indicator--6de55a45-9b08-429d-adcb-7e3a3bf14292", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a058b6be-da28-48d8-b366-cbdbab1076ae", "sighting_of_ref": "indicator--92800808-e0f3-44c3-97ce-dc72030d3604", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a91781e8-b24d-41f2-baa2-2d8a1ee61df8", "sighting_of_ref": "indicator--9dfb6c6c-a979-4667-8a6e-15efbd09c4d1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2b1807d-84b3-4eef-bad0-c7bcd90d0c42", "sighting_of_ref": "indicator--9dfb6c6c-a979-4667-8a6e-15efbd09c4d1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67123b35-bd5a-4eef-8aa8-eae9ba27a661", "sighting_of_ref": "indicator--b7c0e6b8-7e45-4dfe-968b-a5e9442c3f57", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e7cae1b-6875-4cc1-8d69-853d02edbf36", "sighting_of_ref": "indicator--b7c0e6b8-7e45-4dfe-968b-a5e9442c3f57", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ae01b81-c876-45be-8910-762936626d20", "sighting_of_ref": "indicator--d9bdc9e1-fd02-4d40-92ea-bd284b1662a4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7632ea77-933f-41d2-9f29-52bb3c0ad95f", "sighting_of_ref": "indicator--d9bdc9e1-fd02-4d40-92ea-bd284b1662a4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99b7afaa-f197-4ae5-ae38-0aabdf9deb28", "sighting_of_ref": "indicator--84288bf2-500c-4198-9de7-2493b790a1a3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8432d26-7243-4024-84ba-9a0a8f2970f6", "sighting_of_ref": "indicator--75c60867-4d90-402a-8164-78c7cb42c197", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91a89fd3-d98d-456e-99c1-43046328d93e", "sighting_of_ref": "indicator--4761ca17-df44-4258-a00e-70967e6fd04e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88e6b452-9def-4e86-8a86-ea94bb90e732", "sighting_of_ref": "indicator--4761ca17-df44-4258-a00e-70967e6fd04e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b13335ef-77bc-4aa9-ba44-2883c80652be", "sighting_of_ref": "indicator--2459b1ee-5628-4d44-b446-ce1f8827cf68", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d4b1a8d-48d0-4db8-ad66-dedb789bc361", "sighting_of_ref": "indicator--4c0a4d86-2bd8-4860-bf08-cf525c648478", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6aae87a5-6828-4a53-b063-5eac8d09f3f6", "sighting_of_ref": "indicator--4f562fcb-1a24-4ee0-b3a1-36ef3d8eed8e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecda297b-1832-47b8-8a98-811a2469aa45", "sighting_of_ref": "indicator--722f2a7e-742d-4c8f-bbea-498c69f9e6ce", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d62a867-b60a-4a88-b554-8e135af3c5f4", "sighting_of_ref": "indicator--2470d9c2-521c-4e63-9877-8e3b67220fa4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--511f4b17-fcae-4e93-95c5-62fe18c8826b", "sighting_of_ref": "indicator--3438c511-b773-4927-9464-66060f60e2f2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cab222a-bf49-4082-bd64-a152c79e91c7", "sighting_of_ref": "indicator--3438c511-b773-4927-9464-66060f60e2f2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca80076d-89c4-45bb-932a-70c5663dbca1", "sighting_of_ref": "indicator--233d356a-3d58-41d2-8403-e949c786dd69", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--174dacf8-a082-40b6-b2fa-a57c0b9b60c0", "sighting_of_ref": "indicator--233d356a-3d58-41d2-8403-e949c786dd69", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd44ed30-201c-42a5-a2dd-011fdcb996d0", "sighting_of_ref": "indicator--75c7fb0f-44e3-4932-b158-43a7e5bddebd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--341d9986-8abd-46fc-b80c-f47a1ea150aa", "sighting_of_ref": "indicator--d9db248d-57cf-48b3-a700-395afce1881d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f33a2ba-36f5-41db-802b-89b064312aea", "sighting_of_ref": "indicator--d9db248d-57cf-48b3-a700-395afce1881d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a25f5407-ef59-4f47-880d-67123694ff9d", "sighting_of_ref": "indicator--3a139f9d-bff4-4ab7-843b-78731bfae381", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0844d518-1e88-4e38-84d2-5ed2f13ddbce", "sighting_of_ref": "indicator--2c75954f-e0d9-4bb5-add9-f21667461f48", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--667fbf25-5b8d-40ec-aa33-b186a05195e8", "sighting_of_ref": "indicator--b7f9604b-7f52-4f56-9aab-9be6fd22e8d3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bed45f2-54fb-4bb1-b7f3-d034f2b20406", "sighting_of_ref": "indicator--673f58e8-5e80-441a-8f5f-8120e5129224", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07494ee5-ef72-4c35-ba2d-7197e449d28d", "sighting_of_ref": "indicator--d0d2aa5e-0e4a-44e8-a1b4-c9daeada404f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e9a86a2-a643-496c-9af2-b7d960d5ac3c", "sighting_of_ref": "indicator--5853cb22-fb0d-4f8f-9626-9bdb76aef030", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1198858-8488-4ae8-8161-853701fa49e4", "sighting_of_ref": "indicator--5853cb22-fb0d-4f8f-9626-9bdb76aef030", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3a2fe76-af57-4650-9878-023eab81c743", "sighting_of_ref": "indicator--6f51ad70-0af0-4a38-9772-912f7fa92d2f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8942c988-01a7-40e3-ab4f-e97718e2a28d", "sighting_of_ref": "indicator--6f51ad70-0af0-4a38-9772-912f7fa92d2f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85a20022-d332-4992-8ada-2247515498b6", "sighting_of_ref": "indicator--bc46e138-ca60-40f8-8218-e516280e03e7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--616be997-2c2d-4488-b6f4-e40f5762168f", "sighting_of_ref": "indicator--79acb6c3-24e2-4e40-8fcf-99abe2bdfc05", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69bbfd87-9053-4dc4-ae80-dfe01d53469e", "sighting_of_ref": "indicator--511ade9d-054e-43ac-9e05-be39a1e2f760", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92668ef1-3b3f-4e2f-b7e6-d97d28d23769", "sighting_of_ref": "indicator--04495f30-bdde-40c2-90e1-42949f7cd981", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--829c3157-6b97-4173-a64a-817ffec4fe5c", "sighting_of_ref": "indicator--08004caf-ebbe-4310-8980-30a770f528fd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dba01b79-9236-486e-8313-a37756ae0783", "sighting_of_ref": "indicator--08004caf-ebbe-4310-8980-30a770f528fd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c95e89a-77aa-4c34-abd8-0e46d1e1182c", "sighting_of_ref": "indicator--c9b622ff-3ac7-4664-99f3-694cc4147e17", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd192d19-d5f4-489f-b608-a5bee8c1c0ff", "sighting_of_ref": "indicator--7e1f146d-ed58-410f-8529-7148994135f5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--948f5051-2209-445f-b310-40e8a4ae44e3", "sighting_of_ref": "indicator--7e1f146d-ed58-410f-8529-7148994135f5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da0de3c1-5e0b-48ba-ba1d-33ebaa9fee57", "sighting_of_ref": "indicator--e75b6a1b-779d-4ecf-8777-eccc49ce1b26", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72461407-276b-4357-a7e2-e14ca3043d99", "sighting_of_ref": "indicator--a801926b-26e6-4aed-944e-1c98fbf9dcb3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b7faffb-6e5b-4f8c-8744-66421800299c", "sighting_of_ref": "indicator--a801926b-26e6-4aed-944e-1c98fbf9dcb3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e7333ef-e1fb-48e2-8b42-2806f86e266a", "sighting_of_ref": "indicator--24b23d6b-0858-4d05-a7ba-51b07e8e2675", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d66be159-e860-4d2f-97a1-8a0797233721", "sighting_of_ref": "indicator--f9ceaf46-e632-4c4d-bd88-62ce73d791d3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13837623-d945-4a47-947e-a16b9c59edf2", "sighting_of_ref": "indicator--f9ceaf46-e632-4c4d-bd88-62ce73d791d3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31ebc448-cf7b-491b-8562-3c4e00015f70", "sighting_of_ref": "indicator--97f9e82e-0b23-4e9b-8330-ee64c588309e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f1f8794-ab08-4ac5-939a-b4729999b04b", "sighting_of_ref": "indicator--8e02cf42-4828-4120-a344-be6829f54847", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--850bc673-a373-4235-8aa7-031a36f6d1bd", "sighting_of_ref": "indicator--8e02cf42-4828-4120-a344-be6829f54847", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61a016ee-4d28-4e2f-a27f-84733b46f050", "sighting_of_ref": "indicator--26615823-d7f7-4225-a81f-e80dded9d836", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc2f5124-e755-4d21-b1c0-1974ae144510", "sighting_of_ref": "indicator--26615823-d7f7-4225-a81f-e80dded9d836", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94cc75a5-e17a-48c6-b027-6c423bc9019c", "sighting_of_ref": "indicator--52128586-a2ca-46e1-882d-3c9d121d0ce3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99d0883a-88d2-4ccc-8fa8-ce5b60fb6ce7", "sighting_of_ref": "indicator--52128586-a2ca-46e1-882d-3c9d121d0ce3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29cbb50e-41d4-4c36-8cfa-a3ab449d80a7", "sighting_of_ref": "indicator--aae904ae-bad8-4d88-bd24-477c9d8486c7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbc16300-7258-4efc-81af-00a7bb214a1e", "sighting_of_ref": "indicator--eedb7457-ab7d-4042-8259-c5c65974c9fe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72fd4e1f-cb8b-4b9a-9aa2-40ac47baa1b1", "sighting_of_ref": "indicator--eedb7457-ab7d-4042-8259-c5c65974c9fe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4001aff3-c9aa-48c7-9409-96566e36cf91", "sighting_of_ref": "indicator--7bab0a6b-f87f-4ef5-ba70-2d866da3191f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--419c8fa8-73c7-4700-af23-f97baee7f0e7", "sighting_of_ref": "indicator--074ab64b-40e8-47cb-992c-5d0a55341e8b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ba3047c-e740-4cd4-a61c-129bc016a23e", "sighting_of_ref": "indicator--074ab64b-40e8-47cb-992c-5d0a55341e8b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--154346d8-fd05-487f-ac1c-d228dda0face", "sighting_of_ref": "indicator--9d3c4e9a-2884-4b8a-b14c-775fe157166b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6533df4a-9c86-43e9-9a7f-f21927b7ef75", "sighting_of_ref": "indicator--097d6c69-2e97-428b-8622-6d5d68ec2070", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff8c17ba-d42e-4595-9e5a-47e103a9e9dd", "sighting_of_ref": "indicator--097d6c69-2e97-428b-8622-6d5d68ec2070", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b6c6c5d-e3e1-4650-b9c1-41d7cd702f2f", "sighting_of_ref": "indicator--4c1772b7-e60f-4fbd-b115-d9601299cd24", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2352ec78-fad7-49f3-94f2-262798c70fb6", "sighting_of_ref": "indicator--4c1772b7-e60f-4fbd-b115-d9601299cd24", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07e50ad5-d212-44ff-ad55-56e174f1d4a7", "sighting_of_ref": "indicator--1d12efb3-6087-44ca-8bd5-8c1c5b85ebac", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1470516-c914-4423-951e-67e64b1c65f1", "sighting_of_ref": "indicator--27ace7ad-fa14-4882-8572-8ef891359fba", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ad5230c-93d6-4404-8faa-87f6dc82a677", "sighting_of_ref": "indicator--27ace7ad-fa14-4882-8572-8ef891359fba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d05890a-9fda-4a17-9cdb-62f8eb7b7692", "sighting_of_ref": "indicator--6430ec2c-4e85-414b-a64a-18fa6c540ebb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2560d05e-68cb-4061-a1ba-c525ab6e1b37", "sighting_of_ref": "indicator--eae7d747-b73c-48eb-8273-a3972d2c5a3f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75308ca2-8f6d-4f46-bab1-c9e17735d793", "sighting_of_ref": "indicator--ef5619b7-cbce-4bff-a03a-e36522a17291", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a7fa336-5350-455c-a4c9-3c805e420b5e", "sighting_of_ref": "indicator--5fa13bf2-212f-4c9d-94b9-19bdba9627be", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8650d52f-ed02-4ffb-8d91-0ba69c7ee302", "sighting_of_ref": "indicator--192b19b0-16e3-48e1-be00-62a68133d011", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae36251b-b179-42d2-89e6-c68431d72ea8", "sighting_of_ref": "indicator--7a5bd9ed-5c32-4367-9373-4d2a85ec7079", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6d2125a-2a35-405a-8b37-833788d3e9e7", "sighting_of_ref": "indicator--af9188a1-8b5f-4686-b710-6aef3cf156ba", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ea1e2ed-9643-4aac-a3a2-173fafef258e", "sighting_of_ref": "indicator--af9188a1-8b5f-4686-b710-6aef3cf156ba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdea6e5d-cb46-4b3e-b8f0-3b6e7b846dba", "sighting_of_ref": "indicator--aa731a5c-5229-4fe4-bf50-9eb66d22e533", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5513ba3-3e52-4462-8a2d-3d4eeb2b6d41", "sighting_of_ref": "indicator--69d2cf01-9a81-470c-a878-2ff877c524ff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d99261d9-6b56-4a9f-ac26-e31794fd9ae6", "sighting_of_ref": "indicator--11f745c5-422a-4e0b-b19f-d62e760807e5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c796eea0-4a6f-41fc-a8a7-b0381774ae76", "sighting_of_ref": "indicator--11f745c5-422a-4e0b-b19f-d62e760807e5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8a88440-bf89-491d-b806-6dd47a3a07d2", "sighting_of_ref": "indicator--074d130e-d98e-4ce2-9ad4-09b0eddde800", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8040a565-4fef-4a56-9d42-f8a77afa6b2f", "sighting_of_ref": "indicator--56a7ed79-5fca-41cd-9865-8f616f56c572", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee4ce11b-a713-437d-98c2-ab7f70331f8e", "sighting_of_ref": "indicator--9cff72e2-f47d-4df6-9d44-324426165cbb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46b8712b-6068-48b1-997f-d4698084653e", "sighting_of_ref": "indicator--9cff72e2-f47d-4df6-9d44-324426165cbb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34d86d47-be69-4ed1-9151-50fc7d2c1e16", "sighting_of_ref": "indicator--58f56a91-9431-4824-b8a5-7ef6200e6b9a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ec7c58f-5108-4bb4-9ab9-32912eaa9c04", "sighting_of_ref": "indicator--ca11b07a-8878-4e47-af7d-466900dbd34d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0f54e3c-3ed6-4995-93b1-426e3019f7c9", "sighting_of_ref": "indicator--897559b3-2819-45c3-8bd0-ae34fbf6a016", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3530b9c2-15d5-4e14-9462-22ff5d8f6d13", "sighting_of_ref": "indicator--443ecb56-1787-4878-bddf-72505202c6bd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae4bf443-0231-491c-b4e8-1a7eec071b99", "sighting_of_ref": "indicator--cc71e386-e471-4898-88ce-1ded732e6ff8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6c2afdb-f072-4f06-9998-9aa9ca7fda55", "sighting_of_ref": "indicator--d5b13295-3be1-49da-a1ff-f50001f66feb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e6e030d-18fa-4a16-a2e3-7da61f9b0a57", "sighting_of_ref": "indicator--6de07ba4-1fb1-44d8-9304-130d4d44c460", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8d62301-a2eb-4217-bedc-cee390e1e583", "sighting_of_ref": "indicator--6de07ba4-1fb1-44d8-9304-130d4d44c460", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd820d8e-56e8-4110-8514-e517f3c36b79", "sighting_of_ref": "indicator--0a894050-a82f-4c76-a6f3-532bde9dcdb8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc2b93b0-2647-4494-859a-ea163bf0e2b8", "sighting_of_ref": "indicator--d9476f8a-39d2-4fc6-8ec2-1a2a0c884130", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1fb809a-8fb7-4aae-9a6f-c48affae98d5", "sighting_of_ref": "indicator--cff45094-896b-471e-b24c-d77321ce3ccb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b94343e2-41c0-440d-81ef-604623f78ab7", "sighting_of_ref": "indicator--cff45094-896b-471e-b24c-d77321ce3ccb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--342b366c-734e-41ad-9ed7-2b28ca192e44", "sighting_of_ref": "indicator--91ad3f29-92f3-4f9a-91e6-a0ae40894a69", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48413388-58c2-499c-8ef7-c51bb07ed5a7", "sighting_of_ref": "indicator--91ad3f29-92f3-4f9a-91e6-a0ae40894a69", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d75d82f3-0244-4901-bc4a-3c2db08266ae", "sighting_of_ref": "indicator--3a15cc94-de5c-464a-8020-cc85f3d435a3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89775931-2743-459e-9ff3-c36e8f75ee24", "sighting_of_ref": "indicator--ca418ce7-b677-4b00-a69c-576bed01493c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2484c7a4-49ad-4bde-8d0e-8bca30e72218", "sighting_of_ref": "indicator--ca418ce7-b677-4b00-a69c-576bed01493c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30954a9c-b7c6-4774-8e66-84fcadb9560d", "sighting_of_ref": "indicator--2c34b7d3-593d-4973-b9c4-06f50ba7ed0c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7935457f-bcda-4446-be57-2dd927ef6463", "sighting_of_ref": "indicator--45bb8960-75fa-4aa4-a778-7e78181daf86", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54a29115-9c4a-4820-9ace-1bef49569ba4", "sighting_of_ref": "indicator--45bb8960-75fa-4aa4-a778-7e78181daf86", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7840211-2fef-4573-bcca-01761bd00b05", "sighting_of_ref": "indicator--6f1f24a5-9e8a-416a-9f3d-6af4db4c447c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdf012b0-f386-45bf-b101-bcd6361eb45f", "sighting_of_ref": "indicator--e57dfd69-b65d-4576-ac34-db35f5c8ea61", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a82642c8-7d7b-4c85-bf93-52ffdae115ab", "sighting_of_ref": "indicator--f6fb0ff8-76c2-4c82-8053-b58005f34dc1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b0cba25-231a-4264-868a-8bc525bcef2d", "sighting_of_ref": "indicator--059ffc7f-e091-4043-888c-9aa4080d96fd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c245100-c077-47af-817f-113c1c11d32a", "sighting_of_ref": "indicator--7b0c96ed-de68-49c6-bae7-84c1d5310fb2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61fe0360-d539-4d82-a0a1-da459c658386", "sighting_of_ref": "indicator--94b20c17-cbeb-4140-a802-299cfdb46a1f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d658b1d5-38b4-4dbe-a7d9-1b435421666d", "sighting_of_ref": "indicator--fc51a3f1-a450-48bb-a218-4b260e3f0f9b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e51a46f-52cd-497e-8574-a67f70f48cfd", "sighting_of_ref": "indicator--92f4e21d-cf5c-44cb-b783-c26bb6813045", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8eb4e94c-986f-486f-ac40-1a8893a55643", "sighting_of_ref": "indicator--92f4e21d-cf5c-44cb-b783-c26bb6813045", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66f83774-8a9d-423b-90a5-3e15befbcb39", "sighting_of_ref": "indicator--ab54cbb9-7641-4c97-869f-1e42b2ba78fe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52bf36f0-9138-4930-b8de-37d5ec8eac19", "sighting_of_ref": "indicator--b10f06db-6e85-49ae-a736-20f000c98329", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19907dc7-bdf6-460f-bba3-02206344e72e", "sighting_of_ref": "indicator--52db0919-2181-4c75-a4f3-e6fa66bfb94a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--835cd81b-112c-43ac-b684-58d80fe33e24", "sighting_of_ref": "indicator--ebff51d6-21b8-4ee1-a766-0c485c98fcab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a11acea-b4e7-454a-8fe3-c172215db8af", "sighting_of_ref": "indicator--cff840af-81b4-4d5c-a93c-2997baa8e26d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c03f8b3-5f39-4641-8693-5d7ab94e74a2", "sighting_of_ref": "indicator--cff840af-81b4-4d5c-a93c-2997baa8e26d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f8c0aa0-2fd7-460e-9202-7cc5932f7bbb", "sighting_of_ref": "indicator--28d106d0-dd8a-4439-81e3-cf2bf920bd29", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc3dd4b0-c2c7-4b5c-b167-c0d77c23eebb", "sighting_of_ref": "indicator--a6baefe1-48dd-4486-bb02-76f5db4b1b8b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--116293d8-200e-4fca-9dda-9cd8cb1add51", "sighting_of_ref": "indicator--a6baefe1-48dd-4486-bb02-76f5db4b1b8b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58cc6f22-684b-451c-a9de-21d96edcfc41", "sighting_of_ref": "indicator--fd1759e5-1e82-4ee5-aee4-ac4dc3c73690", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af657ab4-4bce-4104-8156-41e08bd141df", "sighting_of_ref": "indicator--ea3b922a-0f6e-4e34-877a-b6fb814a4043", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--291a36ce-60e7-4bb9-b20e-ba9e2b85fdb1", "sighting_of_ref": "indicator--9d38a284-14af-4474-9ab6-6d0bde982d07", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e1cd146-2954-43ae-83c4-60dfed950dfa", "sighting_of_ref": "indicator--d63e6e20-8bfc-4a2f-b30d-99eb21990669", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6dffa3e-5359-4547-9ad9-5a13e63f21aa", "sighting_of_ref": "indicator--a0a34e3c-dc33-4208-b01a-b2a9248f7523", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--725dd93a-4aa7-48d0-9fda-56c75694c9e2", "sighting_of_ref": "indicator--a0a34e3c-dc33-4208-b01a-b2a9248f7523", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f500105e-5d84-4bb9-a2e2-ce07a1603e1d", "sighting_of_ref": "indicator--f3ad3d8e-f1bd-4548-848a-fc1cbd8e8c82", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7586e81a-2235-412b-af60-e96d7b32d9be", "sighting_of_ref": "indicator--bf283f61-3e25-4a18-9961-9b594be8f4ad", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e59a363e-e097-4e1e-9c5c-9ff297fb67ed", "sighting_of_ref": "indicator--bf283f61-3e25-4a18-9961-9b594be8f4ad", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--304d2fda-d168-4a08-ac9d-3763ac25722d", "sighting_of_ref": "indicator--23e55c91-7c2e-475c-9a4c-799bf0c88638", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3921b2bb-1b43-4200-92d8-dc10c9061422", "sighting_of_ref": "indicator--75a4ffad-af13-4e6d-9852-b74ab1b08264", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cd9fc0c-60f9-45a4-872d-15a4d331f54c", "sighting_of_ref": "indicator--87a063af-f6a2-4cdc-97a1-c05279c2e576", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6c87472-3e40-40b2-bca7-80f4fec7fcbc", "sighting_of_ref": "indicator--2a4556b6-1cf1-4cc2-80df-774cb1329c16", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29b51793-6990-4f69-b1cf-367e88284638", "sighting_of_ref": "indicator--a8519088-8efe-492b-9cc7-485c199e840f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8514835-a925-4092-95b4-b438d370c620", "sighting_of_ref": "indicator--a1ab3fb5-8fc4-4c53-85f5-ee09a1a75a51", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--957d2453-7104-4ee3-a871-735002f4a8fe", "sighting_of_ref": "indicator--a1ab3fb5-8fc4-4c53-85f5-ee09a1a75a51", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aafef490-14b6-4979-8748-116851fcc301", "sighting_of_ref": "indicator--69730f9c-af70-4f32-901f-3e9f8bdceaad", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ff56ac5-ac7a-44fd-be70-0db6c22930c9", "sighting_of_ref": "indicator--3047cd5b-39de-40f9-bade-2e7c75a1f0b2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d3428bf-801e-4984-a9fe-460ee4aa9106", "sighting_of_ref": "indicator--3047cd5b-39de-40f9-bade-2e7c75a1f0b2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c60b058-630e-4252-8b56-d9ad6c86c3d1", "sighting_of_ref": "indicator--3c6e575d-e36f-483a-9de3-45c3d2992c7f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdc6af73-832b-4178-8f56-bc98991a47ce", "sighting_of_ref": "indicator--dc956092-df68-4108-9254-9130f1181ebc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5338464e-baf5-4876-8d21-8e1cddc4ea92", "sighting_of_ref": "indicator--d7985b11-50a7-4470-b6b9-6189d77cd8a7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34354396-0bde-4503-b57a-a6c95efd9e9f", "sighting_of_ref": "indicator--0abe7711-5582-4210-8b02-4422dfc67bd4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7505ad75-8d74-407f-880c-3a42f854f7e9", "sighting_of_ref": "indicator--c3606be6-9f51-42b1-b2f8-455f6aa4d25e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d05a1e4-a320-4208-824c-3c34c5b607b7", "sighting_of_ref": "indicator--fa870238-4fc3-40c0-86d1-ac0c3f427e38", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac3b7647-a1d6-4857-8251-da2c9eeb5b04", "sighting_of_ref": "indicator--dc419c74-40c1-47cc-925c-04bc4c9fcca8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78bfc605-682d-49b6-95c9-a3c965bde74a", "sighting_of_ref": "indicator--bb2298c3-3986-4316-a0af-66c8c310b1d0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54f6f7c4-c937-4967-92c3-608a15c81230", "sighting_of_ref": "indicator--c3eeae70-9dd4-4303-a3f2-d5cf928b8856", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac40d852-3f89-4d1d-ab6c-80cff693f6de", "sighting_of_ref": "indicator--6ff0ec24-c2ac-452c-b02b-084fe22cf195", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0057a669-d599-46d5-a5f8-3dc0c13dbc09", "sighting_of_ref": "indicator--224904d3-590b-43d0-909a-4dd0cfda5988", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4544fa8c-0de6-4eaa-b659-bb12f0b5282f", "sighting_of_ref": "indicator--224904d3-590b-43d0-909a-4dd0cfda5988", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e62385d-b7f3-47f6-89c0-146bd40edad0", "sighting_of_ref": "indicator--74ec45a4-eccb-4208-968e-08075a9e3922", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ef89fd3-de3d-4a58-bab2-03f00c89be0b", "sighting_of_ref": "indicator--e3a59fb2-1239-4e76-a7cb-1dc8c958b649", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aadace80-5c69-4dbe-9f54-281045c9b91f", "sighting_of_ref": "indicator--e3a59fb2-1239-4e76-a7cb-1dc8c958b649", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f00a9e31-144b-42e9-804b-8c7818574c75", "sighting_of_ref": "indicator--e8285ffe-d566-4d06-86a7-ca6a6361befa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e116a41e-3a0e-4bc3-9c80-242675782c96", "sighting_of_ref": "indicator--e8285ffe-d566-4d06-86a7-ca6a6361befa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d10f3bed-9bbe-4ce4-9e66-e0041f4ae2a9", "sighting_of_ref": "indicator--2c8526f4-b1b2-479d-ba96-b2953c06e874", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5e48db8-4f02-4d9b-996b-d49d84921aa1", "sighting_of_ref": "indicator--2c8526f4-b1b2-479d-ba96-b2953c06e874", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4cc7a4b-fb49-449e-8386-948889b6ba57", "sighting_of_ref": "indicator--03650b49-7243-4da9-9766-0dbd381b00c2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c61b83b4-1173-4441-8ecc-86620b2e7dd6", "sighting_of_ref": "indicator--51eca55f-faa8-4d60-ac78-911a5e5153cb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--949115c1-e557-4d00-be57-bf5ddbb37a70", "sighting_of_ref": "indicator--4e846ebe-1882-43e6-8cc7-af675ea7771f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f200f14f-97d4-4191-84c8-c10b2893f7bd", "sighting_of_ref": "indicator--4a4ab2bd-cf3c-4184-84db-d61870ebdd1d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--794cb11d-0298-41e3-a375-58c0fe292594", "sighting_of_ref": "indicator--adc67551-90d0-4b14-83d6-dc81e3ed23b7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--236bcec3-0761-4bbf-a6d7-a7c24dd61dca", "sighting_of_ref": "indicator--41bcd8f3-0988-4fac-9991-093a15acbc14", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5e0be95-cf3a-4c37-b20e-aa15914f5146", "sighting_of_ref": "indicator--d097f9d5-e25b-4294-a2fa-67ea07b84ee3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--859ae591-de8a-46c3-a321-59a75a8664ba", "sighting_of_ref": "indicator--d097f9d5-e25b-4294-a2fa-67ea07b84ee3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41844d0e-49e5-4dd6-b50a-9fcbcd338246", "sighting_of_ref": "indicator--91256338-7ddb-4582-93b6-12f1e7f2c46f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--403aad44-2930-46ab-b375-de7f7d45faf5", "sighting_of_ref": "indicator--f40e9fce-68a6-4077-b510-a5ab71a9a658", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2848b730-baf3-45ea-ad6e-75992291ca56", "sighting_of_ref": "indicator--bd37c497-32e6-4c2e-94d0-a21df490d614", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81bbd4bd-52e4-43cc-ad82-6be4d1fb9d5e", "sighting_of_ref": "indicator--d3ac80d7-8399-4397-be47-182032ee96bb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--feb17c65-d5f8-4c9c-b660-db37386b7453", "sighting_of_ref": "indicator--3c02df9e-f51d-417b-824c-85a4d377b9dc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b22f1c4c-ab06-44ee-ade9-8065f503f883", "sighting_of_ref": "indicator--3c02df9e-f51d-417b-824c-85a4d377b9dc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31fef37a-193c-4d3f-a0c2-c30db1429d6f", "sighting_of_ref": "indicator--cf42ee93-280d-492e-8b98-899a2477a4c7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d85c1ffc-7ca8-403e-b915-72595570305d", "sighting_of_ref": "indicator--ab86f43f-b1c1-4070-8344-552b86c1adea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5182efb9-0bdb-4091-92f7-415f1c320e66", "sighting_of_ref": "indicator--0d298632-f821-4e71-ab1f-4ce3099b3ae9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ecd8641-1492-4b99-bc5c-0fb5c1a4599f", "sighting_of_ref": "indicator--38ae64cc-386d-40c9-b170-b03a86d826c2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b77b4264-cfe6-4c8e-b6db-944254bcc529", "sighting_of_ref": "indicator--2d33c184-78db-4171-ae1a-bd1326450fb5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad66a861-5765-4487-9de3-7d343bdf51d9", "sighting_of_ref": "indicator--8ab6e88a-6e0b-44e6-b344-433a158b5989", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f2e23e7-2c01-470e-8ce1-7ada6988b82b", "sighting_of_ref": "indicator--8ab6e88a-6e0b-44e6-b344-433a158b5989", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--836c5e76-596f-47e0-82c6-18f4cd2ed00d", "sighting_of_ref": "indicator--98951060-a8d1-4e61-ba1d-29acd760aa1e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b17d41ff-45cc-496b-a849-07d80b3a17f0", "sighting_of_ref": "indicator--2c158a31-ef9b-4c33-bef1-5a648b593088", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fda2d0bc-0850-4281-ad03-49174252a914", "sighting_of_ref": "indicator--1a80fbfa-aeb8-4079-86b6-ed59cf9e4d9a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e932068a-8d19-4b2c-b723-ba88b639deb5", "sighting_of_ref": "indicator--1a80fbfa-aeb8-4079-86b6-ed59cf9e4d9a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ababe294-c8e3-48c8-b440-b255c8a44019", "sighting_of_ref": "indicator--b85d9f50-d420-4f3a-a641-c6198a026a4f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2b506dc-6533-4fdb-9716-9681eddad2d6", "sighting_of_ref": "indicator--42068803-adfa-47af-9e31-bb247a229d8f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2338b38a-6440-407e-8d95-3f08e819fa73", "sighting_of_ref": "indicator--933c0a93-1033-4f1f-8d78-91586530e2bf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb8e4960-3c27-4a55-83a3-ead6ffdee435", "sighting_of_ref": "indicator--e5edeb3d-c0b3-46e6-b48b-46359470ef07", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6caec8f-4c3d-4554-a2f0-f9b7a6fbb8ab", "sighting_of_ref": "indicator--0f92c6c6-7669-48da-8a1e-34b7c646feb4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a7aeec2-4de0-4d06-82e7-1ddcb34fb772", "sighting_of_ref": "indicator--e230c6bf-4c99-4958-b97c-906019f0405c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed2a7da4-935c-4b4c-b7a2-1c50a1eb294f", "sighting_of_ref": "indicator--0c82c1cd-7c3a-41a6-bb5a-2305fd9503e0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ebd0641-9c1d-408a-a8d0-d80f673a386c", "sighting_of_ref": "indicator--0c82c1cd-7c3a-41a6-bb5a-2305fd9503e0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2845a0c-623d-488e-a145-c1159c5f5141", "sighting_of_ref": "indicator--297a40bc-562c-4290-b6e3-6bc5f0de26f6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0eb29b2-592f-4109-b19c-6867edaf6f04", "sighting_of_ref": "indicator--297a40bc-562c-4290-b6e3-6bc5f0de26f6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a72c06ad-6e14-4dc9-973f-4397f4b6c0ed", "sighting_of_ref": "indicator--a108661b-d6e7-47a7-8e87-2cb3697c40e9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff3393cb-04de-4fec-ad8a-69d539d6931e", "sighting_of_ref": "indicator--a108661b-d6e7-47a7-8e87-2cb3697c40e9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48ddc1f3-9968-4210-a544-acbc08de789d", "sighting_of_ref": "indicator--1bc69176-5555-4997-a10e-2dfdadfe46a3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0574a8f-8871-472f-956a-f3d359b229b3", "sighting_of_ref": "indicator--532e1ff5-5e9e-40c1-9248-3aa002f1fbba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f69e49be-74f1-4943-b348-175e23fed87a", "sighting_of_ref": "indicator--a53b4ecd-9ea9-4b1b-a9cb-b3d7b73044e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e8ab235-8c0e-4372-8d64-3383604e9dc4", "sighting_of_ref": "indicator--a53b4ecd-9ea9-4b1b-a9cb-b3d7b73044e6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ec2304b-472c-49e2-8e3e-64a1e6c4da31", "sighting_of_ref": "indicator--7f420cc9-0361-4a98-9f84-450f5d403702", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86452fae-c62f-4edd-8c00-e03624fa6226", "sighting_of_ref": "indicator--87265890-f5cf-4df6-9cfe-e32e16c06078", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4dc46ff-d3d5-4fe4-b4e1-3f93f2086a34", "sighting_of_ref": "indicator--989cb8a6-9b93-4416-8113-c67b24eb0dc3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f8ce056-a434-4950-8331-cef56a9bf33e", "sighting_of_ref": "indicator--989cb8a6-9b93-4416-8113-c67b24eb0dc3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--028f01b2-87c1-4f29-94c4-86550a63b0d7", "sighting_of_ref": "indicator--c1ff3cc0-0833-4b04-b139-9c0137f29639", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32ddc742-200b-4581-9320-25f4b539a026", "sighting_of_ref": "indicator--c1ff3cc0-0833-4b04-b139-9c0137f29639", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa191d14-a44e-4655-a033-15a6aac1e1d5", "sighting_of_ref": "indicator--17fe53b6-66a9-408d-bc58-d6322d8b1b43", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--332be6ba-1775-4a57-8d71-8572a1e8d246", "sighting_of_ref": "indicator--17fe53b6-66a9-408d-bc58-d6322d8b1b43", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dcf654e-6167-45cc-9669-ba84bda91adf", "sighting_of_ref": "indicator--74260206-2cf9-4036-89aa-406948e26bad", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7eaaf0b0-adc9-4268-abb7-bc74fb322261", "sighting_of_ref": "indicator--74260206-2cf9-4036-89aa-406948e26bad", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f9deb13-395a-4587-9f84-1cfcc709b5a9", "sighting_of_ref": "indicator--6ffd7e2f-3e54-44f7-b550-20ea1fb20675", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3aad5643-39ff-4065-8a27-ae6649adef3c", "sighting_of_ref": "indicator--ae1a5dd2-d143-43a0-98c4-da20c5d6268b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d69e2e76-9d50-473e-b0a7-e2e025fe5d39", "sighting_of_ref": "indicator--ae1a5dd2-d143-43a0-98c4-da20c5d6268b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3153634-96bf-4f5a-bcfb-56580d36c471", "sighting_of_ref": "indicator--582e5f31-d2b0-4870-a33b-49505d526490", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65a798b1-b1e8-4115-9ce5-f824961ee707", "sighting_of_ref": "indicator--9f0af1e1-6d3f-41e9-8ea3-187f5dc697af", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd3cb3d5-5ab9-402f-84ff-45ea8f0c630f", "sighting_of_ref": "indicator--e951ff53-490a-4cf0-98a9-ba1a82385f74", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d42c4841-354b-4eae-970c-91648dae679a", "sighting_of_ref": "indicator--c6c419a3-61ac-4da9-986b-516c94fb9bf5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--218b5867-8c13-41dc-8335-1457c9d123d2", "sighting_of_ref": "indicator--ce54623f-f7aa-40f1-9fba-0f10f0ab2b46", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--864101e2-a674-4bde-99ff-5ecbc0a8ba6e", "sighting_of_ref": "indicator--75470436-7d0e-4979-a284-7c5d2fb7c796", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ae8ba3b-6d7a-4f10-a625-3f87b8ec7c34", "sighting_of_ref": "indicator--da4e1d68-6200-4918-ab7b-18964e6b374a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--389a923e-cfce-4ffd-8a38-3fd347e77a5d", "sighting_of_ref": "indicator--8c3114db-afe1-4645-ab20-0a69a39465b5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40debe3a-1349-4fbb-a1e4-8a5bc25ebe84", "sighting_of_ref": "indicator--8acb80a3-3aa1-48fa-8581-7a720e79bb9d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61ef6a5a-157e-4922-943d-5b8c51a90ecc", "sighting_of_ref": "indicator--2bf6c991-c39d-4336-ae0e-04fdaf31e2df", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c202a89f-9d15-4f68-ba12-a067abe6dfde", "sighting_of_ref": "indicator--2bf6c991-c39d-4336-ae0e-04fdaf31e2df", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84ed17ab-f162-4538-b40a-29093f83d091", "sighting_of_ref": "indicator--6b12971c-f5cd-46b9-8794-2700529a122a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--124a97fe-10b1-42f5-b691-5e8cf0f3c6ca", "sighting_of_ref": "indicator--1f790f75-635b-4287-95e8-d358bceaef4e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c9b38de-e510-44d1-8ea2-d8f46f2b8880", "sighting_of_ref": "indicator--bb116791-ceb6-4b02-908c-cd613cf4b64b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0064d9c7-5223-4e36-9529-b68125c31f6c", "sighting_of_ref": "indicator--c61ecca0-f429-465e-80d3-1d7dbd937dea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--961889ef-7938-4ce7-8fc1-4827d7d88aa4", "sighting_of_ref": "indicator--c61ecca0-f429-465e-80d3-1d7dbd937dea", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61ad33ab-2139-41cc-9793-81eeb87fd877", "sighting_of_ref": "indicator--1f1354fd-45af-4369-882a-f7046038ebaf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b50dbfc0-e17c-4ee9-bc17-6bf81731ce0e", "sighting_of_ref": "indicator--e1a638b6-6226-43c5-8809-b6a16398752f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f70d4427-1582-41a1-9752-2fe3a34d4cf7", "sighting_of_ref": "indicator--3bb258b4-5f72-4e1c-82b7-2b15699e7b47", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fe0924c-1fa4-4fbe-9a56-5a6532632933", "sighting_of_ref": "indicator--258da500-d40d-470e-bcba-868aeb0d1016", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c89c0b9-7a89-40f0-bffd-0b982f6fb759", "sighting_of_ref": "indicator--258da500-d40d-470e-bcba-868aeb0d1016", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fee1679-856f-49d6-a614-8c6b9f2e1ee8", "sighting_of_ref": "indicator--6859c783-dac5-4c81-9854-9a3c624d8ad7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97adb66e-deba-45a2-8f54-986954d0f081", "sighting_of_ref": "indicator--d0de94cf-5ad5-4d4b-ab59-b8d041e7bf05", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d982ec84-8388-4c1d-9212-16bc5f85dade", "sighting_of_ref": "indicator--7f508913-6076-45e4-97b1-bb604bcdcd0c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--552b9eae-d9ff-4b64-ace0-d7caabe945fd", "sighting_of_ref": "indicator--5facfd4f-fffb-4e95-9545-3cbbc31431bd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--518df8de-e3c8-4331-b209-7124372db54e", "sighting_of_ref": "indicator--5098032f-c3bc-4a3e-9b05-302b30ce90a5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3783e27f-37a5-4e97-b3ac-eee24a54ab23", "sighting_of_ref": "indicator--bf2c332f-43e8-4c05-83d4-e45711dbeb61", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e45dce8-5873-44b9-ac1c-a56392c24197", "sighting_of_ref": "indicator--bf2c332f-43e8-4c05-83d4-e45711dbeb61", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6029351c-681f-47df-97dc-c4f138cc3047", "sighting_of_ref": "indicator--445cb299-3c40-4759-a920-4110f7157856", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af8a782c-abd8-4126-aa7d-8feeab9451f4", "sighting_of_ref": "indicator--1850ebd2-24ad-4c18-98cc-a35bdceb7b85", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2659bdd3-8fb0-43fa-8c2f-78b721586a7d", "sighting_of_ref": "indicator--7104bb21-00d8-41f0-94cf-9a97687e429b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--670edca3-9f95-4b4f-ba20-36c87bc3681a", "sighting_of_ref": "indicator--7104bb21-00d8-41f0-94cf-9a97687e429b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8d56a84-f0b4-4e01-a48a-7773718948f8", "sighting_of_ref": "indicator--2481e62f-2132-4963-9a2e-e67b2f4dc6c2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12028bc0-abd4-4b66-a9bd-fb72113ffa8e", "sighting_of_ref": "indicator--7a460e41-0b14-4ef2-815f-f24718b7d360", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a8f691c-b40f-4015-ad07-155be83e93f4", "sighting_of_ref": "indicator--fabbf6a6-124b-49ea-9f6e-50a6b30b599f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b892d3ef-d2cf-494b-9a62-637bce8054fc", "sighting_of_ref": "indicator--92196f05-cdd0-4275-a031-8ccbb2281263", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b81ba62e-581b-41e2-831a-07d3aadb1eee", "sighting_of_ref": "indicator--92196f05-cdd0-4275-a031-8ccbb2281263", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b12c1de5-d52e-4033-b85e-ddf594d246b8", "sighting_of_ref": "indicator--8abe751c-f451-4539-b6b1-9e206c750c80", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a95c612-1769-429e-b51e-1b31f16d72cb", "sighting_of_ref": "indicator--81f54cb9-ae18-4e46-8337-2aaada4148f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78953e77-60c5-45c8-bd35-ccc2e69c370c", "sighting_of_ref": "indicator--1e31db5b-7eca-4ae9-8843-e3daac1e4ca3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e3e3965-0724-461a-a3ee-1481d69aae3c", "sighting_of_ref": "indicator--156aaf8c-e469-4c04-b270-1966d6878f09", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cd5c4b1-e8a1-4a0d-942d-8804e9c929e6", "sighting_of_ref": "indicator--1ebe9954-a85d-4650-b2a3-bf943739a8f6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4565383e-2fb9-4f7d-93a4-96b6693047ff", "sighting_of_ref": "indicator--1ebe9954-a85d-4650-b2a3-bf943739a8f6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d12833dc-3a1a-4695-bc6b-17b75dba7b17", "sighting_of_ref": "indicator--eee629e6-54f7-43a9-a04d-f2cc1872d918", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12ed78de-b320-4ac4-b57d-20902d8afc45", "sighting_of_ref": "indicator--3162269c-d145-4a40-92cd-d4b18be340d3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0ef6f60-e8ed-4631-876d-68f4130fa652", "sighting_of_ref": "indicator--3162269c-d145-4a40-92cd-d4b18be340d3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28f55546-1959-4aca-8efe-9101077eef04", "sighting_of_ref": "indicator--dfd3e200-d221-4eb3-bc4f-47fd5293c597", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a746264-8177-47b9-9b69-c8d5cf1004b0", "sighting_of_ref": "indicator--dfd3e200-d221-4eb3-bc4f-47fd5293c597", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96c3e566-479f-40bf-9fbd-7883f1a6d622", "sighting_of_ref": "indicator--09f4dc79-a89e-47c6-ac7b-d338c97e73ca", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5180c300-3944-48f7-937c-c603bf0dccd0", "sighting_of_ref": "indicator--68009fea-76b9-4006-9190-6681fa2c898e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a68846b1-ba5a-4954-b0cf-1dadb8346a2a", "sighting_of_ref": "indicator--29bd01f5-0126-45a1-a7cb-6546b925cbcd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5340fdc-b907-4d49-8d6c-d9887d4ebf14", "sighting_of_ref": "indicator--29bd01f5-0126-45a1-a7cb-6546b925cbcd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d6b1aea-786a-4ed7-b0bc-6f5ce5da50c6", "sighting_of_ref": "indicator--0348491a-ebf6-4ce1-9909-7a47590b057a", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03da5060-7870-4888-94d5-fa6dbf90398d", "sighting_of_ref": "indicator--70504e62-c91d-45e8-a785-8ced436215ec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0bbd33b-ee32-449d-82fd-7ffad18dd4a7", "sighting_of_ref": "indicator--70504e62-c91d-45e8-a785-8ced436215ec", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73214f3a-2f33-4ce8-ad42-150de4ee4128", "sighting_of_ref": "indicator--e0e6059d-cce0-44c8-9d23-858c64eb1f31", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebd76f3f-6643-4ea9-8242-5ad9ed9e01e4", "sighting_of_ref": "indicator--e0e6059d-cce0-44c8-9d23-858c64eb1f31", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92caa080-3c2e-4194-86ce-c62b8ed8b824", "sighting_of_ref": "indicator--2c629587-a7cb-4639-9ddf-67eb078c2f20", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15b5a78e-dee2-44bb-8c67-ca5b56880fcb", "sighting_of_ref": "indicator--6c9da44a-e889-49ba-937e-8b5dcb1f5f58", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d537cbd-9443-4fc4-8a9f-2ae39e69b2ee", "sighting_of_ref": "indicator--6c9da44a-e889-49ba-937e-8b5dcb1f5f58", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72723b1f-967d-4d79-803a-eaa1f91cd589", "sighting_of_ref": "indicator--001a10a4-3796-4469-9cfa-6beb7c3205b4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c64f7140-a176-4c31-b75c-87e3f17dd017", "sighting_of_ref": "indicator--7f3bae8f-4437-4e8c-943c-e496dfcfee2d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1392a036-7a21-4dd9-b9b9-cc1e27215ee4", "sighting_of_ref": "indicator--6c240af1-01d6-4875-af0b-b3e7e0e61887", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b66eedda-9156-441c-b6b5-9237391832b5", "sighting_of_ref": "indicator--57d2c043-c80c-4988-a072-ee20351e451e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eee898b9-50bf-4b3d-b92f-afa47e35fab9", "sighting_of_ref": "indicator--9ba1804f-cc35-4d43-8fbe-8c84309e2bf3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b93b129e-fcc2-49e5-9c17-94dcac3df3d2", "sighting_of_ref": "indicator--a6bf296e-414c-4d19-9b2c-88040cfa17d2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88deb08f-e8bb-4156-adf4-352b337bb1ea", "sighting_of_ref": "indicator--ec45d74d-5ec3-4d7e-bb13-4097e022c1c5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eef874f4-f54f-4320-9625-7b7ff4405bf4", "sighting_of_ref": "indicator--79b4de61-56ab-4f84-a59d-d087aa77f631", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c59cbb9-1ac3-4743-9bf2-f70b6a5f2b81", "sighting_of_ref": "indicator--7295a4b8-edc7-4ab3-95d0-d6f5d18c1295", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b501ca1a-c7a0-4dd8-8fe5-95828f15232a", "sighting_of_ref": "indicator--fbfe4456-5839-4ffd-889c-281b5f6a43f7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9887295-544e-4cdf-a484-82d1203a6263", "sighting_of_ref": "indicator--db4001ea-1c4c-49f3-9917-9ea56d49e75c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--643f3139-4d3f-4392-a5c7-e9bcd43bb0b6", "sighting_of_ref": "indicator--63def53f-f012-434e-beef-397794bf6580", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe054d1c-9b69-41ca-97ce-cd233dd4f8f1", "sighting_of_ref": "indicator--6b5b8a59-cc56-42f1-b66e-f10b133e1154", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--585b9614-70cb-4deb-9ca8-bfebdf1ba097", "sighting_of_ref": "indicator--2185e9de-3faf-42d7-babe-2e5c3eba52bf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecd42571-5b67-41d7-90fb-50e4f2a36a3a", "sighting_of_ref": "indicator--349b6527-e76d-4d69-83d4-daef67a95345", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51b2780d-9786-4852-bca0-4af7960a70a1", "sighting_of_ref": "indicator--f96dacd0-cac0-4e0e-97bb-d9f25396da4d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc14c176-d13e-4c88-9a64-5100963a177f", "sighting_of_ref": "indicator--b0f921a7-894e-4170-9fea-e97d0ffac816", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--834088a7-c032-4078-8b16-98faf2857b47", "sighting_of_ref": "indicator--b0f921a7-894e-4170-9fea-e97d0ffac816", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f51fb84-8ad1-40da-87e9-708f35a3b3c7", "sighting_of_ref": "indicator--48b09f56-99ff-4e72-b929-07d328cf54ee", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3988bd7b-756a-46a0-8a37-355554ab298a", "sighting_of_ref": "indicator--517d1e23-75c4-4e2a-bcd8-74c5add343d8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c8bbeda-8316-40a7-9e19-ab26bc90a289", "sighting_of_ref": "indicator--517d1e23-75c4-4e2a-bcd8-74c5add343d8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eaf6f6f-81ae-4f0a-92cf-a41436d95845", "sighting_of_ref": "indicator--69a9946d-8181-43b3-b6c3-1bc888751384", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--291143bd-816f-4c6a-9b3a-97873198b1a0", "sighting_of_ref": "indicator--7ba40725-73d9-4e59-8ad6-d525e843ff32", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a7a17e5-df62-416e-937d-f3d4b9f9aa2e", "sighting_of_ref": "indicator--55f13f45-fb31-44eb-bf79-fa820b12cd0e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--794e2da3-a5f7-4a6e-b0ee-f4f2e329c800", "sighting_of_ref": "indicator--da4a744c-26e7-47c0-a47c-8fe793a48510", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a99d944-f2e0-42ab-ac52-64991e231528", "sighting_of_ref": "indicator--354ca802-d38e-435f-8a64-89c7781807ac", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95f44aee-f5a5-45b0-8f9e-e6fc97f1a1de", "sighting_of_ref": "indicator--e86b6ec8-d4b8-43ce-b97a-72365e7fa050", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d29d3d48-296d-47cc-8535-4149e449ae76", "sighting_of_ref": "indicator--dc7a2fd1-a089-47c2-8178-9ffa0d9c5492", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab5ac32e-fc93-4c45-8047-8a0e342088a3", "sighting_of_ref": "indicator--913adfad-8c75-4433-818f-2630a992440a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1281d6d5-4049-4353-ba00-f5a213f84605", "sighting_of_ref": "indicator--7b46600d-45bb-4075-a3e6-79f9c43840a1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dee6aa1-a022-4439-a54d-97abb3985375", "sighting_of_ref": "indicator--5d2faf31-68f8-456a-b4d0-fb02dea939af", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b61b744-be68-4823-87ac-4b9d5b95c426", "sighting_of_ref": "indicator--5c5f15c0-40a5-44d3-a043-87d218bff237", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc3799e6-2a2f-4b84-9499-435dbec8c758", "sighting_of_ref": "indicator--519fc590-03e1-468f-a674-8f5fa0a0f8df", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bdca12e-bd32-4978-a066-981313497b7b", "sighting_of_ref": "indicator--1b4e3667-8241-4aa9-b91f-daa0267c426c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0daf520-2f2b-44a1-9e41-831991b16fe5", "sighting_of_ref": "indicator--1b4e3667-8241-4aa9-b91f-daa0267c426c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--513905d8-ce68-4d14-94b6-f1e4984c3578", "sighting_of_ref": "indicator--cb381c02-0c81-4108-80ce-47130ffdd1e7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b395316a-d8b7-41e5-887f-7630e7cccbb6", "sighting_of_ref": "indicator--3222a32d-2a08-4dbe-8b89-6cb07b641fdb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c7f9de9-9a54-4562-99ca-54e31c2a6279", "sighting_of_ref": "indicator--de87ef0d-be5a-4301-b7e5-b714ba556629", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f360cc2-6983-4850-8706-f7b137ecfb1b", "sighting_of_ref": "indicator--b106e51a-6b3f-453e-8979-1dcf7e81bdc3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84e0ac03-fb1c-484e-a606-67e24dba98e3", "sighting_of_ref": "indicator--a17e949b-7516-40bb-9cb1-0ab88a132bae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2969ccfb-7d3f-4cb4-a49b-868f7794d05f", "sighting_of_ref": "indicator--f97077bd-3319-4b79-9308-198cc9dd651b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--def142c9-cb00-440c-bc0c-306eecf60e8a", "sighting_of_ref": "indicator--e0e0f172-0cb1-4585-8efd-17872306e069", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92f6425b-b6cf-4484-b226-3b93f6448b8f", "sighting_of_ref": "indicator--336bd2fc-8867-4c42-8734-64a3404f070f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef984c8a-8299-4438-8e0f-65074a913509", "sighting_of_ref": "indicator--3572baae-8bb0-4874-b882-250bcae12336", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c21446a4-b121-47a1-9dfb-781587b78bb5", "sighting_of_ref": "indicator--37fa1fc7-302a-4c58-a2a8-79d42ab56544", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0fe03ba-5ca4-4b53-abc7-1fabcf5d8173", "sighting_of_ref": "indicator--da8aba15-274e-465c-88bf-1548bf886ff8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cf209e7-e446-4dc3-be10-be0f41ec27c1", "sighting_of_ref": "indicator--da8aba15-274e-465c-88bf-1548bf886ff8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d9ec91b-b46e-4458-a476-da3b73b74f00", "sighting_of_ref": "indicator--2e9be7f9-ea18-4d7f-a326-bb4bcb58efb2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20b5ccf4-ff16-44d0-b39c-fb54d6d93184", "sighting_of_ref": "indicator--eff905f5-d108-4943-bcc8-2d74ffcf7c80", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c194d31e-674d-4cae-a784-b8fcd88bb78b", "sighting_of_ref": "indicator--68afef1f-1d1b-4c9d-a434-510e7f0b5cf8", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6086728e-96ac-4d96-b33d-f05729d79aef", "sighting_of_ref": "indicator--6f07f38f-a5b9-454b-ac70-938643a3a024", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83c3afb2-434f-4b84-970e-7869b0dcd496", "sighting_of_ref": "indicator--117fe93b-01b4-4c0c-9697-1f1e03688925", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d92245a3-e182-4a78-9e73-4e3940a8ec4f", "sighting_of_ref": "indicator--090e7e36-6f9e-4529-892e-09420cdb8cd7", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--281b08ca-1f84-4ea7-8fb0-712ffaa1bae7", "sighting_of_ref": "indicator--6eeee88b-7e06-4b7d-ab37-08f8c818c5a8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a56bc78b-ed9f-4538-be4f-b5bc6fc3cf2e", "sighting_of_ref": "indicator--f59adcef-7a72-4a2a-a2fd-72be54d2bdc0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db8e5f30-517f-46bf-b5e6-fe35138dc42e", "sighting_of_ref": "indicator--ce149999-4320-400a-9a78-0d09716b158b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3211d0cd-a610-4aeb-ace1-eedcef0587fb", "sighting_of_ref": "indicator--a2764ad1-7a44-4219-bf63-1485395ecbc0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--186bc0de-8e72-4b2b-a3d1-817dc3dd47b4", "sighting_of_ref": "indicator--137f02f7-c3f9-43b4-bf1f-fe8617bdced3", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31d5ff34-3a35-4161-891b-6ae7df531c82", "sighting_of_ref": "indicator--e2ece16b-c22f-4d34-b001-ebc213ffe99a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85fcfc52-0ac7-4a0f-aeb7-1be3a0dc6fe6", "sighting_of_ref": "indicator--8e4ba8c7-6bcc-4136-995b-1f9a4d15c296", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5860ef75-9786-45d8-8a2e-0eff34041198", "sighting_of_ref": "indicator--398cb162-5ade-4742-97b7-31e3627cd2c9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1463b7a0-afb6-4506-a3e0-2e9ddd682910", "sighting_of_ref": "indicator--3775f436-1c21-4954-9b17-22d10bc50f16", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95808f0c-923d-4bfc-86b9-6c7c3d031f80", "sighting_of_ref": "indicator--658f6e9e-dc8c-4b85-b9fc-5c8a60a42caa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abc1fdea-494b-405e-9a87-dd8ec64f29ef", "sighting_of_ref": "indicator--04cc480a-825f-4704-969f-03da3ba7c5a9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8980f93-f40c-43a4-bc22-ce8e412b3376", "sighting_of_ref": "indicator--bc32954b-657f-4181-ba9d-1d013370f48d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--475d5b94-8f76-4f4c-b4ae-bbd6e207bf11", "sighting_of_ref": "indicator--72fabf23-ea2b-478c-b3ac-5d9d7bd0c0dc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eeae4dd3-ba96-4416-a509-332f228b5eae", "sighting_of_ref": "indicator--8a41dc45-9610-4466-b8ab-721da88bd9e9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18ee0f21-50f3-46e3-a564-e6e3f2eba506", "sighting_of_ref": "indicator--e8c7e030-efea-4c62-a556-3bbec3b361c9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd3c3653-d49a-49ef-8a87-a116a277ea00", "sighting_of_ref": "indicator--27580748-6189-42b8-b85b-b36a4f128998", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ba06ba7-7b06-4aac-a905-3a6f24d46846", "sighting_of_ref": "indicator--3de7dac3-3b78-49ce-9747-d92f1117554f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--510b897a-62bf-4bec-b8f9-ac527146380d", "sighting_of_ref": "indicator--1804ec30-7384-4f66-901a-e7ff6523a1d7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05cb2a55-95d6-41d8-b59d-a753348be17a", "sighting_of_ref": "indicator--93848b5c-673e-47ff-93a8-0515584b0c41", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40db209d-f614-4918-a49d-b2dbe983284c", "sighting_of_ref": "indicator--3dd55c68-a641-471f-8597-f7a08fa63a2c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b26b7e08-fdbb-4927-b592-074bce154c42", "sighting_of_ref": "indicator--492663d8-2a40-4935-8ec1-702361dd65a8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6211dc07-fad4-4c64-9948-812306be0995", "sighting_of_ref": "indicator--a575193f-d645-4ea7-898b-a2c52952fef4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3201d0a9-e493-4c45-beab-dea4a4aae5d3", "sighting_of_ref": "indicator--e3e2d2fa-6e74-464d-bfaf-c99f01b43885", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75f3a65a-5009-4732-aa10-16a29b9f6cec", "sighting_of_ref": "indicator--85cccdd2-0f10-4afb-a9a0-a02b8940f64b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--690ef0ce-6ad7-4867-a407-8e7aca3cdbc2", "sighting_of_ref": "indicator--054bbd37-ccb2-4318-ad3f-e2b7c0dece16", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d39dee4f-bd44-4938-bc5e-7b16be89d3f8", "sighting_of_ref": "indicator--cb97b803-3fce-4769-be20-560e093e56e2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52975d35-3048-4782-b71d-5ef17d66816e", "sighting_of_ref": "indicator--5423fe2d-6b81-4c46-9c77-52ae8930dc23", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df7c4df0-0dff-47c4-becc-69daedb35e33", "sighting_of_ref": "indicator--c59a0cce-7f0d-493a-bf57-f5b369c354f7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fba3393-1a30-4c14-81b2-43017f1bb21f", "sighting_of_ref": "indicator--f2979577-e22c-4f94-b433-a194dbacdf1b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18c81bcf-b2a2-4ed2-b587-4de5b403fe89", "sighting_of_ref": "indicator--853c8f6c-cb35-43fc-838b-31ebe75e4630", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03b50326-83e6-4f84-b52f-9c323f50be78", "sighting_of_ref": "indicator--2dba57c8-a2b7-4ed9-b08f-0ce242e8ef1a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a5109ed-1004-4d04-a67d-0494b8c471cd", "sighting_of_ref": "indicator--d882463a-123b-4146-a0cc-3465c0afce9d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--797dba24-9ba5-462a-a496-2150a18bccef", "sighting_of_ref": "indicator--8dcb489a-bc9b-4156-a0b6-5debb02bb4cc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--632a32f2-bbca-44dd-8a7e-61a173edb723", "sighting_of_ref": "indicator--60569e9b-3a05-4aa9-813a-ee765beab43c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d6add51-1fb0-45f2-b69c-405f19008426", "sighting_of_ref": "indicator--0ad639cc-f506-4737-8709-95b5186bf79a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57f8effa-1798-45c4-883e-323a38ae1777", "sighting_of_ref": "indicator--2ed529da-c2b8-414a-a258-f85e0d57f661", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--692d44aa-c3d2-4399-979a-3e9fb182df8f", "sighting_of_ref": "indicator--fc8f5495-e602-4b93-9a32-2db000553c4f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93f3f688-641c-46ca-a010-f26141f21f9f", "sighting_of_ref": "indicator--631092aa-c610-44ac-baeb-b8f9fe1881c8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62a0e105-6729-4185-9485-6f2c00aa639c", "sighting_of_ref": "indicator--1338cb85-b2ce-4a6b-9a29-61aed6108e53", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bea4a3c-eeda-4d2b-87d7-c65694e16b90", "sighting_of_ref": "indicator--31907f98-bda6-4d6c-9cfd-cd55c38ee35e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d44a045-1f56-46c1-8883-f6883e5de971", "sighting_of_ref": "indicator--6c1dbf8b-2c58-43ad-8756-3d919f666579", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcaa4e0e-910e-4076-ba81-77708c2b5eb5", "sighting_of_ref": "indicator--bad20268-54ae-45f2-99ce-cbf278a1b19d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10bcf364-84a8-4450-8e3f-f6f9ab5c4fa8", "sighting_of_ref": "indicator--0aceedd5-f959-4c01-b590-1e52cdd84bcc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8283109e-dddc-40ff-90c8-d6c2d997b2d5", "sighting_of_ref": "indicator--c550a40e-2bf4-40ab-aed4-424a203ae0fa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46a731bc-8537-4707-a7fd-02292e4f071b", "sighting_of_ref": "indicator--dc5804e5-f0e6-4fed-bd36-ad74e73b3457", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4df0cb9-447a-43e3-9c4d-d2a41b6d7b45", "sighting_of_ref": "indicator--8360752e-d84e-4edc-9a70-aa9a7a17487d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48067363-1ecf-4830-a641-37ed52d09e70", "sighting_of_ref": "indicator--ba30ecd5-8381-4f32-83e0-b9c72c52c32f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e73f658a-c48c-4802-8dab-cef14b4a47a4", "sighting_of_ref": "indicator--e9424ced-c22d-4e1a-b678-fdd15576de57", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ff228e4-52a3-4b5a-818b-c9568ba8a685", "sighting_of_ref": "indicator--a24819a4-8c8e-40f6-bc16-0c757a0e6519", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b9169c7-b024-4fa3-9cd8-ebe435fce2f2", "sighting_of_ref": "indicator--c96604fe-fa32-49bf-b2e7-76274a7378d4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--361377ad-419c-46d2-bbb3-6105e3c2d78c", "sighting_of_ref": "indicator--bc2f00fe-1dbc-48f8-b1e7-172dbf9cca4f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--969855ec-9561-4530-826b-a81cdb1a1600", "sighting_of_ref": "indicator--4b948b0f-44c4-49c4-8756-21e620190a67", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d84c008-8284-4f3c-a6db-3edae0d793c0", "sighting_of_ref": "indicator--ce88b3bc-a190-48ec-acdc-d1db4e2a4492", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd39c2a6-6c32-4d1c-b881-9f49e985ed55", "sighting_of_ref": "indicator--433d3a1d-5f45-4851-9a6f-29157400abcb", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3b4da33-7e82-4da6-ab66-24fa7d17b65d", "sighting_of_ref": "indicator--4c8359f9-9ed6-41db-bdf1-587b43fd48dc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b30a27db-8e54-471a-bb1f-04cb74500e1c", "sighting_of_ref": "indicator--f604fe77-6b72-4306-8771-203de3d67982", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1e259b2-fab5-401c-bd74-4a6479b6df3d", "sighting_of_ref": "indicator--06a173a9-1a86-441a-af60-72975a36dcc2", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c6d17c9-9d71-4a9a-bc52-dbd0df80b43d", "sighting_of_ref": "indicator--8e99152d-296c-405a-841d-c51a417a6606", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de5fba8b-5fcf-4935-9a18-bd0a0186de21", "sighting_of_ref": "indicator--d6ac9801-80b9-45fe-9361-d33c297d55eb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8464f49-8206-43de-baca-9be5c1a4108e", "sighting_of_ref": "indicator--f07058a7-f6e6-46f0-bcdf-68b152ffb794", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--843e8b2e-ca58-4b48-8cd4-f55d2e7b8ef4", "sighting_of_ref": "indicator--d33f7e5b-7134-4200-995b-b6762c4cc8c3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1d952f5-0e6b-469d-8ad1-599174465d84", "sighting_of_ref": "indicator--76d86ac1-c0d3-4637-9a1f-0e5e85f41038", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd7cde52-f21e-4ac9-a97f-19ada3d7642c", "sighting_of_ref": "indicator--38061e1f-8275-485f-9787-70afb9352be5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f104e1e-59e5-4358-b30b-681aaafa6e8e", "sighting_of_ref": "indicator--59bb6d83-1f5c-4a3f-ba4d-99ef37555a65", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd2cd66c-91b2-435f-bd1d-7648bdcf5ea6", "sighting_of_ref": "indicator--8099dda9-dc94-49da-961c-fb73c14f8522", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef54145b-ce24-477f-96ed-c7a6aa0fbc15", "sighting_of_ref": "indicator--c6b23717-437a-4d24-a982-b446ab3a794d", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62ca5b26-0b76-4d18-9417-43fc9788da76", "sighting_of_ref": "indicator--c6b23717-437a-4d24-a982-b446ab3a794d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a656aac3-3bd1-4420-96ca-81007207e233", "sighting_of_ref": "indicator--7bbcde61-2b51-430d-848f-b321826c6aaf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5809eee0-24f9-4b8d-afd5-d32a50639f0e", "sighting_of_ref": "indicator--6ff5fca8-4e5a-4729-be9e-2275942785fa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a9706ee-b9e6-4927-90bc-2dc92dda21a3", "sighting_of_ref": "indicator--b19f301e-291f-493a-93e3-2fb791c1a5d9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c87efba2-8273-42d4-934f-83c12d0388c4", "sighting_of_ref": "indicator--253399f1-0028-4052-a518-6b1484e3bf90", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01eb226f-1746-4228-a542-083561f6ffbc", "sighting_of_ref": "indicator--178486bc-f50e-4fcf-95ac-4259c6a92f9e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70cb87e3-7f2a-4ae5-9ae5-83d8aacc5a7d", "sighting_of_ref": "indicator--f71eb624-3e5c-4b57-9d22-6639ab6ecb1e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eb03e28-2302-4751-91c7-75f06e46ef1e", "sighting_of_ref": "indicator--78c53b49-28a0-4fe5-8209-3dfbac96a0dc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9b9dd87-43ea-4892-8024-80de1441afa8", "sighting_of_ref": "indicator--429ad5eb-6319-4cd5-887e-2e025a873859", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b561b2b-b894-41ce-bcd5-754cd7e53bf1", "sighting_of_ref": "indicator--10b56d43-39d5-4ece-aed7-25e2fad8e6b9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c74de5e-b046-4b1c-afdb-ff9449bb806b", "sighting_of_ref": "indicator--7dc4de49-7c2e-4341-b1d2-50273fdafbf2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--974c4964-d6b3-4e2c-8edc-5d88897e8917", "sighting_of_ref": "indicator--3dc00365-c454-486c-a678-964133997a77", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af3cf3fa-b293-4165-a7e8-d03ec37f73ed", "sighting_of_ref": "indicator--64a1ee3a-6956-4922-be61-93c6a30e7855", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--287b9b9a-6c40-4ac8-adf7-86efb1405d51", "sighting_of_ref": "indicator--e8177ff4-8861-4e3a-b134-aeb21f908add", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aed76e17-98cc-4a33-8550-3ccb6e660e87", "sighting_of_ref": "indicator--5937d977-7e2a-493d-b8e0-e20277b5a71e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19b751a6-f4c8-4b17-a148-66634c2c0825", "sighting_of_ref": "indicator--aefda670-9b4f-4b85-afe0-528c85d9fab3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b93f2570-12eb-4699-a1c2-6ad5e252870f", "sighting_of_ref": "indicator--97502a43-d845-49bd-9e94-ff7f1fac19b0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--209c66a9-fcf0-4c7c-9103-85ef4a625191", "sighting_of_ref": "indicator--d663995a-9584-460a-8bff-152f054eac75", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d221eff7-00ce-4dc0-be11-bf9926766591", "sighting_of_ref": "indicator--970859e3-3ae1-4e67-9b42-11fb2fc76372", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--138955fd-1dd4-42c0-b5b4-a5f29b800bcc", "sighting_of_ref": "indicator--db734b8d-f40c-4236-8a25-90af4965e4ce", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fd40552-d835-4260-9664-e28c14ca567e", "sighting_of_ref": "indicator--fcd3366d-d064-42cf-92c9-8e9a4723c73c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b74cbab2-e42c-4a18-9895-d134216cb855", "sighting_of_ref": "indicator--a3f966e8-9e64-407a-8d06-e2f7c56150ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d8c18aa-049b-4039-9df2-8b97195730ed", "sighting_of_ref": "indicator--faaf7d01-7ad3-4919-bee6-a68d4eb6f58f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75c812ab-af52-45d0-b915-094e4ffd397a", "sighting_of_ref": "indicator--f341434f-1a52-4e56-b045-93c71619a621", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97730155-7ad1-4e16-8047-7b289919a41d", "sighting_of_ref": "indicator--35e75b92-e795-46bf-8245-c159676ab6d8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--696a1591-0580-43f7-94a9-cb0ac545cec8", "sighting_of_ref": "indicator--6e7045f4-c48e-4ac5-a8cb-290a70c9bf14", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc7cbc57-1c45-4a7a-8adb-c60040f56f32", "sighting_of_ref": "indicator--12b56556-5e90-4cae-97d8-dc9b70b39007", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1223c538-cc0f-4c47-8797-2175ce3a910b", "sighting_of_ref": "indicator--11c0be27-d1c5-4d70-88fa-60c3c792e3d2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb421cc8-fda5-4e38-b161-22cd022f4c11", "sighting_of_ref": "indicator--6e43420d-7478-47d3-bf1c-a2aeb85aad80", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2a9cb6d-76bc-4f5e-8974-b041c14b0bce", "sighting_of_ref": "indicator--d9558753-8598-4ab9-bb5c-e506aac930b1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16bb1ca4-49e8-4e1a-a278-6fc7e62ca153", "sighting_of_ref": "indicator--c1bedcc7-148b-45c3-8b30-dd600e3ae398", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd235e04-ce3b-40c8-9140-b4e7a54cf0f6", "sighting_of_ref": "indicator--ce76efad-e0a9-4270-b424-c670ac2ddb84", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20d52038-bcfb-4dba-ace6-10d4b1889304", "sighting_of_ref": "indicator--7017f4dc-2254-477c-9dd8-1b13a46f3937", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5354531-fb7a-4c4b-8cab-39eb456406b2", "sighting_of_ref": "indicator--368e9b6c-4fd4-4374-982e-71c19cf8a403", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c153c7e-ef8a-4465-bb46-94011623f9c2", "sighting_of_ref": "indicator--9d97e97a-17bc-4668-8014-681c5cf6babf", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d279926-5061-44fc-a752-98524afd13ce", "sighting_of_ref": "indicator--619525a7-142e-43e5-81ab-0d3530012c0f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98b328b6-3cdd-40f9-a19b-e04d478bbf1f", "sighting_of_ref": "indicator--8350dd57-821a-4087-b073-f15645e1e94b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27f9f61f-2284-4968-b995-08a050c1bb4f", "sighting_of_ref": "indicator--ef413b03-079f-46ca-bdf2-2b7636b42fb8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1918a83-8383-45e5-8e39-c8e0fce54b06", "sighting_of_ref": "indicator--d4677857-618c-47e5-b769-1030b729c3b0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1a3b394-3ad8-434d-88ea-0692c717f52b", "sighting_of_ref": "indicator--ee05726a-0a35-48f2-a743-0eaad394875c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6be5daa-dd90-4595-bd6a-994d59380eaf", "sighting_of_ref": "indicator--6c5e609e-60fc-42d8-945a-bb123f0cf97c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4061703-d01c-4165-a187-b73b31204baa", "sighting_of_ref": "indicator--67f7c474-34db-41e5-9668-a65c4a9b1ce3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cccaa9fd-d86f-4ac9-a896-6d007f412d1b", "sighting_of_ref": "indicator--f7777726-15c6-4762-8c03-1feb86e44351", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7aad1fc1-d60a-4a31-a4b6-e1786c8126bb", "sighting_of_ref": "indicator--07ece1dd-b608-4e67-bdea-dcaf9e681e5b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a5fad2e-56c4-49bd-bfd7-36208ff1e162", "sighting_of_ref": "indicator--4bbc9400-9f0e-41fb-89be-d04da9646f7e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d361462-efb3-4967-8775-c195b5b1209e", "sighting_of_ref": "indicator--61bf5f7d-3a3c-4bc1-99be-5f00b3db23a3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dc1dd0b-27c3-4fc2-b4f5-1020dbe75a6a", "sighting_of_ref": "indicator--9258cd2a-5a28-4c37-8206-a3ad1d4b6485", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a2225b5-e508-4fb2-8541-fc2fb8d5a535", "sighting_of_ref": "indicator--d86a9ebf-0bc5-41fd-a153-4b2237118098", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81d6f421-c44e-4e2e-871a-58c2e42a9dc4", "sighting_of_ref": "indicator--b4aa2789-b02b-4938-a3a0-79d42db3630a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d4ad2d8-c5de-4dcb-bb93-f9b8e2101a29", "sighting_of_ref": "indicator--97b28616-e98f-4ae4-89a1-7dcb9c5bbc9f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd125e5c-a733-4931-9cb9-e21287c39a6f", "sighting_of_ref": "indicator--7f906d23-06de-4348-8c8a-de231395bf20", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68032cd7-e615-41fb-b49c-bb28975cde9c", "sighting_of_ref": "indicator--969e20f1-fd81-4c89-92d2-0f1e86b7b51d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3c6a237-ab93-46c7-803b-6f4ac5a00d8c", "sighting_of_ref": "indicator--8604fb51-72e4-498e-aec4-af1b9204b501", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bede81c1-17c2-44e7-ac0a-feb47a33701e", "sighting_of_ref": "indicator--8604fb51-72e4-498e-aec4-af1b9204b501", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcb784a3-a833-4b24-a00a-045127206f0c", "sighting_of_ref": "indicator--8c42634e-1533-4ab1-80ac-a01023cd44ef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb546804-792c-440e-80a8-c887bbbcee20", "sighting_of_ref": "indicator--8c42634e-1533-4ab1-80ac-a01023cd44ef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75220787-5289-469e-90c7-37b443b5559b", "sighting_of_ref": "indicator--81725510-a091-4c59-80ec-b8ed46ec38d5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e161dec-840b-468a-837d-442613bd00c6", "sighting_of_ref": "indicator--81725510-a091-4c59-80ec-b8ed46ec38d5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0f9c47a-0f2c-4f81-b787-aca81bc06fcd", "sighting_of_ref": "indicator--5ebb3b57-b81d-4121-b072-dc361c86f75c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17ea3500-f295-4fb4-94b5-3fa9b9d58cdb", "sighting_of_ref": "indicator--5ebb3b57-b81d-4121-b072-dc361c86f75c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f4bf3de-3ab7-43c3-9804-64fb761cdb0f", "sighting_of_ref": "indicator--2819db4d-bfe2-40d4-b7ed-95977bede084", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ebff3c3-ac3c-4646-bf04-347a2d192915", "sighting_of_ref": "indicator--03127386-1810-4ed3-96b9-1bf3198e74aa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81f5fc4d-1182-4fe0-945c-01741b104f61", "sighting_of_ref": "indicator--a473a9b1-f3ad-4876-ab41-0d84455ee773", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fcc62ab-3bd1-406a-a4f1-3583856f4d77", "sighting_of_ref": "indicator--7d32e5c6-4c1d-42dd-bced-e62f62010723", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12e22423-80f9-4c25-8932-abcc59613032", "sighting_of_ref": "indicator--27c51ecd-ac87-440b-8395-a5ad68059103", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--318f987e-c1d2-47a6-9d01-98ef8b9fa3b6", "sighting_of_ref": "indicator--78be6b43-dfaf-4353-9ade-80093b4ef2ba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e10cbb9-ca87-4970-a416-975d007dffac", "sighting_of_ref": "indicator--7b98d70d-7be5-4922-bed8-3f1d483cf62b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--807ee938-e749-48a0-afbc-18dede7d9f40", "sighting_of_ref": "indicator--0a6425e2-6ff7-4b2a-b441-4ca285a2447a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef603748-513c-4101-bbbe-0249dbb9a2fb", "sighting_of_ref": "indicator--f4add079-5e9e-4afb-a1d9-e9275f2e6a1c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4cc6570-e6ca-473a-85c2-4b643e677882", "sighting_of_ref": "indicator--f62587ca-2f21-41cb-929b-f761daf77321", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a707ffa-f299-4974-acf7-bd428cf9cd78", "sighting_of_ref": "indicator--8cd67747-2905-4d35-9281-ac6c5726f6fa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13671df8-2e2a-49e8-84c6-487531048c61", "sighting_of_ref": "indicator--a7e96910-ef97-48be-95b4-1d64b9d53045", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44cfd455-bb90-420c-a5c9-de79eda25e33", "sighting_of_ref": "indicator--c8fd70bd-ee36-451e-9ffe-af47e81ad5bf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab501685-0240-4cd9-9fc2-cf777adaab3f", "sighting_of_ref": "indicator--c8fd70bd-ee36-451e-9ffe-af47e81ad5bf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e09a3c30-5c5e-4e1c-983a-ef4d2d4bbd7f", "sighting_of_ref": "indicator--0c782fb1-37fd-4b96-b329-22d3e60d73c6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--066ffd2e-dd9f-4d38-9adb-6a598a1827dd", "sighting_of_ref": "indicator--64678175-3f86-4d3f-86e1-7076f9cd732d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46cc06fc-34e7-437d-8868-09d6ec619f9c", "sighting_of_ref": "indicator--f54868cf-1c7a-482a-ad7f-7f72eaae207b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a38e2ebe-20ce-4501-a16d-bf303eed9b76", "sighting_of_ref": "indicator--eaed7d34-23fc-4682-937b-b4f134ab994b", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dc1014e-b6e3-49ad-b400-7a0b0fe8e107", "sighting_of_ref": "indicator--56aba4f0-8551-4c9a-b7bb-e1fc78334c16", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25c05e9c-535a-44cd-b50f-40db5f9266c8", "sighting_of_ref": "indicator--5850f789-732a-4eb3-be01-fd3e375ac14e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9980104-228a-4873-910e-fd8f8a5712a3", "sighting_of_ref": "indicator--97abb0ff-e99d-4016-b395-ea751537cc4c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--360ce1ea-7e73-46f4-ad16-7b7e24782780", "sighting_of_ref": "indicator--19f72581-1ee3-418b-bab0-3578fc412705", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa6ce68f-0e00-484e-a940-6ade183b73e3", "sighting_of_ref": "indicator--19f72581-1ee3-418b-bab0-3578fc412705", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ef40de6-c558-4b84-8db1-6acaa7aa4811", "sighting_of_ref": "indicator--7a5bedd4-5d4a-40ca-afed-024158415600", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd71977c-eacf-4f49-8081-f5fb6ebb8527", "sighting_of_ref": "indicator--7a5bedd4-5d4a-40ca-afed-024158415600", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--541cfa19-e782-4c68-b8ce-6b28efe7606b", "sighting_of_ref": "indicator--ed7f5a1f-b0aa-449a-b7bc-f07d871b0db2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a15e6d54-c40c-4afb-b5fa-fb9a243997b2", "sighting_of_ref": "indicator--c7692a7f-537d-4f32-9de5-30766cf07708", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--057cfc60-780a-41ce-98e3-1a60470ca452", "sighting_of_ref": "indicator--e443b82f-3a76-4e44-b1b3-d3a938b60b39", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce11a96e-305c-42fe-9d61-1aeeeadddcd1", "sighting_of_ref": "indicator--72c237e7-1363-4ea7-8017-efa5ad66cfbe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d78a09d1-5752-4053-93e9-c276b1c5cda2", "sighting_of_ref": "indicator--72c237e7-1363-4ea7-8017-efa5ad66cfbe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3e8611a-1895-4820-bff3-41712bba72b0", "sighting_of_ref": "indicator--87ab2dfc-476e-45be-aaa3-895aa74ce7fa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34737ef9-ff4c-44ce-902d-bf1907bcb93b", "sighting_of_ref": "indicator--87ab2dfc-476e-45be-aaa3-895aa74ce7fa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b27d3077-5923-422f-befc-d9a7ee925b25", "sighting_of_ref": "indicator--4ef5cdb1-1b8e-4410-b654-2a88fe2da764", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52989f81-20b3-4a64-8559-4ec6b7b510cd", "sighting_of_ref": "indicator--775fd866-48f9-498b-8d34-4eef661ab246", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0f9dbe7-6ac7-45eb-867c-a374adad6564", "sighting_of_ref": "indicator--61d82587-629f-4b7d-9e6b-864ab3473cd2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ddaffa9-4ea8-4174-abe0-6e74c1facb94", "sighting_of_ref": "indicator--61d82587-629f-4b7d-9e6b-864ab3473cd2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09e84735-21b9-46c5-9924-a98301b6abb5", "sighting_of_ref": "indicator--962f5436-06ef-4f4d-8722-44d67423d57d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b0b61f5-2b91-40de-8a96-b6dc1d55c50a", "sighting_of_ref": "indicator--962f5436-06ef-4f4d-8722-44d67423d57d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b5fbc74-e507-4b0e-a366-77ba267312e4", "sighting_of_ref": "indicator--b2ace8d4-499a-4e3c-834b-69ecd71fd4d7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ce53a6b-14a0-4f62-8cc1-fe5fdc69287a", "sighting_of_ref": "indicator--b2ace8d4-499a-4e3c-834b-69ecd71fd4d7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49596d14-848e-4479-a9ab-104492b20414", "sighting_of_ref": "indicator--8564ce33-c1bb-455e-a5df-978ad67eb38f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--284dad11-62c5-44fe-b40a-b1ed278db164", "sighting_of_ref": "indicator--8564ce33-c1bb-455e-a5df-978ad67eb38f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42b56c1a-a6ec-4750-814e-a882d8ae1f9c", "sighting_of_ref": "indicator--6ad7aa9c-fba8-4d5c-84a9-b52ac4c1b1a3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b00cc5f0-d0dc-435e-aefc-313a3e0ae67e", "sighting_of_ref": "indicator--6ad7aa9c-fba8-4d5c-84a9-b52ac4c1b1a3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9be838c0-542c-4393-b792-1be5f2a65728", "sighting_of_ref": "indicator--4ea134f0-1a1b-43ad-af95-02a04143ddd1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2e0ec71-02e5-4aa9-804d-d3f9f72acc12", "sighting_of_ref": "indicator--15f53cce-4b95-486e-b72b-80f868795820", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f23b30a5-78c3-41cc-8bdb-5bc98fcafed5", "sighting_of_ref": "indicator--eb7ad6a2-15ef-48d7-bed1-5499d0168f49", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3ab81e5-a7f4-468a-9eb1-8aa926e86d87", "sighting_of_ref": "indicator--eb7ad6a2-15ef-48d7-bed1-5499d0168f49", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f93d827f-fb1f-4e5d-a7d0-845fa2f24775", "sighting_of_ref": "indicator--4c11937f-24de-441d-b0c8-e9fdc247d817", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bac0623c-b2fd-488a-9f41-802a2e6fa59a", "sighting_of_ref": "indicator--b38592bf-8ed5-4492-b5d1-fa9a08d3e8f8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dad2eb1-abb4-49da-9ae5-a12fe5c38698", "sighting_of_ref": "indicator--aba03fce-1491-44c0-ab9e-56dbbd07b28c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd77a04b-307a-498f-8fe7-6cd57b7563fe", "sighting_of_ref": "indicator--a9e2eaf1-fe29-4458-bf0d-02f357fa7c28", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47ac3c2e-5730-4293-859d-05abc6e60840", "sighting_of_ref": "indicator--38c6ac90-e842-4b39-ad75-b10f3abb9802", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70f694f5-8269-4e01-987a-d72a6144b774", "sighting_of_ref": "indicator--38c6ac90-e842-4b39-ad75-b10f3abb9802", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1acc369-2387-4327-88d9-18700d2633aa", "sighting_of_ref": "indicator--e6e3e9a4-ad0b-4513-a6fd-9823a5f75efc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06b42275-109a-4af6-ad13-6cf213d50789", "sighting_of_ref": "indicator--e6e3e9a4-ad0b-4513-a6fd-9823a5f75efc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--929b6187-21d5-4a7b-847f-7b344bfbc270", "sighting_of_ref": "indicator--dbc09db8-6f84-443f-a23f-9f96c17c7ab8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8830a093-c1df-4f43-95ae-cf9219c42da0", "sighting_of_ref": "indicator--dbc09db8-6f84-443f-a23f-9f96c17c7ab8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c01fc1e2-8c70-4be2-b26d-a047b5f6b657", "sighting_of_ref": "indicator--a1627c45-031d-46ae-894a-f3fb0a8db0e2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b73ea3f2-c010-407b-b478-ad9569e418ec", "sighting_of_ref": "indicator--a1627c45-031d-46ae-894a-f3fb0a8db0e2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0820a4a-7f0c-407b-9aac-15a6e94cc578", "sighting_of_ref": "indicator--d8556a41-97d9-4667-8d43-e119546e5a7c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1efc62e7-6999-40f1-82b1-ae289d3b7625", "sighting_of_ref": "indicator--d8556a41-97d9-4667-8d43-e119546e5a7c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3793f0c9-3fab-4a73-8d89-45fbf6b58b98", "sighting_of_ref": "indicator--de704181-6920-473e-9cf4-74bbbd71b4ee", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09601ba5-b4be-472b-8b93-947a0e9329a3", "sighting_of_ref": "indicator--cc1ab12d-314e-491e-bc1c-ae391d6ed809", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85fdb866-9c08-4a3f-8f66-1607ccc6ff0c", "sighting_of_ref": "indicator--02183cc4-16ef-419e-b755-da2a1ed21ef9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05cfb4af-ddf1-4c25-9bc8-d8feb8742d87", "sighting_of_ref": "indicator--52004c6f-272b-42d2-9911-decbacce36fd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79595c9d-07fa-45ff-aed3-f0e185f9e587", "sighting_of_ref": "indicator--52004c6f-272b-42d2-9911-decbacce36fd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29567640-1dd0-4993-a383-5a9f46489c38", "sighting_of_ref": "indicator--df240f7b-3135-4227-867f-7471419ece7a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81f3fc00-8a88-434b-bbff-5d7e64e091c3", "sighting_of_ref": "indicator--df240f7b-3135-4227-867f-7471419ece7a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b162dec-3388-4764-a760-24e72650dc0e", "sighting_of_ref": "indicator--2f0e7c5d-9ee3-4e98-b3cf-d989341b98d7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cec20686-b05a-4c44-a8cd-81b3e641ca4d", "sighting_of_ref": "indicator--2f0e7c5d-9ee3-4e98-b3cf-d989341b98d7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17cc3e6c-bcab-4d6d-8543-2f72bcd309de", "sighting_of_ref": "indicator--b492e4d8-cfd2-4cc4-ac57-612b8de48951", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34dd494b-e567-4618-852f-0789d1352de6", "sighting_of_ref": "indicator--2558cc32-c3a2-4692-920e-4b89f16b6339", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5a91c85-9668-4c9f-b78d-8a2f6724ad5b", "sighting_of_ref": "indicator--2558cc32-c3a2-4692-920e-4b89f16b6339", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5137e8d6-92c5-47c4-9fd2-258e9f6b4693", "sighting_of_ref": "indicator--04e987cf-bd4a-49fc-b576-fc5154867e42", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1042b54-90d2-46cb-8f7b-4badf8590ef9", "sighting_of_ref": "indicator--04e987cf-bd4a-49fc-b576-fc5154867e42", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c62bceb-82c0-4f11-8d8f-047b078b3cb4", "sighting_of_ref": "indicator--07035598-0a06-4977-88c5-be7e2817cbba", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--178fcfb5-e932-41ea-a996-6ebf731a1ad8", "sighting_of_ref": "indicator--5c48e324-ec45-4b97-ac42-a9225a4773c1", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97d8f476-d6f3-40c3-8c2f-6fbe0c336bcd", "sighting_of_ref": "indicator--a3816f02-a067-499e-b3d0-786cc912f079", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0d7ed22-f770-41f6-96bb-263ad0a13d94", "sighting_of_ref": "indicator--b65eea98-4949-4fc6-a562-9a1af6bc30a1", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--679d7498-5943-46a5-8ea1-6ba1f27d65e4", "sighting_of_ref": "indicator--84910b95-dd65-4773-b37b-832a67da8059", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64079cdd-03f1-407f-8d64-4e699866a977", "sighting_of_ref": "indicator--84910b95-dd65-4773-b37b-832a67da8059", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e61fe6dd-aaab-42f5-ac34-3219612f84a1", "sighting_of_ref": "indicator--84910b95-dd65-4773-b37b-832a67da8059", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6df53b9f-4d10-4011-8575-6ded38ceefe1", "sighting_of_ref": "indicator--84910b95-dd65-4773-b37b-832a67da8059", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f0c0e95-e411-4b6b-ac3c-4bc71a3ed747", "sighting_of_ref": "indicator--84910b95-dd65-4773-b37b-832a67da8059", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3096be0-9095-43fa-bc2d-787b484c2983", "sighting_of_ref": "indicator--b15eaa18-bede-4079-bfcc-bd6bdca4e11f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d2b796b-1eb0-4c57-881e-005306a1c16e", "sighting_of_ref": "indicator--b15eaa18-bede-4079-bfcc-bd6bdca4e11f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc29ec0a-85df-4a20-8230-afa6db02f69b", "sighting_of_ref": "indicator--b15eaa18-bede-4079-bfcc-bd6bdca4e11f", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5ed4b68-36de-4316-8a3c-2b8bccc9d6ea", "sighting_of_ref": "indicator--af7910b2-b9cf-4898-b6a0-e2de1c80eed8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c62946e0-d931-4dce-9a5c-b43edc4eba20", "sighting_of_ref": "indicator--af7910b2-b9cf-4898-b6a0-e2de1c80eed8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66b48daf-52ad-4096-b2ff-4b6c0d9d8e60", "sighting_of_ref": "indicator--af7910b2-b9cf-4898-b6a0-e2de1c80eed8", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c98b498-6303-453e-9afd-7ccdff4457af", "sighting_of_ref": "indicator--de70022a-41b3-41db-a6ae-2aa80992ceef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47d24781-f2f9-4dcd-9c51-eeaf6f3e34dd", "sighting_of_ref": "indicator--de70022a-41b3-41db-a6ae-2aa80992ceef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e0d9b36-a9c1-4958-8903-3c87d66e5df1", "sighting_of_ref": "indicator--de70022a-41b3-41db-a6ae-2aa80992ceef", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed070697-b7c1-4bd2-8547-fe3a7383517c", "sighting_of_ref": "indicator--80d70ca2-d636-48e6-8bbc-cdab8340262a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dea05b06-7605-412b-a1c6-8c1aa9d35cba", "sighting_of_ref": "indicator--80d70ca2-d636-48e6-8bbc-cdab8340262a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e87491b-5393-4fbd-914f-2ed4ce23b54c", "sighting_of_ref": "indicator--80d70ca2-d636-48e6-8bbc-cdab8340262a", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f969776-785c-45b5-896c-91135e1f132d", "sighting_of_ref": "indicator--543965f6-1327-47c4-8f12-a6b3236cf7bf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59a00a63-3a73-44d8-889b-c01bedce0ac9", "sighting_of_ref": "indicator--543965f6-1327-47c4-8f12-a6b3236cf7bf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83130285-ee46-4a9d-a194-d15a89ccc47a", "sighting_of_ref": "indicator--631f377d-c574-4321-be84-91b997e91239", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e81c3609-5fad-446e-8ecc-02a8be7b0e2c", "sighting_of_ref": "indicator--631f377d-c574-4321-be84-91b997e91239", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02bdc870-0c0b-433f-943b-64e7533afae4", "sighting_of_ref": "indicator--631f377d-c574-4321-be84-91b997e91239", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f5939d9-7593-4e2b-b703-bc1f08497613", "sighting_of_ref": "indicator--6686598c-11d4-422c-8224-4b9dffe88400", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07a205b3-73c7-4aa0-8f9a-81aa8b27a9c4", "sighting_of_ref": "indicator--fb245e59-2787-4a75-8e79-0e895e573df6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f91a6723-c84f-4723-93f3-730ffd86b475", "sighting_of_ref": "indicator--fb245e59-2787-4a75-8e79-0e895e573df6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbd14265-cc62-4ce8-9d88-2f48256d63e6", "sighting_of_ref": "indicator--321d5dd7-d2ce-4203-ba00-b13476972997", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ce9dd50-de48-420b-addc-e2736bd9c593", "sighting_of_ref": "indicator--321d5dd7-d2ce-4203-ba00-b13476972997", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c4614bd-f105-4bd4-94af-d77f5a0dd8c1", "sighting_of_ref": "indicator--28dee8db-7fa0-4033-b607-c2dc47ce6ad7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8defe1ee-625d-468c-ae0e-1edc1f17d6b5", "sighting_of_ref": "indicator--28dee8db-7fa0-4033-b607-c2dc47ce6ad7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63e2a4e6-8c34-4038-9bc8-0b8da65ede3b", "sighting_of_ref": "indicator--9cf800d0-b35d-4e79-883f-ce7f12b6afe2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c7fce39-1251-43e8-931b-21800a105bce", "sighting_of_ref": "indicator--9cf800d0-b35d-4e79-883f-ce7f12b6afe2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02f2a17e-e124-47f7-b868-503acb7bbe8e", "sighting_of_ref": "indicator--74a162e3-6e10-461f-993a-ffcd642d1630", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d53386f-bc19-46e1-a64e-c6d52e72916a", "sighting_of_ref": "indicator--4dc6fb55-88c3-4d09-bdca-66772283d5aa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33d8654e-15b3-4717-a174-67b3a0bc52c8", "sighting_of_ref": "indicator--fc698242-563f-498f-b740-8c557e8e4d32", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2abf04c2-8b01-43e1-a513-816232b8ff6c", "sighting_of_ref": "indicator--fc698242-563f-498f-b740-8c557e8e4d32", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad0e29ce-ce7b-43c9-9053-52b85941da43", "sighting_of_ref": "indicator--02442aff-2a8e-4823-ae02-0d7f97bbb202", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7cc2e85-8f0f-4b2e-8e31-4a3263555d0c", "sighting_of_ref": "indicator--abd0fc8b-e794-41db-b755-2502ddec452f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f6fff2b-1da3-4a99-884b-e476d3b2545a", "sighting_of_ref": "indicator--abd0fc8b-e794-41db-b755-2502ddec452f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77d08b35-6328-4563-9546-b5d65b11d2e6", "sighting_of_ref": "indicator--0ff0fb05-56c2-4b5f-b5be-29c9669a80bc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e884e63e-a287-48f0-b083-445cc8f82f36", "sighting_of_ref": "indicator--0ff0fb05-56c2-4b5f-b5be-29c9669a80bc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--976a7107-93a5-41da-a43b-3524acbea57f", "sighting_of_ref": "indicator--65a1e6cf-82d2-4b3d-ba8b-9c8c5ab95bed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5da84636-8c1d-4b34-8987-59b24fa230fc", "sighting_of_ref": "indicator--d44aa430-bae7-476d-8bf0-107861a1b23d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e1f78ea-0406-44bf-90e1-86860b26c186", "sighting_of_ref": "indicator--fcbf6343-3784-4bf7-ae74-a74add6ede2e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e1f915d-98dc-4049-b0d4-a4890be82b4e", "sighting_of_ref": "indicator--44174091-fde6-493f-a309-876d4551a738", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a15ec5d-8546-4986-a2e0-4190284116f6", "sighting_of_ref": "indicator--44174091-fde6-493f-a309-876d4551a738", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79edf0d5-c6b1-4023-a419-00aedbce5d65", "sighting_of_ref": "indicator--358412f8-6e90-463c-b554-7e973ae0a951", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49c0a29c-7c78-4652-a80d-d0fe6ab4f2d7", "sighting_of_ref": "indicator--358412f8-6e90-463c-b554-7e973ae0a951", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--074b24b5-a965-479b-8786-2f1d8c0dbc13", "sighting_of_ref": "indicator--04c7a925-478c-4122-a2ca-76147371d741", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--caf6a90e-02c7-44a7-a827-ed6e99e402d7", "sighting_of_ref": "indicator--dfbb35e8-1daf-4938-994c-40d0c0d7fd33", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2b37318-d565-4928-9282-624551c74990", "sighting_of_ref": "indicator--8b9b6790-760e-45f0-9feb-437067890b01", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aecc8b5e-dc3a-4d4f-9e2d-0f9b4e8cdc28", "sighting_of_ref": "indicator--aaac1db1-aff9-4ed4-b2a2-fb16b2ac8e98", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a4ce37d-8809-49a9-8830-83ecfccba822", "sighting_of_ref": "indicator--08c502bd-7b84-4b4e-bc68-ffbdfcd3a50e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1599bcb-91b8-4429-8d7c-cfaa797de54f", "sighting_of_ref": "indicator--2d37a605-fd21-4d4d-8cc8-72025b285554", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1af76660-2247-4169-be60-72da7b1489fa", "sighting_of_ref": "indicator--c12fe71e-6ca6-4b34-b433-431b0b212b96", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--590845a4-6c57-4b3c-9bd5-7fa910943727", "sighting_of_ref": "indicator--3abf1f19-3e2e-47c8-a7a2-a1be045def3f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--596a2d73-bde9-49ca-a5db-be3745161f43", "sighting_of_ref": "indicator--5bfc8000-580a-4bfe-9758-d94af2237203", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29f18657-ff6d-48c6-a003-874ada45ebd1", "sighting_of_ref": "indicator--06846969-e159-42cd-af81-3a5e17445600", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4af99268-7c06-4691-9162-957c4a4885f5", "sighting_of_ref": "indicator--54d10a71-bfc8-4956-be51-78896fe6ffa0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14c36e0a-6414-4b48-bdbd-10c771e958d0", "sighting_of_ref": "indicator--60ae5451-8ee2-426a-b7d6-4b7bb3e4d4c5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f66fd053-f111-49a8-a03b-54706fe93026", "sighting_of_ref": "indicator--7102ac27-805e-440b-b7c4-4d68c3fc94f8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99751ac1-3f7e-45ac-ba25-f96fc13bb27e", "sighting_of_ref": "indicator--2971f2fa-1be5-4010-890f-8afe46ce4cea", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b52df729-8e4c-434c-bbf5-7127b42abcdb", "sighting_of_ref": "indicator--05a9f402-6edf-42e8-9082-97c3458ad361", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1cff31a-04c3-41d5-966f-c7ebfbe2be80", "sighting_of_ref": "indicator--ff784f1b-68c7-4a9c-8d46-9b5615baa015", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ab7fc95-3cb5-45cd-be44-e5f68d3601f4", "sighting_of_ref": "indicator--dba5fb40-ee80-487d-954f-32e07023728e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5d0dd01-a847-4367-8265-bdd5b9efbb88", "sighting_of_ref": "indicator--3b726464-cd07-4f1b-b902-1a5f79d8c325", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76d27481-e69f-444b-9420-b5d1b4f77a96", "sighting_of_ref": "indicator--9ed2676f-4527-43ee-8f2c-c10277481c88", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--819b25bc-f9e9-4521-babd-dd85a87df522", "sighting_of_ref": "indicator--9ed2676f-4527-43ee-8f2c-c10277481c88", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1be91c86-24be-4b99-a9f1-4b289d7cd745", "sighting_of_ref": "indicator--11c0c7d3-dc27-47d2-b07a-63d29b08654d", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da8dcad4-ad3c-4722-b4d5-a988ff994175", "sighting_of_ref": "indicator--9ec68360-28ed-4055-9f2b-34f2d110f970", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c070fe28-0a5b-48b1-97f4-2d61390f348a", "sighting_of_ref": "indicator--5e03f98f-03dd-4733-a0a1-36e8c6758a52", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0704970-b84a-4d55-af0a-34f8e9499063", "sighting_of_ref": "indicator--0c31bc4a-4c2a-4dda-a297-6ee43d39cd54", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1d827ae-c996-4981-9f42-a3e889234b33", "sighting_of_ref": "indicator--bbed9fd6-6da3-46d8-a18d-56cbe2119566", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7be9420-947c-417e-8c66-8d5969bd5300", "sighting_of_ref": "indicator--f355f218-85ff-493d-b31b-ceae74c56675", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--465dcc97-7232-48c0-8dd5-407105aba264", "sighting_of_ref": "indicator--e83009cc-c8fb-43a1-8adc-10043e27cf9c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--246352c5-0aec-4400-9b4a-2270383ce82c", "sighting_of_ref": "indicator--a292ed6f-642e-48c2-a813-0d8b3d78d1e4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f9642ee-13d2-4af4-ac07-76d8be0b5c09", "sighting_of_ref": "indicator--a292ed6f-642e-48c2-a813-0d8b3d78d1e4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdd50b0b-12a4-4bd0-9236-84ef9e17dcf4", "sighting_of_ref": "indicator--be27800a-5e06-4c2d-9270-33952b50a2cc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4e8421f-cad3-46ad-8454-c5f9092222e8", "sighting_of_ref": "indicator--98aa38a0-ba4a-4aef-ab84-2e6a426873dd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d28f6ea-5f5e-4b14-afb5-763ee28a1a0f", "sighting_of_ref": "indicator--a1f9717f-9abe-4360-904c-6602add0224a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--319d1d2d-d4f1-4b87-a1a6-8fa7251a0b8f", "sighting_of_ref": "indicator--d0effba5-418e-4187-938d-85e79f32c84e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bb91db3-195e-4d5a-b4a1-6f7d12397ecf", "sighting_of_ref": "indicator--0d1786d1-caed-45df-a700-fc47eaf37078", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--665242c0-b2d6-4145-bfd1-8aa42b80e8da", "sighting_of_ref": "indicator--814148f0-42b1-4a6d-85d1-b636b1b48415", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fbe741f-cbac-454c-8734-fed05d3eefa1", "sighting_of_ref": "indicator--b7284e9a-5ebf-45d0-8ea7-3c14c202797e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02e11031-ee29-4e7d-927a-d13e68485222", "sighting_of_ref": "indicator--3b784190-ed83-48e7-85ae-773881de3ede", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b0a69ed-1931-4123-ab9d-bf8f12d35731", "sighting_of_ref": "indicator--c6d7d67b-6d84-4e2f-985d-454f8c6a209b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6e86220-b0ab-4c85-ad2a-980df6330eb1", "sighting_of_ref": "indicator--36a4fab2-7c57-4146-a673-20090558bdde", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0d8e957-5428-4238-aa6b-208a560ef3a2", "sighting_of_ref": "indicator--9eb037b2-ac1f-4210-ba0b-9257353737a6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adc2af59-97ba-4b42-acd6-e868f4669107", "sighting_of_ref": "indicator--9eb037b2-ac1f-4210-ba0b-9257353737a6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa25fea9-92b8-402c-b9ec-323b32a6599f", "sighting_of_ref": "indicator--be87464b-208a-466c-b375-1c8af135df2b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52fb7348-06c8-4aa3-a64a-4c192dd884a1", "sighting_of_ref": "indicator--be87464b-208a-466c-b375-1c8af135df2b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e4ed536-c07c-4fdb-afd0-5185cffe1616", "sighting_of_ref": "indicator--18cd34ee-fbf1-4943-aca4-db3fb857f9f2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a874895-e27e-4692-99cd-9aa2cf85e884", "sighting_of_ref": "indicator--cdc8b971-6db3-456b-9704-2b728d92158e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ceaefb72-941a-42f7-95cb-e1fd24796748", "sighting_of_ref": "indicator--cdc8b971-6db3-456b-9704-2b728d92158e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1550da6-9b31-40de-866e-d568e4b974df", "sighting_of_ref": "indicator--4906393b-7edc-4281-b7d5-24fef0489b43", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--480a9074-a88c-4161-8167-1f93beb09e76", "sighting_of_ref": "indicator--fb10de92-1fa8-4278-9cf8-6b4aad3974b8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17513c97-d1f7-43ed-95ea-064f60777641", "sighting_of_ref": "indicator--fb10de92-1fa8-4278-9cf8-6b4aad3974b8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a013c123-4e54-4ae4-9213-dff5c4cfe1cf", "sighting_of_ref": "indicator--2208bf01-df1a-4b4f-9a83-bb8f93ff75f8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b75517bc-bd78-4e52-9ad7-5dbbaa50ac6e", "sighting_of_ref": "indicator--3c6550b5-74f0-46dd-a3c3-6e6ab3a37308", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5848fc5b-d27e-45ef-91b3-64c4a4c798e6", "sighting_of_ref": "indicator--a9ee6fba-162e-4dad-8347-b1d93af9a19f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4680506-8fe3-4018-a2cc-3942725d19de", "sighting_of_ref": "indicator--a9ee6fba-162e-4dad-8347-b1d93af9a19f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56819977-3c76-4d69-973b-f76559b45828", "sighting_of_ref": "indicator--9ca9e9ae-acd3-401d-b55b-54ad0db7f0ec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--404999b5-a6da-4b20-af3a-5e3a7276228b", "sighting_of_ref": "indicator--f6c4e58d-d64d-45df-9676-177eb128b9c9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78d6bc07-16f7-41d7-90ba-71677efe474d", "sighting_of_ref": "indicator--9d1769d2-dffe-43ac-acce-bd63f93b1426", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8591f4ed-d519-4a09-a118-7d8b47df72ba", "sighting_of_ref": "indicator--3cd4cc08-ae59-4e51-b0b0-ca0782e73e03", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d771331-0b84-4bd6-8f53-bd071e1ebc73", "sighting_of_ref": "indicator--3cd4cc08-ae59-4e51-b0b0-ca0782e73e03", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d57e7a19-3cb6-49ef-a599-3333d2f7b93a", "sighting_of_ref": "indicator--478ecea5-7178-4658-bbe4-86ea1875bf58", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3074219-53b5-44ea-af08-fc554019391c", "sighting_of_ref": "indicator--478ecea5-7178-4658-bbe4-86ea1875bf58", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e4812da-fddb-4490-895a-1e9acac4c3a8", "sighting_of_ref": "indicator--7590599c-a6a7-48ff-a39d-a6f10b54b368", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--803d20b5-cb84-4c85-8e8d-1b5a8601648b", "sighting_of_ref": "indicator--52c24a14-97d8-4f0c-a364-f8ea64399173", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--351a1253-a4d6-4614-9e9d-f7bcfe69dc72", "sighting_of_ref": "indicator--5d59f641-a0ab-4d64-8bbe-998b441af1c8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c2f33fd-5abc-4335-b91c-33958f9e2410", "sighting_of_ref": "indicator--5d59f641-a0ab-4d64-8bbe-998b441af1c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--692ea582-2e5f-46d3-bc15-753d1fd147d9", "sighting_of_ref": "indicator--5d59f641-a0ab-4d64-8bbe-998b441af1c8", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebedc41c-abe4-46d8-9d1e-9a62e3609c4f", "sighting_of_ref": "indicator--bc3da0f9-e330-4956-9a94-fbec0ec97924", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f9dae1e-aa40-4fe4-a727-eddb778dd39a", "sighting_of_ref": "indicator--1dcb36d5-1fa0-4656-9831-083860b342bd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38ff3b9f-9e76-4546-8971-0b8b26c8d0dc", "sighting_of_ref": "indicator--9e2c82a2-9432-41ad-b620-770ceb627b1f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a583975-0458-42d1-b682-669ab6448b80", "sighting_of_ref": "indicator--b49ad551-9037-469e-a5a7-a7f1a4f7c345", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--146cc04e-ecde-4338-a3b2-26a050aa19bb", "sighting_of_ref": "indicator--0fa5f0ee-9226-41f3-9a31-0d27608270d0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80700583-4979-4382-acaf-f484e9b990da", "sighting_of_ref": "indicator--6b4c6f15-288b-4e8a-889a-30708521841b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67c399bf-c7fe-4203-b29b-2d140ab9c292", "sighting_of_ref": "indicator--d109b163-7818-4551-a95b-f8d5e39bb687", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2276085e-95c5-4832-89c4-451c8ca35e4f", "sighting_of_ref": "indicator--72b41b99-4bd8-4f8f-ae30-22a7d8fd209c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76b9e357-f80b-45b8-8c13-a9506cf94e13", "sighting_of_ref": "indicator--c45b2186-517f-4575-9e79-d0232e490daf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c223810-1aa9-452c-926e-f1f1221bf9af", "sighting_of_ref": "indicator--c45b2186-517f-4575-9e79-d0232e490daf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2b9eb3e-5411-4bc1-8d81-635c347692c4", "sighting_of_ref": "indicator--d0015e74-451b-4225-b09c-b0dae5d8da71", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97f41b2f-548a-48a5-ab6a-f055655d65ce", "sighting_of_ref": "indicator--d0015e74-451b-4225-b09c-b0dae5d8da71", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e1e50af-d358-4c6d-84a9-1c014b2cdfdb", "sighting_of_ref": "indicator--0f89ba4a-249a-4fe2-9169-b16c251e1509", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--551ef42f-0492-4db2-b005-b49f75eef961", "sighting_of_ref": "indicator--6d69f77f-2981-4aa3-b968-6316da073ccf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbc08a6d-cc70-4e90-b885-5e577d3f0cc6", "sighting_of_ref": "indicator--59396697-73a9-41c7-ba23-07a7d6da6b66", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d832f6f1-61aa-4ef6-9604-c2b8a38f0c2e", "sighting_of_ref": "indicator--529b57bb-a41b-4f6f-9031-b080eead73b8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12f89c27-d681-4a06-a8f9-fe2a72158c9d", "sighting_of_ref": "indicator--906e7c74-9d2b-401e-8d7d-3e26b152d28c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3942abf-b514-43d8-93c2-a900291be4d3", "sighting_of_ref": "indicator--6b8e240a-9445-4845-9e8e-41f30f7b1a4b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f5a8139-f356-4112-9c00-88ea1cefb162", "sighting_of_ref": "indicator--6b8e240a-9445-4845-9e8e-41f30f7b1a4b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f86a01a0-40f7-44db-bda3-7fd68f46e243", "sighting_of_ref": "indicator--2fd334b1-f818-4890-b6c4-ae40697a6411", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d8db67d-d443-4116-8767-1e6317b84791", "sighting_of_ref": "indicator--2fd334b1-f818-4890-b6c4-ae40697a6411", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7951aea-58a4-4449-b59d-6742e3958dc7", "sighting_of_ref": "indicator--aa46ba1e-068e-4a46-95e8-2ac6b3fe71e7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e648b28f-1116-41bc-b7ac-5556c8a9c9bf", "sighting_of_ref": "indicator--4af4a7ab-c3b0-430c-a9bf-3a2ce28e866e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0a0edd8-6130-4ca6-b412-2bd3abbf9cc0", "sighting_of_ref": "indicator--9ecf43e5-a655-41af-8e81-d03861d34962", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2220a603-ca76-4aef-a68b-91d187d7258b", "sighting_of_ref": "indicator--9ecf43e5-a655-41af-8e81-d03861d34962", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f42aad3-4377-4f87-b9c0-0d9238f7200a", "sighting_of_ref": "indicator--944ef17b-ba03-4cb4-a3c5-a1eee6fad34c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90a25a0b-3f98-4b2f-9887-c7dfbf676405", "sighting_of_ref": "indicator--47426315-59d7-44dd-ba3c-23ff8064e6bd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c42b3a02-6848-4a74-aa9e-179ea3591a0c", "sighting_of_ref": "indicator--42a20dbe-f607-4cdf-b7c5-376ed061a8da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19e64575-9912-42dd-a11c-107299f8b606", "sighting_of_ref": "indicator--9d109339-5b11-46dc-9a6a-ba30717acd16", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cfa21fd-1b89-49ba-ad19-c8e0e71e88bc", "sighting_of_ref": "indicator--9d109339-5b11-46dc-9a6a-ba30717acd16", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6836eed2-7489-4dbb-aff4-b7efaeaa3ad1", "sighting_of_ref": "indicator--f521e2ac-4df5-4bd7-b78a-a064698b0631", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24705dee-12f0-4af2-a5c0-e8979bf8c91a", "sighting_of_ref": "indicator--f521e2ac-4df5-4bd7-b78a-a064698b0631", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--291bf705-02ba-4af4-b7b2-1d5ebb3b6c04", "sighting_of_ref": "indicator--b12b2aae-865e-48a2-afdd-5b58aa1ad46e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc1dcf06-3ce0-4e43-9a0d-69d94b4177c1", "sighting_of_ref": "indicator--b12b2aae-865e-48a2-afdd-5b58aa1ad46e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eb24381-810d-4eba-8f10-5d449a4ab7f4", "sighting_of_ref": "indicator--c8ebc4d7-37ae-4d40-850c-03c6efef0f3c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d14cb5e4-0c8e-44a8-9ef9-959f8246baf8", "sighting_of_ref": "indicator--c8ebc4d7-37ae-4d40-850c-03c6efef0f3c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b7d8080-cd23-4e72-9567-69c35b600e3f", "sighting_of_ref": "indicator--f2ba980b-5eff-4246-87e1-9c7f5b48261e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9241f85-8f0c-4b13-89e2-de84c9a5cda7", "sighting_of_ref": "indicator--f1da8979-85ff-4f88-bb3f-895b53910604", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c225895a-93bd-43ab-a5ec-39f2e4df88cc", "sighting_of_ref": "indicator--f215b4b6-ad60-4bf3-973d-b5e9b6f0fd77", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f39fb004-63ea-4d58-8ff0-ee330988eae0", "sighting_of_ref": "indicator--f215b4b6-ad60-4bf3-973d-b5e9b6f0fd77", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdd9fca5-3107-4a4d-85fc-39b2f53460c4", "sighting_of_ref": "indicator--a3ef769d-bd7d-4f8a-8f36-1eaeeec688a2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6e13891-a5c4-4570-a87b-2df5e48359f9", "sighting_of_ref": "indicator--a3ef769d-bd7d-4f8a-8f36-1eaeeec688a2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00d21f46-d921-4d62-b7a2-0756f3063cbd", "sighting_of_ref": "indicator--e52b8960-0b94-4603-9fa1-ed9a9c49e8d5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba948abd-8db4-4297-8494-184f236d827d", "sighting_of_ref": "indicator--e52b8960-0b94-4603-9fa1-ed9a9c49e8d5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61043234-dcaa-4c21-95ab-12935f63a8cd", "sighting_of_ref": "indicator--a2f8fbf0-418f-43e4-b5f6-b5fe1d5d5614", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--361b5d97-b108-4882-91fb-a34c1de700b6", "sighting_of_ref": "indicator--a2f8fbf0-418f-43e4-b5f6-b5fe1d5d5614", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--436d525e-84ce-49d5-874f-45cac68320ab", "sighting_of_ref": "indicator--3bb0eb90-5dc6-40dd-8ec3-0d3166ed5e40", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5589cb5-e223-49b3-bd18-267d54751ff6", "sighting_of_ref": "indicator--3bb0eb90-5dc6-40dd-8ec3-0d3166ed5e40", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c7f35ae-b8db-41d7-9e91-62e64e1362d9", "sighting_of_ref": "indicator--2b27236a-9f77-4b6e-9588-b47fb0ce00f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07ed0e65-8207-4862-9cec-d8a05fe991d0", "sighting_of_ref": "indicator--e7bf444b-5206-4dd3-89e3-44583bb9ebe6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b10d5dc-528e-4ecc-b79e-622859c12684", "sighting_of_ref": "indicator--92b4ca67-6034-44fa-aab5-60894ebed2ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a168044-0d83-4347-8192-1e80aeb18fb9", "sighting_of_ref": "indicator--92b4ca67-6034-44fa-aab5-60894ebed2ed", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88376128-fbc9-4d35-b97b-69209c5a277d", "sighting_of_ref": "indicator--bf305b76-4aaa-482c-b59e-d11aaf02a6c2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad848dc7-a328-428e-a7b4-b89a6aa15168", "sighting_of_ref": "indicator--b82f7efa-9553-4c3e-8a05-9eaa95807c59", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d50771f0-afd0-4f28-98d2-2d825dba8840", "sighting_of_ref": "indicator--b82f7efa-9553-4c3e-8a05-9eaa95807c59", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ca4fd0b-aa0f-4bec-8a6c-7a5c2b53fe95", "sighting_of_ref": "indicator--d89d1e5f-3ea9-4540-b3ba-562fc7116cb9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fecde17-a602-4fc7-ad7c-818877e359d1", "sighting_of_ref": "indicator--d89d1e5f-3ea9-4540-b3ba-562fc7116cb9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef1715e1-e0c4-4af4-a4ed-22a5bc11857c", "sighting_of_ref": "indicator--4df891f7-de72-44fd-88ae-ea6bd8881122", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5e7524b-3ee8-4ff4-9c4c-de1d9ad13228", "sighting_of_ref": "indicator--d58e1664-06c2-46eb-9a98-cb53718a34e6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a80d357-8ae6-4ceb-b7e0-d1a5d04ff086", "sighting_of_ref": "indicator--b63cb2fc-1d07-4255-b932-88a345ceef34", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--468824e8-8000-46e5-8e3a-7cf686285d39", "sighting_of_ref": "indicator--023d9323-d887-4c4a-9f4c-dc3ebd103467", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e51b277c-1dff-4228-a3c0-3cca0023803e", "sighting_of_ref": "indicator--023d9323-d887-4c4a-9f4c-dc3ebd103467", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--423b9f10-8fa9-4432-8aa0-c25a8dcbb0f2", "sighting_of_ref": "indicator--9389d793-355c-440e-8d0b-4396b9253a9a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--381dfde8-f99d-4ac1-99ab-7943967d1c37", "sighting_of_ref": "indicator--9389d793-355c-440e-8d0b-4396b9253a9a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5d94ac6-06a2-4042-8cdb-f6b31b2a94c5", "sighting_of_ref": "indicator--eee7f7db-7db6-44d2-8e6c-06e3acc4db9c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6320424a-e675-45a7-8aff-99386f7f45cb", "sighting_of_ref": "indicator--eee7f7db-7db6-44d2-8e6c-06e3acc4db9c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6b2373d-a09a-4ebd-81f2-c949c41abbd3", "sighting_of_ref": "indicator--982d324f-16a9-4e4c-b046-58d027e561ad", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d0ff848-633d-4998-9797-69b4d659088f", "sighting_of_ref": "indicator--982d324f-16a9-4e4c-b046-58d027e561ad", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5071e9d5-969f-46fd-9722-66c301636036", "sighting_of_ref": "indicator--b80ca8b4-0183-42e7-8f8a-813c5b8c1fa2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73426e12-47ad-4b38-a415-98f91d1a6f17", "sighting_of_ref": "indicator--b80ca8b4-0183-42e7-8f8a-813c5b8c1fa2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c1cca9b-62cf-487b-89d6-fbcaa1eb7a96", "sighting_of_ref": "indicator--d67b1cf4-c616-4d1e-bbc0-ac13ee205fa5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ef4d315-fdc6-453e-8e79-53c94cd04584", "sighting_of_ref": "indicator--d67b1cf4-c616-4d1e-bbc0-ac13ee205fa5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcb027a1-c333-4a42-ad9a-b21a1f0a0428", "sighting_of_ref": "indicator--9bceb0e5-d52d-43c5-914d-05a15a7dce39", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d06af19d-074e-4372-bb6b-6a93326bda8b", "sighting_of_ref": "indicator--9bceb0e5-d52d-43c5-914d-05a15a7dce39", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d33720a7-4851-41d1-a033-fe43ad73758b", "sighting_of_ref": "indicator--173da8c8-c9d0-45b3-8657-23f656e217f7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ce2979a-0510-4e82-a5d9-9c9025351048", "sighting_of_ref": "indicator--173da8c8-c9d0-45b3-8657-23f656e217f7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d42b49ca-aa49-4f57-b625-dce2d4d3cc0a", "sighting_of_ref": "indicator--5fef1778-816c-4ba8-8bbd-f3bf27059c1f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cfc5c0b-4550-4262-9548-7050b7a993b7", "sighting_of_ref": "indicator--89775de2-caf6-46c6-9dae-f3b6b29e4e60", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f451f1b3-7312-40ec-a852-60d699e40fa5", "sighting_of_ref": "indicator--f63c325b-b8da-44c9-b7b4-8012d6e52698", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--918df72a-cf95-4e22-a447-18f2f0a66c2b", "sighting_of_ref": "indicator--a6b83189-8a96-4ff0-a85a-ca67d09c48ba", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72913fd3-d72b-4a79-8cf7-31bef9920666", "sighting_of_ref": "indicator--105825e1-698a-4696-b3b6-3512339185c8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89b31bda-680c-43ca-9093-f4c41b3af601", "sighting_of_ref": "indicator--105825e1-698a-4696-b3b6-3512339185c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2774e1b-1a83-4b2b-ac04-0a9a7c1a6c4e", "sighting_of_ref": "indicator--5f8461d1-fd32-4050-8283-1deef762dc77", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c52a711-aa2f-44bb-b2fd-7fa2412b8d1a", "sighting_of_ref": "indicator--5f8461d1-fd32-4050-8283-1deef762dc77", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67eab6b6-5d36-49e4-b0db-b178d34d652e", "sighting_of_ref": "indicator--cca1b884-8c84-42e4-9679-fa40ceb841a4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb3a3413-f254-4e61-bd9f-083e102f17cb", "sighting_of_ref": "indicator--cca1b884-8c84-42e4-9679-fa40ceb841a4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a5fe8f2-b12f-4a88-80c0-47fcc78622f0", "sighting_of_ref": "indicator--0b99151f-43a4-4f48-aedd-b747940272bf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecab5c7f-42f8-4b44-865c-466ec31a0396", "sighting_of_ref": "indicator--0b99151f-43a4-4f48-aedd-b747940272bf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13e3db51-d75a-4e1b-a561-84f339e47679", "sighting_of_ref": "indicator--53b7aef3-3286-4f3d-a181-688f2039d1bf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce8f8d02-62ba-4dc9-b390-687d5584163c", "sighting_of_ref": "indicator--53b7aef3-3286-4f3d-a181-688f2039d1bf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c88a9d08-27c4-45bb-97bb-f69e8d2684ac", "sighting_of_ref": "indicator--fafe8589-671e-4ac6-8e8a-ce0531d5a7ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f192978-0245-471e-8153-9cb98bf194a0", "sighting_of_ref": "indicator--fafe8589-671e-4ac6-8e8a-ce0531d5a7ed", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f4548b1-0e67-4db2-9d1e-8f87e7774f10", "sighting_of_ref": "indicator--83aa1b89-6892-4890-871c-63bc215c19c6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c4b897b-b33d-4d49-9bbb-b2eaf32c13fc", "sighting_of_ref": "indicator--83aa1b89-6892-4890-871c-63bc215c19c6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28c72553-b99a-473d-b117-5220ddfce4d0", "sighting_of_ref": "indicator--33687543-6467-4ad1-b8cd-67d9f96759ce", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--202c3a5e-a50a-41d3-8e25-fc3aa283c7bc", "sighting_of_ref": "indicator--33687543-6467-4ad1-b8cd-67d9f96759ce", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--195b4f13-cfa1-4c4a-98cd-8fdc3ae4c736", "sighting_of_ref": "indicator--b0c9142c-ae9a-4de7-874f-40a447d49833", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b83cdb63-ad9d-41ec-afa0-9f50dad7c4cc", "sighting_of_ref": "indicator--b0c9142c-ae9a-4de7-874f-40a447d49833", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5d979ac-c59b-4a64-8c33-cfcf5ceab4ff", "sighting_of_ref": "indicator--2860f6a5-0a68-43cc-9473-55c1f781ec58", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bcc81af-95bc-409f-b906-5fb237b26dc6", "sighting_of_ref": "indicator--2860f6a5-0a68-43cc-9473-55c1f781ec58", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--804a67e6-8795-44e2-b23d-578b772c4cdb", "sighting_of_ref": "indicator--d3437a7d-d015-4498-a9e5-726d3fc5da93", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--698ad920-396f-4f74-881c-ea0982d67c24", "sighting_of_ref": "indicator--d3437a7d-d015-4498-a9e5-726d3fc5da93", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20e21806-f74c-4fec-a185-e0a570ed38cc", "sighting_of_ref": "indicator--b57e052d-fef4-4daf-80da-d653c8d3385c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf939c7b-44ca-42c2-b88d-ba78661de635", "sighting_of_ref": "indicator--b57e052d-fef4-4daf-80da-d653c8d3385c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08f5220c-a321-4beb-8803-2800aa227ba4", "sighting_of_ref": "indicator--c05b9dc9-3532-431c-8f3e-1786ab9d3e8e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e62a68f8-df4b-4e53-96af-8647330348ac", "sighting_of_ref": "indicator--c05b9dc9-3532-431c-8f3e-1786ab9d3e8e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5704788a-91a3-496b-a016-cd146cb0ea13", "sighting_of_ref": "indicator--ff91f25a-57f0-4023-860a-9cc5645cfcd7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68bfdc92-5111-4ac5-a13c-3ce9cf96ffce", "sighting_of_ref": "indicator--ff91f25a-57f0-4023-860a-9cc5645cfcd7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a7327f1-403c-46e3-b3f4-bcb4f429fd7e", "sighting_of_ref": "indicator--55c0a7c1-708a-49a1-9bdf-101fff20e59a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8313e1d6-6393-4177-8280-62e258224164", "sighting_of_ref": "indicator--55c0a7c1-708a-49a1-9bdf-101fff20e59a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93fb6bd7-8fe1-4593-a237-287918b223a3", "sighting_of_ref": "indicator--b4a5bb7e-3ea7-498a-a0b9-ddbdba154d89", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3aa93054-5c13-4f4d-8b0d-c6e1432585c7", "sighting_of_ref": "indicator--b4a5bb7e-3ea7-498a-a0b9-ddbdba154d89", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75000658-cdfc-4794-a671-cf86719cf6ca", "sighting_of_ref": "indicator--2c92ed8d-74a9-489a-87ef-5aa2fb8d8462", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05bc72e4-02c7-4dc6-8097-780928a4c8d4", "sighting_of_ref": "indicator--2c92ed8d-74a9-489a-87ef-5aa2fb8d8462", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--663a8561-9ef6-4327-a00b-56c435954810", "sighting_of_ref": "indicator--a69a5b57-9773-4534-ac0b-d5f57cb3cdb0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f300fa85-7f48-45f5-abf8-b6bbcade060f", "sighting_of_ref": "indicator--8c67a2af-b202-44c1-8a6f-81b4197bb15f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b49f47c1-2e38-46ce-b9ad-33c45cacc771", "sighting_of_ref": "indicator--8c67a2af-b202-44c1-8a6f-81b4197bb15f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c43e9d8-de82-400d-9802-b57920239bdb", "sighting_of_ref": "indicator--67f87c3a-e086-4bae-bc51-bf976a5043c8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5456b423-0b91-4550-b0f0-19d22a1f757b", "sighting_of_ref": "indicator--8269a615-506a-4acd-8560-fda31082edd1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af6517af-87c5-453a-99f1-ebbe5de29f74", "sighting_of_ref": "indicator--8269a615-506a-4acd-8560-fda31082edd1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--105bb3b1-7169-44e8-93f0-12db0e3cb932", "sighting_of_ref": "indicator--93194a53-58d1-4f58-a230-1dc7957e134a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad03e6dc-2252-4d96-b29c-1284dc3f1f25", "sighting_of_ref": "indicator--635d67bd-d202-4051-bb34-e7384b7e7a69", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33016c85-77da-4295-89c0-d7c62f97dccf", "sighting_of_ref": "indicator--46756aae-b1f0-42d9-8bf3-8e5ce4fb7206", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6410d1cb-1c5c-4eaf-bc43-2cc241ea01fe", "sighting_of_ref": "indicator--46756aae-b1f0-42d9-8bf3-8e5ce4fb7206", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--461f760e-071e-4b08-9798-925819c12d49", "sighting_of_ref": "indicator--a53a60de-5904-465d-acdc-f707bde72040", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e33a77a1-56c3-4101-b7de-a1fd5bbcce34", "sighting_of_ref": "indicator--a53a60de-5904-465d-acdc-f707bde72040", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46830951-75b8-4929-ae3f-2978c6decb55", "sighting_of_ref": "indicator--7697e0ab-dbc6-4c02-9366-323ea9da8378", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bd849f9-8bd5-4979-81d8-1a76c970fc06", "sighting_of_ref": "indicator--7697e0ab-dbc6-4c02-9366-323ea9da8378", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a998d8c-59e9-4528-9d5e-976e1f4aaa29", "sighting_of_ref": "indicator--add87e97-12d3-4f35-9c5c-41d6d01819cb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc7a49cc-ed53-4f49-b274-eb13e4403aa6", "sighting_of_ref": "indicator--c3dee5b2-571f-42e6-b304-5c1184e9a5d9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0441a698-4d29-4881-b7a6-4bca61606762", "sighting_of_ref": "indicator--8c871983-d111-4562-ad22-5c3078f1a29b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--848cac95-0cd0-4630-8d1a-60d9c817020a", "sighting_of_ref": "indicator--8c871983-d111-4562-ad22-5c3078f1a29b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd17e47a-0e32-4fef-9315-29b0246fcb7a", "sighting_of_ref": "indicator--02b1442f-8051-4ff7-a112-6ad5bcb4cb4f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f62d761-e39c-46ba-8b96-0bc1eab92408", "sighting_of_ref": "indicator--418e3505-aad8-4d70-a17f-63f0d3e102f3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cad070f-365e-4ba6-ad68-3db626ed5db8", "sighting_of_ref": "indicator--418e3505-aad8-4d70-a17f-63f0d3e102f3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e83bd70-2d77-4655-b7f3-5e370a14aaf6", "sighting_of_ref": "indicator--51ed9d3a-8400-4b9b-9e55-b8b720e68f6f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e76bfb4-f670-4ae9-89f9-e37c8c9be82f", "sighting_of_ref": "indicator--b6fa97c7-c74c-4bb9-895e-b6705ce2b56f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a2277c7-5a60-42cb-a1ba-ecddffd6288c", "sighting_of_ref": "indicator--c1642ff9-6b90-4e51-b961-fca086c75336", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11c791db-a2a9-417e-a820-a541ab62085c", "sighting_of_ref": "indicator--3e549311-19f3-45a4-a7ee-ba0913655b08", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ff4e2d5-7e19-477b-84ba-7b6793c8db31", "sighting_of_ref": "indicator--ad6a30ec-f442-4e9c-9429-9c06e03f488e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b48441de-f2c9-41ba-a96b-e481260bc8c2", "sighting_of_ref": "indicator--410b8cb6-fd76-4641-9e85-6045be99a41a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--856a780b-5338-4853-beea-da38d74f6d27", "sighting_of_ref": "indicator--b2720ddc-79f7-40dd-90be-7975c9e90c58", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbbd4628-a038-49ec-a0e0-bc7e051365da", "sighting_of_ref": "indicator--f9a2efed-ecf6-41b7-9360-751e9f1f39a3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e71e257-2c32-417c-ba87-cc5a98b2d822", "sighting_of_ref": "indicator--442594e2-511b-4a3e-9117-417812e69728", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d46497c2-f79b-47c9-826e-e8b912123090", "sighting_of_ref": "indicator--169c1137-711e-493b-bd84-1c235e2217d9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b41326c-734e-4dab-97f2-9fbce74b3685", "sighting_of_ref": "indicator--ae3c0c0c-beb0-4fdf-a8f8-38660f4efa9d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--374cb53a-349d-48f0-a67e-c18b47c08b09", "sighting_of_ref": "indicator--ae3c0c0c-beb0-4fdf-a8f8-38660f4efa9d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2b3a7d3-3f03-40e5-bc4f-d3915f2ed2ac", "sighting_of_ref": "indicator--1c91170c-df8d-4ed0-b5a3-99d22e289e7c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76155b23-05bb-47a2-97d3-cd8393716456", "sighting_of_ref": "indicator--90f7f2ea-9f9f-4009-917c-9c0fe621b1aa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d704dce6-1943-4df5-b967-d7c49cd8357e", "sighting_of_ref": "indicator--fb4d6260-4f44-46e4-afc7-3cc11fc840c6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c395c74-b64c-4b21-8afa-893c8d314eda", "sighting_of_ref": "indicator--0beb3675-1c00-4333-845d-13231ec78fa0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2a03655-e1fe-4428-8d7f-3b450f34794b", "sighting_of_ref": "indicator--7449cbe5-878d-46b1-bfc2-054a0b04a309", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1288ce8-7125-4412-92ef-caad5c5df22f", "sighting_of_ref": "indicator--7449cbe5-878d-46b1-bfc2-054a0b04a309", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8022651a-3293-4f25-9f78-e3aa5e3bae95", "sighting_of_ref": "indicator--36a54d9e-bcf0-43e1-adba-d77feb1d2114", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0918b04-381c-4791-9746-fdb534b917d1", "sighting_of_ref": "indicator--36a54d9e-bcf0-43e1-adba-d77feb1d2114", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bb40442-ecf2-42b5-8f34-bc47c92ba15c", "sighting_of_ref": "indicator--ad260eef-b7ce-446a-928f-edf5f0994dfc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e6908d5-c851-4e2d-b1d1-6d34446e0fb6", "sighting_of_ref": "indicator--b8ed4b86-a162-4da0-b911-742c713d0fe0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb473839-dc52-4d17-87f7-4cee25bd78f7", "sighting_of_ref": "indicator--b8ed4b86-a162-4da0-b911-742c713d0fe0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aec865eb-3f15-45b2-bcfe-42d59bd3373d", "sighting_of_ref": "indicator--9c6c2c4d-ad17-45c4-801d-0898897f64ba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7e8122e-b893-4815-bb96-8b3dfab67783", "sighting_of_ref": "indicator--53507190-802d-4f31-beb3-99db0d14c8ac", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d2a41b7-f1a9-402b-8d91-e03dc1b2da3e", "sighting_of_ref": "indicator--db64baec-b39f-4bdc-985b-1957eec2f7f5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73f91c91-f132-4906-9be7-b6c1c562a31e", "sighting_of_ref": "indicator--1ca1ba1b-3ed0-4db1-9325-98dead5448b0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9df5d2cc-73df-4d49-a13b-7f6b3a27fc27", "sighting_of_ref": "indicator--7cc0385d-7043-4889-b629-29fd03a542a3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aec1c107-8679-4c39-8ad0-ff305d84cd11", "sighting_of_ref": "indicator--53cde69e-1646-4f1a-9bb9-e186afb27b78", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d4f514c-abd1-4a46-8d6b-37b009b88f93", "sighting_of_ref": "indicator--540a90a5-9d4a-49f9-af01-e3779afa9522", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aa37b50-6893-4f15-8956-77bff07801f4", "sighting_of_ref": "indicator--4cf2870e-8480-4eee-a0d6-fa32af60356b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93bcf3c6-9b07-46cd-b684-8deb78015f1f", "sighting_of_ref": "indicator--4cf2870e-8480-4eee-a0d6-fa32af60356b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49fd30d1-31f8-4a61-8a5b-2c8b9b27d4a4", "sighting_of_ref": "indicator--7cfd92b1-0d84-491f-877e-789b6d66696d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d414b12-e947-46dc-adbd-2fe5e6bc60ea", "sighting_of_ref": "indicator--9deef321-096b-414d-b268-662d6c061f55", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7427e525-13d0-4017-ba62-6871aadd6944", "sighting_of_ref": "indicator--5ddf6b2f-4507-45d4-b504-5d0dacf4e5a3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c371a8a1-0cd4-4d95-aadc-5980434a589e", "sighting_of_ref": "indicator--2364af6b-4826-4318-9bc2-fccb29f9e464", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb2d4b9c-002e-4a66-9ffa-12278b561944", "sighting_of_ref": "indicator--de1071fb-a368-4984-b668-7b800a5ea217", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--576b6a35-fde8-43d3-acf0-e09ec61ea67a", "sighting_of_ref": "indicator--a55cca09-a555-4e28-b8c6-5e1e660a88e7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db3dda2a-665b-4468-ae5d-85529e5dfe35", "sighting_of_ref": "indicator--a55cca09-a555-4e28-b8c6-5e1e660a88e7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44ef0b72-77a1-4408-9393-50c47b64f622", "sighting_of_ref": "indicator--5c996c6a-1290-4925-84d3-0e20e9c9bbe4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66539491-a972-4e50-ab82-2cd665431c74", "sighting_of_ref": "indicator--ded8d64e-3fee-4db4-81ed-e3a044af98e3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38ed7f12-62bd-4d49-b0eb-04228b47d25d", "sighting_of_ref": "indicator--4272b38e-c006-4fba-9b32-68d73cb9f414", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fdbe35d-4cea-43c0-aacd-88713cbd7ed2", "sighting_of_ref": "indicator--5e8cb953-35ec-4cea-b77f-cc8c91c95eaf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3503285e-27c5-4942-9a1c-15b20d0f5e71", "sighting_of_ref": "indicator--1bddd9a5-9b26-43c8-afe7-3d54d4219f9e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--daf65b47-14bf-4316-bda1-c915c083d61d", "sighting_of_ref": "indicator--c488528b-8bdc-4844-a145-e4f01f0ba334", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1581bbee-bfe2-4657-8023-ad73ffbf0219", "sighting_of_ref": "indicator--e220caf7-710b-459f-b405-7da1ac06a52e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7591cc7-bca0-4871-8611-1d51a2ac8d1a", "sighting_of_ref": "indicator--199c93bd-05b7-4358-bff8-6291f80693b0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--611e4677-c544-4ee0-bd0b-88b6da79f421", "sighting_of_ref": "indicator--32331da5-3253-4926-a859-032c1e9525ca", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc638ec9-18b4-45cc-9df4-ca5b43609627", "sighting_of_ref": "indicator--2d3f7b2f-d862-4d62-89f2-3d8eec41704f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28eb34ad-47ce-4537-a367-d2b488dc6ede", "sighting_of_ref": "indicator--b94f8117-48f1-4be4-aab4-0eacbd993309", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1158be2d-cb50-4ab3-b4de-99442807b982", "sighting_of_ref": "indicator--b94f8117-48f1-4be4-aab4-0eacbd993309", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd76ff7d-82cf-4c81-a4ca-def250ecfff7", "sighting_of_ref": "indicator--257f5b46-7eb9-4d42-af0b-c4ed156f5527", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b78faac-fbd1-43d2-9603-06d1cadf88a4", "sighting_of_ref": "indicator--7912b52e-7446-4e15-90db-8cec6d6a287e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25080081-547f-4efd-8a1a-9970bc29d079", "sighting_of_ref": "indicator--7912b52e-7446-4e15-90db-8cec6d6a287e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15d38d5b-dd16-4fcb-a438-f8062dabda07", "sighting_of_ref": "indicator--92bf8c31-f8c9-4501-8e42-06caa35e68ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af3ee46f-c702-4e7c-9625-852b3a4babeb", "sighting_of_ref": "indicator--92bf8c31-f8c9-4501-8e42-06caa35e68ed", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b302a6e4-7ff3-45a3-967a-225940049681", "sighting_of_ref": "indicator--2fbf8df7-41a3-4752-89bb-9c994ffea79c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cde0f8c4-fbc2-413c-9098-4e226961ecdb", "sighting_of_ref": "indicator--2fbf8df7-41a3-4752-89bb-9c994ffea79c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ee35cbc-c5cc-40f4-9d0d-9236ee622a6b", "sighting_of_ref": "indicator--76c77247-735f-4baf-b39f-863f259e06f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--832d0db2-54cf-4b4e-aa01-99a67fc50c2a", "sighting_of_ref": "indicator--76c77247-735f-4baf-b39f-863f259e06f0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4a3b23e-32e1-4ebd-871a-4e433e8674cc", "sighting_of_ref": "indicator--56e2e0ed-bf7a-44b3-85c4-b6f57398f5d7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6777f68-65a9-45de-a4b7-1162b44a11b2", "sighting_of_ref": "indicator--b6b12989-1c20-4333-bf72-1687d61fb65e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6aea2a1-36ad-46c1-bac4-651bb080d126", "sighting_of_ref": "indicator--731d75f4-638a-4bce-a31a-b8fbe330b0a5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f54fd76-4597-4c97-a4e3-bbfd8c21c345", "sighting_of_ref": "indicator--731d75f4-638a-4bce-a31a-b8fbe330b0a5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a355891-5fe8-4e4c-8b7b-1c7ea0c7f2be", "sighting_of_ref": "indicator--f590654b-a692-46bb-95c1-6698517e2c09", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d61fd989-7a97-45a3-9109-be54b6cfe109", "sighting_of_ref": "indicator--7dea3157-4d1e-470a-99ce-c6edcecc7169", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62314096-b120-42c9-acc3-dca9acfffa65", "sighting_of_ref": "indicator--015f74b3-3f06-4cf8-99ab-fceb8e323a9e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfa6f19b-d1cd-4cec-9c56-4546cdfd7a51", "sighting_of_ref": "indicator--a6358e94-9b26-4b09-aeaf-284c8a1b02ff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90a5cc6e-5657-4e04-9ebc-1945d936e622", "sighting_of_ref": "indicator--ad7421f6-9718-4c21-9302-8f1053c90ae4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa7a64de-245e-4b54-9d23-0b1d46533049", "sighting_of_ref": "indicator--93a2ea7a-eb72-488b-a5ed-9d893657b7b7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebc8e4a8-2326-454a-9467-7d958792870a", "sighting_of_ref": "indicator--f0a2e73f-0c93-40b4-859e-fc01efc25095", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93b90470-e727-498a-a7ea-ebdd23786605", "sighting_of_ref": "indicator--cfaf5b8b-e764-4163-b9d1-8f9871abb9af", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--111c5e11-aed7-4490-94d0-14b7302a346d", "sighting_of_ref": "indicator--b3fe4e7f-3e2d-4dc4-b885-98c33f93d37d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86a40fa1-2439-4c7b-856b-9bdf92cad6ac", "sighting_of_ref": "indicator--7d11fedf-bd76-4c3d-82b6-837306e90f7c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dae0266f-9ebc-4331-bd44-63d1319a12cb", "sighting_of_ref": "indicator--8e718c1f-2746-4b5a-ae3c-b8beded6f4af", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fba5253-08f9-4971-b0a3-7e93f131e518", "sighting_of_ref": "indicator--c24ad281-5585-4614-bd53-f2d400060da6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--375fc399-e62a-4181-a714-d9b8948d5ed6", "sighting_of_ref": "indicator--e019bb87-1a49-4102-af6e-8c2a65521c25", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20a3545d-032b-4839-91b1-384efcea2431", "sighting_of_ref": "indicator--4f44aa92-d9f1-4b44-b107-4e7d4bd8e6eb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1d43aad-bf51-4cca-8a27-64b26ca55310", "sighting_of_ref": "indicator--fbb4ba03-6ecd-4812-8a7b-08ca9cff5fcb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80290d91-3a43-44b5-9462-383cc4be2def", "sighting_of_ref": "indicator--ec2901c0-ff0c-4a88-b762-1ecdb8c578f3", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7104344a-77db-4e7d-b6c7-285171df9843", "sighting_of_ref": "indicator--d3acbc1a-3aae-41bd-b812-e7c79fdfa9c7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--183434fe-6d82-4541-ba1e-a597b548fa60", "sighting_of_ref": "indicator--6f0a4d8b-8a6b-4fe0-a334-321a6cedf926", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a24fe37-715e-449b-81ac-bfeba2dc5a39", "sighting_of_ref": "indicator--6ae89320-4581-4664-8800-b227d1deae8b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f75e4a1-a09e-4dae-bf43-2cae29f1db52", "sighting_of_ref": "indicator--f6a74a6c-3c86-4019-afc4-e2d463f46970", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1691661b-4d92-4459-867f-02e55aa19705", "sighting_of_ref": "indicator--f6a74a6c-3c86-4019-afc4-e2d463f46970", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cd0f149-f639-4865-b824-89ea9e20227a", "sighting_of_ref": "indicator--8aac4ea2-1393-4f75-9ef5-e0c5661bcd06", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e58a4c44-c0bb-462e-a53b-cfd02720a2e7", "sighting_of_ref": "indicator--9cdb59b3-71a9-457b-8280-a00facfbc521", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e303177-267e-4451-89e1-d5db2a32bfab", "sighting_of_ref": "indicator--e4e13ad5-e34b-4946-9ae1-1282a86ab2a9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccac4804-d25b-45f5-b01a-b2f5974e1285", "sighting_of_ref": "indicator--e880a5f7-546f-44fc-8331-347950416a8c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90ad22e2-370d-4095-9060-b742a92b5148", "sighting_of_ref": "indicator--e880a5f7-546f-44fc-8331-347950416a8c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8985710d-0429-4390-824c-452423dc4641", "sighting_of_ref": "indicator--e0e9eb9f-080c-4274-8cf4-3d5e351112a6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d127d47-1d69-4c4e-9128-ea0ae58036b1", "sighting_of_ref": "indicator--0deb31bd-5ee9-463a-9590-6be2ed848bd3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9d19170-58cd-49c8-87b2-7ec49504dacf", "sighting_of_ref": "indicator--10b88b77-6fdd-4ee0-9a65-3b8ea143f60c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4f98d6b-f594-4f0e-883d-057b7c6ce6ff", "sighting_of_ref": "indicator--797a7243-e533-4cb8-b17e-8ee7f4ed724e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ecb5b8d-96c2-4463-817e-09b2fe15e303", "sighting_of_ref": "indicator--347a7892-dcf1-405c-9abe-2fe333fb568e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--454f8d08-08bd-4803-96d8-9f86b5ac01b2", "sighting_of_ref": "indicator--eff73f0f-ea78-4514-9813-f0705bf69fe5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8fdd73e-7101-4722-bf2f-1bdfa58c1500", "sighting_of_ref": "indicator--a7f64d6c-aa66-4723-8f02-b9f191358b03", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a51b8e22-046a-42cd-a464-3d6a78952b78", "sighting_of_ref": "indicator--695d2d22-c3dc-4894-888d-55131019a15d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74309bbb-15c5-4b22-8b29-6968f9800a88", "sighting_of_ref": "indicator--ce1ee1cc-2d37-42f5-be06-b19371136cc6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12b1cbf1-34c2-4d9d-b3fc-c61b52f467f1", "sighting_of_ref": "indicator--4f365d57-9b41-490a-ac37-7d7149e28028", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0af51b6-141d-453f-be65-15072751ab87", "sighting_of_ref": "indicator--207459fb-e752-4b21-8e4b-1638a2edc09f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af861027-7b1b-468d-8cde-471ae54361ce", "sighting_of_ref": "indicator--414f8022-7c77-4b32-ab1e-7a21b1b2b929", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ab6cd5f-15b7-432e-b5b4-d5cdc95ddc9a", "sighting_of_ref": "indicator--33718fb3-5042-4f27-a64c-900a51c26c35", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45442533-077c-48c6-bdc1-84071049ed87", "sighting_of_ref": "indicator--e9bc78ba-006d-4e85-804d-cbe1bd8cb09a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ab91ebb-708e-40d1-a003-a7831f38ac70", "sighting_of_ref": "indicator--ca2a1ba9-2b4c-4683-b4f9-91087dacb419", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7098ba0-2b3e-4a99-ab2c-5e9c1d715167", "sighting_of_ref": "indicator--5d8ff6a4-2a94-4381-bd42-f02f7b682da3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b1e8d39-0cca-4587-8cc5-11b4091b2894", "sighting_of_ref": "indicator--c8e3a78e-6c76-4868-a1b9-7739c0b76bfc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a310ac8-e94c-4462-9370-7c297ab264b2", "sighting_of_ref": "indicator--60d3a87e-73c1-478a-9343-c694deeeb844", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80c9b49a-8c6a-4f64-ba18-f698989d0ab9", "sighting_of_ref": "indicator--60a9fd50-685d-4914-b24d-f829d279c7b6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6331db1e-364c-48a7-ad5f-d94753e23935", "sighting_of_ref": "indicator--916aebc5-be32-46f2-a4e1-1b5d4f734aa5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77c200e7-7803-4519-92ee-2d4ded6707af", "sighting_of_ref": "indicator--1e9826aa-0381-4c6f-b687-2cdd05876a8b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0abd8a1-af74-4911-8d05-bfe5567a6fa8", "sighting_of_ref": "indicator--1e6773d3-4185-43cf-b5f4-e8d666dec033", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d84c531-3f13-4376-a3ae-a4ae0ffc99bf", "sighting_of_ref": "indicator--1e6773d3-4185-43cf-b5f4-e8d666dec033", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adca22fc-0803-41d9-b7dd-f3ba2ad14b2a", "sighting_of_ref": "indicator--ea1d8117-dabd-4ab2-b44f-82b4481cee87", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a8df96b-a4ea-4dc1-94ad-9fd0f239e311", "sighting_of_ref": "indicator--20c1d870-7e9b-42b6-9028-4e952c9df38c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db172ec9-6d42-46a4-b1ad-669586e0b47b", "sighting_of_ref": "indicator--75613fb4-9f01-4c98-9211-b671d5b66d59", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--513d4be3-162b-460f-85f1-868e568bbf8e", "sighting_of_ref": "indicator--477b2651-238c-483f-a866-d239d9a54e27", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--544c9753-d5f0-4837-b1ea-7e1914b111e6", "sighting_of_ref": "indicator--0c604019-2ad9-4a27-826e-74bec4d2258a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0bb52d0-5c89-43f1-a2d7-cf1e7bb676f3", "sighting_of_ref": "indicator--722a9d39-f47e-4c6c-89e4-51c4745ff59a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff7c4a55-4b4e-4562-a966-f56ee83bf9b3", "sighting_of_ref": "indicator--dfc31261-f8e1-4c4c-8e1c-c0b7d61dfb64", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0deeba0-7b49-4fb2-8256-788735fd0d94", "sighting_of_ref": "indicator--9bfef6b7-2938-4d9b-9738-d610c2572c04", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d59fdd59-eb0e-4f8f-a4d0-9ef190bd94e3", "sighting_of_ref": "indicator--f2d933db-07e5-458f-9267-6c1ccf148a67", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8752b6ac-cf49-4a39-a732-9b5a8295104d", "sighting_of_ref": "indicator--037a9adb-1718-4658-a369-0d7b0baab1b0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8e03b92-2590-4fe3-b18e-530289f86839", "sighting_of_ref": "indicator--869b666b-6550-4e85-9bda-a3c844fb5989", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58fc80e6-a1a9-4e31-a845-efe43c18bcd8", "sighting_of_ref": "indicator--977b0367-ed77-4395-932f-75915079f699", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df01b391-8dde-4607-ad60-ca921d62b3c4", "sighting_of_ref": "indicator--0e85582b-0c3b-45f9-bc81-293c0b1ad408", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9febd48a-1d6f-4859-a263-4aea01822bd7", "sighting_of_ref": "indicator--27f5b52d-48f9-4f34-9720-334bcfc6239d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da1e0eb8-18b9-489f-a529-5624a15b6aed", "sighting_of_ref": "indicator--3230b48d-b5ff-4024-a1f9-54464b84253e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4c3475d-4818-426b-9216-047e60846771", "sighting_of_ref": "indicator--0939a326-4836-46bb-9abc-f09c0b4845ae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e37cea91-7871-45f4-afd4-0f64a882e7de", "sighting_of_ref": "indicator--90f46f30-072d-4a3f-8a59-4920bd58014f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2b444e2-a841-4793-ba4f-615c37298500", "sighting_of_ref": "indicator--4e9179a6-9afd-443f-a7b1-2dd033e5dbec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4d4a0d8-73de-4be8-820c-059fe0bbca8b", "sighting_of_ref": "indicator--8319c65f-d0bb-4f2e-91fd-5770d5141efe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2679dfd3-d6b1-4c35-a021-3570480d6e2b", "sighting_of_ref": "indicator--6627fd0a-c560-4f8c-8205-6c7f63d5b1c7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90bfe507-46e7-4cc2-8446-b6efa5eb5017", "sighting_of_ref": "indicator--bfa4a739-561b-4058-916e-486cc9ca806d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c308c958-be36-4592-9ae4-b7a992dcddee", "sighting_of_ref": "indicator--5a2f4686-ea1b-43af-adf1-d697087c4a2d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7b85c77-6971-4da3-845e-06b934a2ef6c", "sighting_of_ref": "indicator--4dacc00b-2a38-44e3-8b16-f1cdbce4a4b9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44bd6785-eec7-409a-a554-f5fe4f066d2a", "sighting_of_ref": "indicator--1ba13e10-2b05-4772-a155-6f493006e131", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0141b6fa-a722-4a7a-97ea-68a660987d89", "sighting_of_ref": "indicator--d2bdcd5c-9ba4-4b6a-ab10-70b295b24180", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5264fe14-2fca-473e-a50c-ab9c9370eebf", "sighting_of_ref": "indicator--e0d585f1-003e-4aa6-894b-3c907a45330b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7629fac-334c-4e60-8ea3-e852a9d4aab0", "sighting_of_ref": "indicator--fe125228-bf3d-4c6f-a5b8-38395be4569d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4750b050-9e4a-49cd-bba2-3a4eb1fdfd84", "sighting_of_ref": "indicator--d8c7c142-85c1-4fa0-b84a-1757cebebe94", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c29804e-83e1-4d88-a629-aa67beb43ebd", "sighting_of_ref": "indicator--bc08d5c3-e4c7-482f-b2db-ae7ecad10b65", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d73acfb9-249b-4b97-b4b9-06f5f9ed73bb", "sighting_of_ref": "indicator--49b248d4-a54c-4d19-9f5e-6a1db5d172ee", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65398ecb-8427-49ad-b355-80b3af41beb5", "sighting_of_ref": "indicator--0de667d0-88f0-4a19-b4b1-fe6c86478f64", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--753a583f-22bc-4458-a945-849fafd8735d", "sighting_of_ref": "indicator--7a5ba1cb-9a4d-4a49-a5ec-39a7b7eba38a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c154507f-8842-47c6-9354-fa6a42d747c4", "sighting_of_ref": "indicator--d432ebe8-fb98-4784-8e76-d7832252859c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09eb9f3a-3579-40a2-b135-0963057ff147", "sighting_of_ref": "indicator--257611fb-276b-4766-adc1-393fc8ee9c48", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--642e5531-0fc6-4506-a74a-2ac0bd045531", "sighting_of_ref": "indicator--002e5b6e-939c-4e0e-be5b-37a95f5e4d83", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1d0a160-b2af-4214-a07d-ebcbada78a96", "sighting_of_ref": "indicator--7544203e-76ec-48f6-9468-ac43a6794f80", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39e50333-f0f9-41bc-b17a-a15cafdb5cfa", "sighting_of_ref": "indicator--ff3c02b1-b40d-4e64-a307-d8e1ea36c558", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79e18f38-f6f9-49d1-b0d1-86f63c2d50c9", "sighting_of_ref": "indicator--c162bcbe-04be-4b1b-91e4-d12f5458d395", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53ca43b5-2182-4d20-903d-b707612c5e16", "sighting_of_ref": "indicator--319f2e91-bd24-458f-81ca-ec43f9d387b3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4371ac2-1c7b-4c81-9618-ce319867cbe0", "sighting_of_ref": "indicator--417ae414-b706-45ba-8ce3-375aeeb13427", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef065bfb-f01b-4b18-bfc4-2cbed4d67969", "sighting_of_ref": "indicator--72b26bb8-712d-416b-9879-46598a6c5698", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5df55c93-7f8e-46f4-829e-d84802a53fb8", "sighting_of_ref": "indicator--bd2fe0cb-a055-46a5-a4ce-ca80f32410d6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da411bda-1d73-458e-b313-6b7ceabc7fe2", "sighting_of_ref": "indicator--64bf6d3b-e952-4efb-bde5-74ecdb332dec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30b1280b-e12e-4f64-adf3-26e244ca77ea", "sighting_of_ref": "indicator--7c8804a0-de7c-40c8-8e5f-bfa51faee562", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e3ba9c6-078b-4298-8886-4e67c6477023", "sighting_of_ref": "indicator--3ad5733a-dc17-4065-a264-0fd5f312266e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2439d63c-a233-44ef-b102-887dc565f97f", "sighting_of_ref": "indicator--d726e27d-fc25-451f-8029-08ef1cf18073", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6939be1d-42dd-47cd-9739-f3aaa90468e0", "sighting_of_ref": "indicator--301e55b4-73e3-44da-9c10-e0d8d4f781c5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f54700b-0496-4237-89e9-4e8bce01abac", "sighting_of_ref": "indicator--95268472-68ba-4855-881f-a442c76e187d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8858e52-d158-4dd2-8dfe-5c13b81fc689", "sighting_of_ref": "indicator--64970bb6-16de-4007-8e50-033db3083d4f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f74343d-8ebe-43b9-ad41-f9c3d72c0fcb", "sighting_of_ref": "indicator--9b22c21f-012e-4fe0-be66-332e1c6ac8a1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b7a9daa-309c-45d0-9f32-f3ae9f6cb377", "sighting_of_ref": "indicator--c725d272-84c1-4018-8334-33c785c64505", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07b22c6b-4f4b-40a8-83e9-df3b083e7ece", "sighting_of_ref": "indicator--afa673b8-251c-4d1f-8b93-3f2ffd5a547b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d036b51e-83b5-4fcb-95e3-1ef2b42cb241", "sighting_of_ref": "indicator--f5bc7796-fbfa-4ded-b295-bcf696730b66", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4193afd-6df3-4c87-9a6d-816ce52d1795", "sighting_of_ref": "indicator--78c90222-0c41-460d-a3d7-143c2f060e76", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c07ce653-5ba6-44a9-90fd-3de2e63d8236", "sighting_of_ref": "indicator--6f7cebb3-f435-41be-a981-8bd6529b30e7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e09dc57c-f426-4c47-84c4-4fd095cf1ee2", "sighting_of_ref": "indicator--3ba63d63-6d67-4a50-9d69-b856e77f4de3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9b257eb-10b7-4c81-a778-77fcabd2c609", "sighting_of_ref": "indicator--275f80dc-ef80-407a-bbeb-48eaa43d9578", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da715357-0b40-49d5-abf7-0e836ad0f281", "sighting_of_ref": "indicator--da9b5c64-f473-4f1d-b5e0-8bfa02ed391f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--829378b6-d0c9-42ac-89f5-90bb13cf0887", "sighting_of_ref": "indicator--fe044227-97b0-43bb-9265-c617b4c0c8bc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac6ad9f3-47c5-4b04-a8d2-528b0168d609", "sighting_of_ref": "indicator--cb20a752-5a81-4cba-801a-265b91124341", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--243b7380-54af-4f7d-b04f-5ccfab411fbb", "sighting_of_ref": "indicator--f9442c6d-650b-4d0d-bee7-78b068f19500", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7842e009-de0d-43da-8f2d-779359d01e15", "sighting_of_ref": "indicator--e8e04f90-0c9b-40e3-8a4e-71f5fd188520", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77f08c7a-c4bc-448b-a161-8378ca648846", "sighting_of_ref": "indicator--51080415-b7ec-47c5-bc39-f1d32bc82dc3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcd708d5-c9df-41ba-a53f-91058ce54b59", "sighting_of_ref": "indicator--5f9ed1b3-0a79-46a3-b651-b8440545149c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--443c2477-82f5-4bdb-9560-90c7ad7f8fb7", "sighting_of_ref": "indicator--8e098a1e-3146-4221-8503-9dc346ec046a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--092d5e46-c84d-426e-a0c4-cfc2ed96f651", "sighting_of_ref": "indicator--5d1bfce7-8bcf-4c91-af95-2e04726251d9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e8415d9-0880-4798-8d42-ce5ce29d29c4", "sighting_of_ref": "indicator--1b650432-b58a-4a5a-862c-37ee87826927", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2931c14e-7562-4edd-8460-aab847ec5b72", "sighting_of_ref": "indicator--3516c4d7-2552-48cc-a9fc-c5d37c7e73b4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03ae8caf-a986-4234-910f-89fd22146e01", "sighting_of_ref": "indicator--3516c4d7-2552-48cc-a9fc-c5d37c7e73b4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3aa7ec02-141e-47f2-8b82-153abbbd9ad9", "sighting_of_ref": "indicator--4f6e3ac7-fdfb-4a1f-af9f-73d39d1507e4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9a58224-99c5-4933-acee-79f3bb583e9a", "sighting_of_ref": "indicator--53fad511-6709-4477-a504-c170ec70460a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e835df3d-94c8-40d0-bcee-be42281c7b9c", "sighting_of_ref": "indicator--2054aa86-0732-4ca3-9576-36aa1f93418b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbec0ae5-7117-45f9-8de3-07b5affbf1de", "sighting_of_ref": "indicator--bbea968c-4d3a-4328-a131-d3842e1fd288", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3756b1cb-f272-4c85-8c00-bcd93e078108", "sighting_of_ref": "indicator--34012148-44e4-427c-97b2-601ce9c1a437", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2f77ee3-650e-496c-85d9-0deb4b374ca7", "sighting_of_ref": "indicator--6dab1775-a771-42b1-82bd-51b266192ede", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--feee6b73-1afa-448f-a933-c85439173112", "sighting_of_ref": "indicator--e88bec75-8829-4efb-84d4-b26bfb455459", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--466d1304-07bd-4e1d-a369-260d6f4260f8", "sighting_of_ref": "indicator--8ca615a3-3a24-4be7-aba5-7bbb90658ad6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9f8f2f4-c8e9-472d-819c-ab6a0d2b5ded", "sighting_of_ref": "indicator--d5acce5d-ea2c-4050-adea-598a789bd8c7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54c68807-6a01-4977-b817-82ec5a7b0448", "sighting_of_ref": "indicator--8ece4f86-85c4-4945-b2f2-f55783a459bc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72419458-8f4f-471c-a5cf-f34114a9fc75", "sighting_of_ref": "indicator--881e538c-63a8-4f1c-8534-8731279771a8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bfcf221-5ef9-4fe0-9fdb-693379776b49", "sighting_of_ref": "indicator--c05db130-1b32-40ac-a40b-b1baa0b32351", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51d7a5dc-2fc1-4f8c-93d7-812fb89df011", "sighting_of_ref": "indicator--358cc7f5-6019-49dd-8008-32ddaddd791b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--178a65b8-5d56-49b7-a969-22080d49c198", "sighting_of_ref": "indicator--f155140f-a298-46fd-92de-36e8e7afb6ec", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b049da1-deb9-41a1-b8c6-716227bf69a7", "sighting_of_ref": "indicator--c14fb1d9-3bc8-4bd8-8ca0-8051363d3ee8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d8a6190-2d9d-45bd-b6ec-fbbc31a03926", "sighting_of_ref": "indicator--154aa3f3-a7e6-46ac-a5ba-8ca5d15a24cb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c647044-635b-4b63-916a-6510acf71780", "sighting_of_ref": "indicator--54e33369-0034-4eba-8c13-c754ec811aec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9725f657-8c4c-4803-8b17-7d9e97ba32df", "sighting_of_ref": "indicator--06104328-80c0-4749-ba2a-30081592631c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7af4d0b-6837-420a-9797-75e95c3f9a0c", "sighting_of_ref": "indicator--c0988a46-11a7-41b8-a6fe-3abe21d4d2bb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6d1fb1e-0763-485b-8ddf-54190308fc79", "sighting_of_ref": "indicator--9d5be4d5-195b-4b2a-8dce-5d216d38fa5f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2447adef-3d36-4c1a-a75d-755e6364aa09", "sighting_of_ref": "indicator--726f25f0-3962-4fff-9819-0a67504c8595", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc007494-4771-4bea-8cf4-e411de572ef0", "sighting_of_ref": "indicator--fa1536fa-d46c-4256-8e57-1df68a081b0e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28c90eaf-3f44-4a12-a05b-5b996bfb3af9", "sighting_of_ref": "indicator--2f1eeac3-1261-4348-a74d-f32c9ccd3e08", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0498da38-5e34-43ef-8fb1-15f6dd7c16b4", "sighting_of_ref": "indicator--8a1526c0-7738-4f91-80ff-4307f863f978", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1babc4b4-12ea-4795-847c-e889ac6a710d", "sighting_of_ref": "indicator--dd8c0dbf-9bc4-4417-b93c-26378f33730b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4e452be-899e-4c3d-9d66-f1eaedf1fe2d", "sighting_of_ref": "indicator--3bb65455-adf7-4ea4-bd42-ec9c1cb74c9f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ed91fa9-4cb2-4e20-94bc-d9fc88824a8b", "sighting_of_ref": "indicator--2616f1fe-4259-4413-8d2c-6d5abd3c5456", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb4eff69-9250-4455-a643-307d6c991e36", "sighting_of_ref": "indicator--61f0a1af-9605-44cb-b499-81ca2b5f2c22", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--374d8d17-42bc-46e8-9183-26601a4ae6e8", "sighting_of_ref": "indicator--1f276658-7c12-496d-91a4-b0625fa6c0df", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd148bb3-e03c-4615-b2d8-9095b81e9582", "sighting_of_ref": "indicator--de8a1b88-3d50-4a14-bd59-04161fd616c1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da9bd19e-210b-4c18-8776-2f7e8a83feac", "sighting_of_ref": "indicator--70ed2cd8-000d-4635-89c9-5709d9ff8cd8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--421370ed-a0d7-4d2c-8d31-12854daf9b06", "sighting_of_ref": "indicator--fa2ddffd-ffc1-4e81-a7f8-1939004ffc8c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb8238b9-5d76-4be3-9e55-44ed66c627f6", "sighting_of_ref": "indicator--8fa1faeb-d16d-4db6-adc9-7c416fcea86d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3233f2db-5e19-4ddf-9ec3-ccbff18e8410", "sighting_of_ref": "indicator--d79ee5b7-026c-4c88-9fad-a40a3ef4610a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf442e57-313d-4544-8531-8807688051b4", "sighting_of_ref": "indicator--2c980803-6768-444e-a5ee-911555ce1a28", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68f2ab6e-699a-40d4-9236-9b74f7fa4f4b", "sighting_of_ref": "indicator--854dda80-3f1b-4ea5-a058-bd56e34c0f17", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef94a75a-e6cc-4556-be0e-f202f5c51ca4", "sighting_of_ref": "indicator--77be6c07-b1bd-4c86-b857-647334917d72", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e76b855f-a610-4c2f-96cc-832d7f2e8f3b", "sighting_of_ref": "indicator--bb280676-745a-4cf0-a29f-3e8396503775", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94aae54f-4939-4b39-8905-32f89cf30b89", "sighting_of_ref": "indicator--d0c249d3-2d71-47c9-8304-68cd9700924e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58857415-dc4e-4d1e-a140-3e80cf7d4716", "sighting_of_ref": "indicator--c2c16d07-99a4-4b5a-b873-1404723fd2f5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e71bbb0-bb55-485a-8aee-9d4e7426e246", "sighting_of_ref": "indicator--c2c16d07-99a4-4b5a-b873-1404723fd2f5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0ea8efc-045b-4139-b577-c7a10b83c194", "sighting_of_ref": "indicator--bf17b066-3d68-47ed-97ae-fbbc76eb468c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28ef6823-cffc-4e2e-b466-dcfc2b8e873d", "sighting_of_ref": "indicator--86e18e5b-1aed-4266-bdc1-581137a86474", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb45347f-0435-4316-94c8-aa2b4cbd884b", "sighting_of_ref": "indicator--2e895c6f-663a-48a1-b75a-d506faa897c9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--284ddf6c-2510-4d6e-80d0-b2952046923c", "sighting_of_ref": "indicator--30b73bab-a8c1-480c-8c03-1207a5110b1a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7a452bf-14f6-496a-a9f8-743f3d2a3c39", "sighting_of_ref": "indicator--c873795d-0500-41b8-81f2-9c25ad411a63", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3eb86db-90d4-433a-a785-1bf4abc6f090", "sighting_of_ref": "indicator--080bc6eb-6200-40ba-be26-1ebb16c8aca2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebd25da3-218f-4931-9828-6c5bf25a0122", "sighting_of_ref": "indicator--1f3748b9-22f7-4611-a7a9-ee97d54d9a2e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5922799-a9ca-449f-b224-cc4b6732af52", "sighting_of_ref": "indicator--bed64bfd-7471-4d6e-8994-f4de4c25b42b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de134f01-91c7-4c60-9b8e-2c28a26286e6", "sighting_of_ref": "indicator--f9af1f86-3066-47e0-9496-0c1201f98bad", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--251945bb-f04e-40fb-a487-0e222b70f908", "sighting_of_ref": "indicator--0ad86559-030b-49aa-9327-5a988a3fd240", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a3506e7-ced0-45e7-8603-bfde032f6eef", "sighting_of_ref": "indicator--688e2ce7-f851-4c17-8342-d05d3b16f958", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0980dffe-c126-47cc-9c25-c0288a4b2933", "sighting_of_ref": "indicator--5a312305-d4be-4038-9021-c19bd3dbbd6a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb7780ed-feef-4b30-8d3f-1162d1527698", "sighting_of_ref": "indicator--82575e73-cc0d-40e0-bbe3-d99af9a6b1ff", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b23f180-9e53-438f-a79c-150a7e6f43d2", "sighting_of_ref": "indicator--b7d93c1f-83db-48d6-afdb-5a0e01a78aaa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c23f4215-43b8-486b-ac5f-0c0faabe73cb", "sighting_of_ref": "indicator--6ef1a397-c208-4120-80c9-3a951b0d3b1b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af28fcff-50ac-4018-bc7b-65f313e5b2ae", "sighting_of_ref": "indicator--303fd53b-94bb-4a71-8b82-aa270e0f6325", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--164e6626-b619-434c-9500-a64a9b1639a9", "sighting_of_ref": "indicator--617c16d3-1b30-4590-b05c-fc558919b371", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a878dd79-3e1d-4efc-b0c9-59444fd90c31", "sighting_of_ref": "indicator--ad0f093b-9adb-4c51-8460-1bc0e2862275", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2dc46f7-f246-4791-b76f-dd5239c91c75", "sighting_of_ref": "indicator--d46e887f-cfc1-4340-a43f-ad89db3d95fe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca3ba42f-9eb2-4922-9950-aa15620642c9", "sighting_of_ref": "indicator--1184c09e-d303-4038-ba45-635611264350", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b681041d-1147-425d-a3eb-1605e078d9d0", "sighting_of_ref": "indicator--dd4d4b42-16bf-4d61-b98f-4d66f4855a98", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbfcb453-c650-47c0-84fc-78c70dbf67b8", "sighting_of_ref": "indicator--8da9d073-3729-471b-8dc7-0e5bdc6c3a93", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71786537-30e6-4350-9a39-501911ec26c1", "sighting_of_ref": "indicator--16e5f508-00f9-472a-ba00-d887ac4769ab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e52863b7-732d-4cb9-a2de-75c10f799760", "sighting_of_ref": "indicator--38af561e-a0db-43f4-8bbf-246db94f000f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27921ff1-96fb-4079-8e2f-4ee4a9e1f91f", "sighting_of_ref": "indicator--b851f73a-d5b3-4220-afd0-adf6f0a8b3a2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da78fa8a-8554-415a-aeba-f9ec4f1f60c6", "sighting_of_ref": "indicator--249d542d-e43e-498d-8d33-df66752b16a3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2bbd206-d373-452b-8fce-ee43c6a8026b", "sighting_of_ref": "indicator--9d335931-2a5b-47ba-80a9-06efc6c48e21", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fc66459-3483-4e16-b0c1-28071beb33f0", "sighting_of_ref": "indicator--0feac671-b6c3-4384-a434-0ee407a5132b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dd6ca83-d42f-4de1-a425-7906fee9c2de", "sighting_of_ref": "indicator--033e24e1-1b06-4fd4-9b9b-4d757322e442", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2763c7fc-b948-415d-b47d-a874f79e38eb", "sighting_of_ref": "indicator--40e47504-0a3f-4dc2-a7b9-8dc72c8b7973", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5906f928-1a3f-41ef-ba8c-c48757757c93", "sighting_of_ref": "indicator--98599d96-4f39-4fd9-938e-c97359e6a65e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06506249-702d-48a9-9a13-0b7c779921fa", "sighting_of_ref": "indicator--0ec091a5-56e2-4170-a9bc-ae4947461189", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--562f993a-843f-44b5-9406-a63d45420f62", "sighting_of_ref": "indicator--84797526-76ff-41dd-b5c6-14ab46adc4aa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a9bf606-f84e-49a9-8715-ee40026e4db3", "sighting_of_ref": "indicator--9a1b6514-fef1-4943-b714-53b9d98f477a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d406cc2-52e3-4abb-80e1-ac65ed2d6022", "sighting_of_ref": "indicator--56ef7aca-1509-4daa-81ce-35ec4ee86780", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7256d20c-f1a2-4bff-a5f8-f5cd95adfab2", "sighting_of_ref": "indicator--fa31a5ac-eae8-4616-83e4-c32d743e24d0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d246bfb8-2423-4d21-aa2d-cfe0e9d43042", "sighting_of_ref": "indicator--445d3371-3705-44ef-92ec-394a1fa9ae5e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fb0e1c5-3626-442a-b38e-a54eaac9a8a9", "sighting_of_ref": "indicator--a7bd9f4f-8e4a-479e-b899-d0ea757057c3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83bbf34c-22fd-450b-bf77-3175b4b57244", "sighting_of_ref": "indicator--85094e32-ce6b-4217-9278-775c044814ff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--344a9246-c1c1-4ede-b03b-c5b7dc9edf5f", "sighting_of_ref": "indicator--1fb44d41-a450-42de-927a-5d1e09a1dbb9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77138703-ac98-4a90-8cff-6e1a87ddaa93", "sighting_of_ref": "indicator--e62a19f5-f284-496e-926b-b169f7953e29", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4390704-9581-41b4-8cba-1ef37688903f", "sighting_of_ref": "indicator--45554e0d-59cf-493a-9117-054eb679fc8d", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--686a9845-2cfb-462b-bcc7-cd20689ea2df", "sighting_of_ref": "indicator--97da49f2-fdb0-4c79-adc4-d838f5ac84d2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c5cd9fc-ac6b-4784-b6d6-3f8157878d19", "sighting_of_ref": "indicator--6135bc21-7e8b-4d61-aaed-a960f2b9d210", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--113015e5-fd70-4dc6-8026-b9aa4c83492b", "sighting_of_ref": "indicator--549ef6b5-d05b-45bb-8a82-41452760f618", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b28d8a13-20e9-4203-a1b4-6058f5c1644a", "sighting_of_ref": "indicator--ca0d82ea-fca8-407c-8cc2-2c453a60e5b4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c38c60f3-3a15-4cf8-ba9b-65dd2c13ce7e", "sighting_of_ref": "indicator--a4a56f54-2630-44b9-a942-99d643c54ae3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eee92510-b2b0-41d1-8099-58e61aaa932b", "sighting_of_ref": "indicator--247ef457-80a0-4126-846b-5c34db10b612", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba759ed8-beee-4f0b-ab8d-a350b2f7601f", "sighting_of_ref": "indicator--07122956-8970-432d-af88-2d4d72aaef4b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb8f9b23-7c79-4d55-9b90-f201ac1e0cc1", "sighting_of_ref": "indicator--f6dca4f2-8593-41bd-93e7-fd23a9a9a05f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c94b864-27c6-4ba7-9e75-5414263964dc", "sighting_of_ref": "indicator--840d572f-f82f-4477-8673-26e039d73186", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1011007-1905-4579-aaa8-19c39ec1c833", "sighting_of_ref": "indicator--cdfa4896-5f14-40b0-ac0c-869b0ab7f22d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cd89d60-a2be-4023-8801-bb07bb7761fd", "sighting_of_ref": "indicator--2f0a1eeb-b28f-47f7-8652-6daa38a79669", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac654d19-e1c9-4cf0-a87f-cd4a0751a2f5", "sighting_of_ref": "indicator--d2dc8c4c-2e28-47d3-9599-1a4eae8e58e5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd8f62aa-9aa2-4fc0-91ee-2daba09b89c0", "sighting_of_ref": "indicator--771e4140-2568-4c5f-a35a-b4912c74b47c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba83d22b-b28a-445a-9969-fba5509955d2", "sighting_of_ref": "indicator--3df86de5-8fef-4f4d-bf7b-213abdc80fde", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9795f4b5-4dee-47ff-80cd-2a5103605dc1", "sighting_of_ref": "indicator--26ae6deb-425a-498e-b41d-93c9e61c20b5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eecd9d28-4f56-4428-8ba4-a6108c90568f", "sighting_of_ref": "indicator--a06a0b44-686b-4b6b-90a2-08b4755b7f48", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f222455-74e8-4c16-96b9-4fe1fd10af35", "sighting_of_ref": "indicator--25614578-4c32-4c96-8286-2f2bf1b5f1d0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b8cb095-65de-4a89-b7d8-e40d78e679a8", "sighting_of_ref": "indicator--2d80dc3f-5fc8-4b77-bb9b-83ee9e03ad1e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45433f37-3ed3-4be3-a908-5027c5f1a26d", "sighting_of_ref": "indicator--45d2159a-6526-4d46-90d4-f70418ecead3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d974750e-0136-4507-8914-db5c8bfe64e5", "sighting_of_ref": "indicator--941d26c8-ebc4-456a-a95c-d6ef5dfea25d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4de7dcb1-8494-4f2b-b2ae-7fb8fa45b464", "sighting_of_ref": "indicator--d1e0082e-b1ae-45ea-840e-97f9366ed892", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43701358-2cc0-4eba-b52a-9804941ea863", "sighting_of_ref": "indicator--c005caaa-1729-4b9d-8b69-09ede26828db", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32b9f989-cc7f-41b6-a9b8-087ec1068d1a", "sighting_of_ref": "indicator--050ac85c-92e2-418b-ad3f-40c57ae4cfd5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--855fe2df-0d87-4a92-af18-99e17b57b6c2", "sighting_of_ref": "indicator--f3a611f2-af73-40d7-a241-f57dc944dc27", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca4bd086-3487-44af-88b0-f263d0ca95c0", "sighting_of_ref": "indicator--85fee3eb-88ad-47b1-8188-a6853c3fe11d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6923d4d3-0de2-49f1-a190-672e30b1eea6", "sighting_of_ref": "indicator--1431e4fe-e068-47a1-a8ef-049e84d757d8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd804baf-6013-455d-961a-de85087a776f", "sighting_of_ref": "indicator--2e494ad7-6e74-42dc-ba9e-0304ed53fdea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--736f1cda-b813-43ff-b3f9-1ec6eaabc004", "sighting_of_ref": "indicator--feee5700-b74c-4c28-9586-345c19d70f6f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9c557e3-0bd0-477c-8afb-e419293bd167", "sighting_of_ref": "indicator--910291d6-eba5-42cd-9efe-30452c3c55aa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--163bccf0-d5ae-4cf0-a5c9-5f4363f0a1e4", "sighting_of_ref": "indicator--1f06c3a1-7a04-43f9-9082-af5210fda6f3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84b35f1e-e59f-4546-8ac0-8618f3f17b8a", "sighting_of_ref": "indicator--6977d31f-a882-4d06-901b-2753b99caa56", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d42e24c9-d973-452d-9f4c-0e18f7ffa85d", "sighting_of_ref": "indicator--1969a618-0134-4589-bd0c-a5841c6cf68d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbee9d78-ba39-455f-9277-389d450acc54", "sighting_of_ref": "indicator--fa62b2d6-4be3-4888-9850-9ca4262e9f5c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51b4a399-b711-414a-8ebe-4b21ccaaab9d", "sighting_of_ref": "indicator--4f07af25-c8c7-4ba5-b909-c38daa4cf2df", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1f48b3f-7328-4c94-af43-4ae8aaf1385e", "sighting_of_ref": "indicator--ee2c6af3-5dba-402b-a8c2-530baf5c960b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4b4d9af-60a9-4d59-8b1e-2ac9bff1402b", "sighting_of_ref": "indicator--1297c9a6-d510-451b-bbcc-d63066054ff5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d22e4b35-539a-4cfc-90f1-7422bfe197c5", "sighting_of_ref": "indicator--917e7e1b-4f83-48f1-ad27-7ff79bdbc322", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f585c62-e8cd-4364-80e8-bd780a087dfa", "sighting_of_ref": "indicator--1dad6778-1386-445f-9453-81f53963f828", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48127a98-882c-49c5-8a87-37c3e0cd4885", "sighting_of_ref": "indicator--6d89ebcb-4dbe-49d1-bc78-8715c56df826", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80a124a0-2ae0-492c-907f-bec619805e9b", "sighting_of_ref": "indicator--e04dec67-303c-4d98-97a1-3e4a3266b5a9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--908cd065-e6f8-4abf-a4fe-b41b6d3f42a8", "sighting_of_ref": "indicator--f5b2aad5-af8a-47d3-8b5a-130531a88234", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8bfc104-c7f2-4203-a87f-2ea47e1ce516", "sighting_of_ref": "indicator--6bd51134-ec3e-48cf-8505-1c14aaf99eab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92d0c369-cc1e-4da6-b36b-06b92b3214c9", "sighting_of_ref": "indicator--f5ee9eca-d65b-484b-9cd8-2cf935110e75", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b86ba641-1d8a-4fc7-9b2b-70acaed91a38", "sighting_of_ref": "indicator--33b6c3d8-bb9e-4796-92dc-cae490414f87", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d9b8f07-b32b-4d13-94e1-d9a5292c33db", "sighting_of_ref": "indicator--e26a50d4-a4e7-4ab3-8580-7b6742abc6f6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8443d03f-774b-497d-988e-de9762896ed7", "sighting_of_ref": "indicator--14e0ecc4-88bb-445e-a5ea-bbfd16c96859", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5a56183-f007-4568-b8b7-c80e1704b93b", "sighting_of_ref": "indicator--14e0ecc4-88bb-445e-a5ea-bbfd16c96859", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4864004-a0a1-4df1-9947-c27c1a7220ec", "sighting_of_ref": "indicator--3a6e2307-3ee0-476f-9149-6054eed30b22", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9940f5d6-4418-4d28-b972-8254272a4a2e", "sighting_of_ref": "indicator--30ef0f1d-a1b4-4d12-b115-a362ee648006", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7f0854b-33a9-466e-9cb0-65a3510b3769", "sighting_of_ref": "indicator--ed826b1d-d12c-4139-8fe9-54a127890b1f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88b91bba-a5f6-4ea1-8535-c130ef8c3eb3", "sighting_of_ref": "indicator--f05d922f-6f87-457d-8601-f4530999eed7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cf7be80-0073-4a10-87d4-e4916e32bdbc", "sighting_of_ref": "indicator--1a677fb7-1af6-468c-bb9d-aa38f4cb9283", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f410567-f0d9-417c-b32b-910ab5d25896", "sighting_of_ref": "indicator--9df91021-c29b-4043-80ea-9488d86f0124", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bed75dc6-4889-4297-877f-4050a621c30b", "sighting_of_ref": "indicator--0cf403f5-518a-4c36-89bc-1aaac84fda97", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cb8db17-f2ab-46c6-8a7b-d0044fcb9dab", "sighting_of_ref": "indicator--49e360c9-8cb9-4acc-8d9c-2042ccb9e524", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa8a97a7-1b0c-4b92-9aa9-44db5e46df4b", "sighting_of_ref": "indicator--d805584b-8ca0-486f-9bfb-587f97a9af3f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7974052-2122-431c-b2e8-793c527d4e4b", "sighting_of_ref": "indicator--9ce05063-36dd-4fbb-a102-70b756d178a8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f424067-c46d-4ec6-85dc-63270878ea43", "sighting_of_ref": "indicator--83122efb-214a-4952-8619-c9334291df3c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d5240c6-c636-486d-8602-0e3693918f24", "sighting_of_ref": "indicator--3dbbc355-4e98-43c8-9240-5e493ecc7a66", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85af029b-a22f-44f3-bf92-976fb5a9e089", "sighting_of_ref": "indicator--9897135d-4038-4489-b3b5-8751891bd8a0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--843fd353-d393-426f-8112-491bcaccf438", "sighting_of_ref": "indicator--8f6ad00e-0082-4f47-af14-49e36d741ccc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--032dcca2-e9c3-4b12-badf-bc583bc2b8c0", "sighting_of_ref": "indicator--067703b0-0c29-4f8e-92f4-48b564785a6c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--535ca5c4-b2c3-47a8-bb7f-4a6288947e8e", "sighting_of_ref": "indicator--f605b90c-b2b9-48a0-8479-42eb2a97752d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47dfeb66-0228-4c87-9fd6-b377f8a42cb0", "sighting_of_ref": "indicator--9fc861fa-e002-4d1e-bd6c-b3f6616c3e50", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5133b675-fb43-4c49-8d32-93adfd97d296", "sighting_of_ref": "indicator--8d011b84-7c2f-4748-ac7b-14da7d0a17c6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4100595-df7a-427c-800e-2d8e0006539b", "sighting_of_ref": "indicator--0db53832-717e-4a77-9ca5-3a1978037147", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6959e89e-c5d1-49c1-b31f-5c700263b7f8", "sighting_of_ref": "indicator--f6a8dac5-83e5-47f9-9d55-4271d2b060b3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--630d916a-2593-4d71-a2e0-50fb587b8568", "sighting_of_ref": "indicator--f1baeff9-ef6e-4f87-a2f3-028ca2e40e8b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ab9a8c6-998e-41d3-a278-b96a699bf6cd", "sighting_of_ref": "indicator--16119b93-cd93-4ed9-a92d-3c475513a226", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb1683b3-ade0-4d92-9dfd-3113e2b61040", "sighting_of_ref": "indicator--d6e6fbf3-0511-42f2-a994-fc3990efb22e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e268f95-35d5-417b-ac50-9a1217bb99a7", "sighting_of_ref": "indicator--3f30397d-b4b7-457b-a5d6-7512fa2fb9e2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2764fd1e-7485-406f-9a44-8d4509a1ce7e", "sighting_of_ref": "indicator--003a5c9c-34af-4513-abbc-a1be73f47fb4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a94ddaa6-88fb-4824-8a85-919b7fc96040", "sighting_of_ref": "indicator--df5e2454-55ea-4cd1-8289-cf8f33ebc110", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8c2aeb4-df7e-4ba5-881e-af97fec75bee", "sighting_of_ref": "indicator--86c44e9a-cff7-44ca-b581-47453762b6cc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2aba3b34-a76e-47cf-9449-0fda8b861bf4", "sighting_of_ref": "indicator--d955fa21-4b87-4eac-adc5-26185fb3373c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff952d77-6699-46c9-9d18-b2553ca7d9e1", "sighting_of_ref": "indicator--e7ccd32c-6b29-4221-8f9f-33cf49f6749b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d10554cb-8954-41f9-a2a0-ee8640d8a39d", "sighting_of_ref": "indicator--041a9945-4d92-4136-ac38-eb0d88dd3fa5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0c0b97c-d53f-4901-a214-e3b36ee77c62", "sighting_of_ref": "indicator--44f9d190-1b26-4493-9f0f-76e7ed8382e2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--172b13d9-58ad-4018-b0e6-0827c7ef8c6a", "sighting_of_ref": "indicator--a6a46187-13ee-4105-bd53-ec1953a91d74", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20a0947d-7ae3-429a-a2d3-f2e3b4865958", "sighting_of_ref": "indicator--b06ba918-ef26-4d18-a5a1-45887c823726", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06a7b60c-e693-4935-a580-1b1ef70ae4bb", "sighting_of_ref": "indicator--8610be62-fc2c-4b7f-ac48-3e25971abfd8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebf8c4e6-b9d3-4899-b05b-6b4670129f73", "sighting_of_ref": "indicator--0bf00579-6574-4778-8caa-20115cc59126", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--143359b2-b11b-4fc6-a5c9-edd1dbe7f2e2", "sighting_of_ref": "indicator--0a9ce0e8-6514-454d-8918-7cf41ee0b22d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35bbcea7-3d32-4cee-9fec-bc4cb7a6e8be", "sighting_of_ref": "indicator--7d98445d-6bac-4495-9b5b-fbad210b8a07", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0d3c2c3-2142-4e7b-8f1e-69b80cbe3a5a", "sighting_of_ref": "indicator--cac8f436-4fb0-4fef-8d17-38d65a498cf7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfb08ab0-9a32-4bad-9cd3-1eded45c319b", "sighting_of_ref": "indicator--b9962984-74d1-4b71-a34d-919c57955e75", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd8fb714-357b-4ce1-9844-d1f3c4f0f40f", "sighting_of_ref": "indicator--53e14ff0-bbe9-4590-8c3a-7247d436b5ee", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4becd0b3-b49b-47b0-b589-ed14b6cf2afd", "sighting_of_ref": "indicator--2e3ebd89-2dd5-4c8c-b94d-4584ba07c419", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7982d725-a863-45ea-b23b-19bf8a81221a", "sighting_of_ref": "indicator--b64a65e2-0ff0-4733-b662-5ba89306d565", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4b59b98-0119-48fd-82be-f1e6acdc1461", "sighting_of_ref": "indicator--5362271f-49ab-4474-a2b7-da5d094d73d5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2dfc30de-ee48-4605-9a37-6fb5477b89a1", "sighting_of_ref": "indicator--d2281d89-a183-413b-bb5c-cc99783ece16", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da5616c8-0cf5-4739-84ad-97ec2c22e13f", "sighting_of_ref": "indicator--a1845788-1a5c-4346-9a46-19b12dca1fc8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ca43b85-086d-4801-b5a7-0fe13faa5788", "sighting_of_ref": "indicator--2ed6bb11-fe1c-45b1-b90c-1bf8cdc34b65", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4b98065-258b-43ab-a4b3-73ed36e78bd6", "sighting_of_ref": "indicator--2ed6bb11-fe1c-45b1-b90c-1bf8cdc34b65", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--185c4f6b-fdae-4134-9186-75e8d166efac", "sighting_of_ref": "indicator--d6b289de-e28b-4b1a-b0d1-23a062fcee40", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12eb5588-3c42-40e1-88f9-45eabcb6114a", "sighting_of_ref": "indicator--f5dcdfc4-be84-4bfc-9dbc-82bc8d2e8c8d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07b703be-5eeb-4dd7-8799-b9a72531ee7b", "sighting_of_ref": "indicator--82a852de-4eeb-46c2-82ca-7c8c10083454", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15e4d8e3-f470-48e9-8afc-c1dfba2474ed", "sighting_of_ref": "indicator--eb228582-a508-46e1-b8db-e45953f6a806", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a871e3e8-de87-4ac4-910a-29c760a59219", "sighting_of_ref": "indicator--e08b224d-6583-4780-9c50-8e0e60d3dc32", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--809dd2a4-2e24-4489-af7b-637b0ad1cf27", "sighting_of_ref": "indicator--1f10a35e-9d49-4ebf-a43f-18c737bad7b7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6539f737-389c-41c1-a1d3-6e650e4974e7", "sighting_of_ref": "indicator--ef29844e-da9c-4be5-876b-26b9c483c3d0", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bc71c7a-ea5d-4059-85f2-308a6207941a", "sighting_of_ref": "indicator--c12c26c2-b4dd-4420-b893-18e41aa9e951", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed096fe6-3c20-4106-bb65-97df2dc06063", "sighting_of_ref": "indicator--edb96c6c-2235-4707-9d13-85682edd364a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76739e8d-f035-4b57-b287-db7ee3c4c787", "sighting_of_ref": "indicator--4b874ca6-34e2-4049-b470-646f7146125f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c15ceee8-b7d6-4e0f-b1d2-2533f7c7b09d", "sighting_of_ref": "indicator--383a432c-9977-4c5f-b218-17a84947a9f9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8a1379e-5fb7-4521-8fbc-5615e82f8b91", "sighting_of_ref": "indicator--a18e0e21-1402-45ac-a957-b97048ff4aad", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a77171f-ec15-4f5b-b975-d2cae8802503", "sighting_of_ref": "indicator--71fa3cdc-0d06-48b8-97b8-f46d4abdd2b4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--122eb532-110e-43ec-83d1-27976621e1da", "sighting_of_ref": "indicator--84fa30ce-bb53-48f0-a907-b879ea139e71", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30d17fac-4fd4-4042-a66e-236b202d4c22", "sighting_of_ref": "indicator--73a56906-4744-4b67-b4c8-f881d7bba0d6", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78188842-7623-4b3b-afc8-2688313408af", "sighting_of_ref": "indicator--cf40cfed-6189-461f-8aa0-11fead06e0bd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d43ce87e-585b-4dae-9738-cf3f7238994e", "sighting_of_ref": "indicator--6efbb0b5-e68b-4233-a6e2-37691aa582a3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16f869b1-6af3-44a1-bcd3-9f83774e2ac7", "sighting_of_ref": "indicator--067fe6c6-e3bc-4edc-ba9a-d76a09981fb3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35de17b0-2a46-41e9-8cf7-1bbf2e453063", "sighting_of_ref": "indicator--537a656c-3fd0-40f8-8207-5c916af363b0", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d7d4b54-6ea6-4b1b-a632-76ea9eaa03d0", "sighting_of_ref": "indicator--537a656c-3fd0-40f8-8207-5c916af363b0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8efac0a1-f070-4f98-8795-bdb2a09008b7", "sighting_of_ref": "indicator--41243874-5876-4cbb-b36b-896a16d1a27f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb58ea06-3168-4e21-bcbc-d58a5d7a2e6b", "sighting_of_ref": "indicator--2310d97c-385a-427b-a3d3-42c088ce03ce", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa2eac09-33e7-48dd-97ca-e70b6c0361f0", "sighting_of_ref": "indicator--4a233d54-579e-414f-9936-824c4bf79d09", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae2a63b7-2fb2-4785-b7d9-1077e5431bf6", "sighting_of_ref": "indicator--cd9964c7-1439-4590-a6ed-1a7fc38f1012", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d740152a-ee03-43aa-ba3a-a4753fc854d6", "sighting_of_ref": "indicator--a2d81a11-11c4-42f6-8d44-8b5a7f32ec83", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca32bfcd-1b1f-4df7-96e3-632b1bc79387", "sighting_of_ref": "indicator--a3344382-f64c-4207-ac66-fd8fad7f0a21", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29d48b45-f2c9-4088-9f1c-e93a91bdce80", "sighting_of_ref": "indicator--3294841c-93fd-42f9-a29e-c07d30741477", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4992719e-2e5d-4042-a1ad-e43886bf845b", "sighting_of_ref": "indicator--a439d08d-ce51-4c7f-9597-a8af2ce5dfd9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0d65a9c-1f72-4cb7-9955-84320e2e05d8", "sighting_of_ref": "indicator--a439d08d-ce51-4c7f-9597-a8af2ce5dfd9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10c275db-bbde-4512-a060-cbbeb2e03038", "sighting_of_ref": "indicator--9f4ad67a-fa7f-489a-a835-3caf4c503b66", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b6187b8-83c9-4a2e-860b-373051e151ee", "sighting_of_ref": "indicator--9f4ad67a-fa7f-489a-a835-3caf4c503b66", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--845b9d7b-514e-411f-8ddb-f45646dd7402", "sighting_of_ref": "indicator--b4a421e8-56b5-471a-b08d-87cb48624d5f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--250de749-9fb2-479d-a887-ad1b87531855", "sighting_of_ref": "indicator--b4a421e8-56b5-471a-b08d-87cb48624d5f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed873cdf-ae1e-49c0-b60c-14ae45e1c8ee", "sighting_of_ref": "indicator--561ef2ff-443d-4713-b6c9-45daec635cd9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed414eb6-7abd-423d-bdc5-1c1b77197046", "sighting_of_ref": "indicator--561ef2ff-443d-4713-b6c9-45daec635cd9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1fc572b-4622-4afe-b6b4-18aa8f4ed17a", "sighting_of_ref": "indicator--2f4f0f42-a66e-4cdd-bf90-ff67340ac694", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3f394b1-0c4a-478b-9965-98ddad237b4f", "sighting_of_ref": "indicator--2f4f0f42-a66e-4cdd-bf90-ff67340ac694", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7d0d9e0-fca0-485d-bf5e-51299e26743a", "sighting_of_ref": "indicator--13bc894a-0342-43fd-bf06-a3b6d9843f2a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--167a12d3-0804-4905-b291-bc9d72fc4470", "sighting_of_ref": "indicator--8e09c3b6-d122-45ac-9da6-3dec01187649", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a8ce92a-f9be-4f1c-ae6b-49ec607f34d5", "sighting_of_ref": "indicator--29b567ed-13c1-41b4-aa0c-7c929e37714c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5047ac8d-2b4a-4fe4-ae18-3c69bbe72b16", "sighting_of_ref": "indicator--6a792c31-aa81-4ff5-9b4d-135c31b4e6c1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--199433cc-ff62-4c93-920d-82affd4954c2", "sighting_of_ref": "indicator--6a792c31-aa81-4ff5-9b4d-135c31b4e6c1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd722e9c-9c24-43e1-98c3-b20131dcacbe", "sighting_of_ref": "indicator--1c23d17e-b6ef-470d-bfde-1ecf60a7625a", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cde3e5cc-21bc-40e6-80f7-aaab7e4421c0", "sighting_of_ref": "indicator--c721f16a-36b3-433a-a715-b3b8f4b84bef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90602f09-6db7-465e-826d-279f41fb0312", "sighting_of_ref": "indicator--c721f16a-36b3-433a-a715-b3b8f4b84bef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08bcc87e-1831-47c8-be09-6246df1b9da4", "sighting_of_ref": "indicator--5abeafcf-8995-4809-937d-0cfa6d402cb9", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d398f08a-3021-49bc-863b-f8eb9c0cf21e", "sighting_of_ref": "indicator--74b0659d-9616-4332-a8f9-bcbdf75c0197", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62e8c119-d802-49cc-a248-2fc13adf2890", "sighting_of_ref": "indicator--74b0659d-9616-4332-a8f9-bcbdf75c0197", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0f574fe-42a2-419e-a1a3-44c80c4945b1", "sighting_of_ref": "indicator--02fff4b6-9418-43ca-b6bd-7dd0eccb45b3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--661a22a2-8806-44b6-be14-43b39e952b45", "sighting_of_ref": "indicator--534064f7-e9af-4fb1-9be8-5b5e6eda0c5d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--723f7714-367f-4cde-ae7f-bfb0367bdd0a", "sighting_of_ref": "indicator--ef2d9dbf-5aff-437f-8387-fe614518453f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8e3f6e3-3138-47fe-ac71-71a9d13a6fe0", "sighting_of_ref": "indicator--eba14dec-cac1-4f71-b753-94eb3f4b9cc1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39cb6145-a99e-4a07-9ef6-cb9db8e28e30", "sighting_of_ref": "indicator--ebb1309e-9bf2-4844-9578-03d63e5c5753", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0318d6e3-6e89-4fce-a9af-8d27f67d3f91", "sighting_of_ref": "indicator--e9af9c8e-aa09-40d9-884b-73a06e75c7ba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a8ebcb6-51ba-45fb-b66f-ed48731d8e10", "sighting_of_ref": "indicator--bde6b93b-d4ac-4edb-aca8-ccef33000e30", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67c15b98-e511-4f2a-b98c-b3065e4360a4", "sighting_of_ref": "indicator--787e0a3b-b39f-40c2-ae1b-add007bbd6bb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--011b9eba-4e0e-48b7-b0ee-0b12ca38af42", "sighting_of_ref": "indicator--ce7bf1c9-b083-4246-8df7-c05b40d02450", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29c470f8-9781-4692-b5d2-4b571ea0a281", "sighting_of_ref": "indicator--ce7bf1c9-b083-4246-8df7-c05b40d02450", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e13166e-a970-429c-b36a-1c4a5ca484e8", "sighting_of_ref": "indicator--6b3cd962-6486-4f2d-9f10-507bd8f55ac0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39fab6a5-30b0-4db2-bb6d-93788f8ad68a", "sighting_of_ref": "indicator--6b3cd962-6486-4f2d-9f10-507bd8f55ac0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d991dd59-c8dc-410b-8fa7-d594f13246d5", "sighting_of_ref": "indicator--0563e928-91e6-45fc-940b-ed6b87c2e96c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccb82f14-091f-4dfb-8cfb-a17a91fd0ca8", "sighting_of_ref": "indicator--06d6ad58-79f6-415b-a306-b7396d969a7d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c647685-def8-4404-bee5-082cabb63cc5", "sighting_of_ref": "indicator--06d6ad58-79f6-415b-a306-b7396d969a7d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5632ddbf-b254-4556-a19a-b43d524bd3bc", "sighting_of_ref": "indicator--3342c5a8-5c51-4ca8-b1a1-201634037906", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--735a53fc-531c-49bf-bdf4-265a817ad8c7", "sighting_of_ref": "indicator--3342c5a8-5c51-4ca8-b1a1-201634037906", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d754c2d5-bb94-45f1-831b-e602222b44be", "sighting_of_ref": "indicator--766b71f5-4f52-4f3e-80eb-8bfb6872f8c9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--deb6b549-df54-497c-8c40-ee4f6f2fdd07", "sighting_of_ref": "indicator--58041715-44d1-4882-a893-eb554154f8a9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--544607c7-fb67-4e4f-b229-59a4791e7064", "sighting_of_ref": "indicator--58041715-44d1-4882-a893-eb554154f8a9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a0aac19-0d61-40f2-9d20-c3b1e988464f", "sighting_of_ref": "indicator--0c3a9a1b-d7c4-4278-9ca6-84e248258e38", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92f3c590-164b-4022-85a7-be0d49d97437", "sighting_of_ref": "indicator--0c3a9a1b-d7c4-4278-9ca6-84e248258e38", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c71c796b-53b6-4621-8483-bad76cc3592b", "sighting_of_ref": "indicator--6dfd9636-fae2-4568-8a5e-4fd2be7d4e2d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55557534-07d7-4973-b95b-11dd2f7a99f3", "sighting_of_ref": "indicator--6dfd9636-fae2-4568-8a5e-4fd2be7d4e2d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee2bd0ff-a3d9-4f49-9e41-58c5d556dddd", "sighting_of_ref": "indicator--0861d00a-6e10-43a3-9bc4-4a5b26c6468f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20690cbb-ab3a-4cc7-8c89-9f0cbf89f1ca", "sighting_of_ref": "indicator--2a3abfdb-62b8-46cb-bdae-d44a59876325", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa8534aa-2ec4-45ee-936e-4664cf8513f4", "sighting_of_ref": "indicator--893afcc7-a84b-4c32-9bd5-1d807810392c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2faa2047-6d9f-40b9-a3f4-7f8b8123d722", "sighting_of_ref": "indicator--9e42e6ca-c0d0-42aa-8458-f2d73b596dfa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12a17625-eab3-4891-961c-b150a21df74b", "sighting_of_ref": "indicator--d8d3e0d5-7465-46ab-ab4c-7e7b62d60ed4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b044502-e890-40a9-a790-225f0c75fdb2", "sighting_of_ref": "indicator--e43404e1-6bba-469e-8fd6-78e7c16a6b92", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22e11db5-f2b9-434a-848e-9f4a7bd171a1", "sighting_of_ref": "indicator--1880c082-44db-4fd9-8e07-5090e2666553", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e50bbdae-0ccc-4e06-a411-1643564b46ab", "sighting_of_ref": "indicator--1880c082-44db-4fd9-8e07-5090e2666553", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcdb2d26-2ef3-41dc-bc20-2a62072f0797", "sighting_of_ref": "indicator--d0c83e25-048a-4f10-b07d-ae76c7fafe58", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c8b8623-b6a2-47cd-99e9-b017571438f4", "sighting_of_ref": "indicator--e4ee5b3d-fcca-4f27-a177-92b5b49b297d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc4fc1e5-6d11-416a-ac8d-e4e7ca29d732", "sighting_of_ref": "indicator--3acd0c8d-5fe9-4c3a-8e3c-0a241dd603a0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68776656-482e-4e28-ab33-01380c78aadb", "sighting_of_ref": "indicator--fce39bf8-99c8-4795-89ff-8d9cc37dca54", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8947e1af-0e85-4346-9f55-d0ccf681f6c3", "sighting_of_ref": "indicator--98aaab45-15dc-41e2-b4a1-ea997fd83451", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecb767a5-2898-42ad-8c0a-7c6add5914e0", "sighting_of_ref": "indicator--67fc2994-fa31-45a9-9c66-473d11e45a83", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b84364c-0473-46f4-afee-849c72f5f55c", "sighting_of_ref": "indicator--67fc2994-fa31-45a9-9c66-473d11e45a83", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fffe2d2c-d632-4206-8608-a341dd42ec3f", "sighting_of_ref": "indicator--2624f98f-bd21-4782-be2c-60d65c30f1ea", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f257fa2-603c-4321-abaa-020756bab918", "sighting_of_ref": "indicator--b2591a68-967c-4c65-bab1-cfc19311bf84", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f7eb4fa-9833-405c-bcf1-ade4ca224282", "sighting_of_ref": "indicator--b2591a68-967c-4c65-bab1-cfc19311bf84", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4416043-b9dd-4ef9-b87d-da9d89c592c0", "sighting_of_ref": "indicator--5923569e-da66-45c7-8096-dfa7b54521c2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1513aef3-e11b-449b-86e1-0b1983e07891", "sighting_of_ref": "indicator--3374ce75-9970-41cc-ade5-92d161cbb8e6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc6e085d-1458-4d06-bf8a-846937c596bd", "sighting_of_ref": "indicator--03731f57-27ec-4a7f-a631-070e54596294", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61400066-077e-4078-8a64-52a5316356d6", "sighting_of_ref": "indicator--a2d2178b-85a4-470b-aeb9-e79e72b84cbc", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ba8f2aa-8ff3-45b5-b38d-3d14ef733ed4", "sighting_of_ref": "indicator--0ee3d7b4-6acb-4d65-8c79-2bc3b5286931", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f877ca4-1f09-43c3-9826-2a8be662517b", "sighting_of_ref": "indicator--13a256f5-1314-4ea9-98db-3916831d6cca", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f4bf8cd-381b-4ce1-8953-e1e3634d7a55", "sighting_of_ref": "indicator--13a256f5-1314-4ea9-98db-3916831d6cca", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7631bbe-dbcf-4f75-938e-58ce552b5822", "sighting_of_ref": "indicator--2b08da49-541e-4320-8db7-fb2badeafb63", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7998c4c1-ecc1-4043-b146-f87e6a387263", "sighting_of_ref": "indicator--2b08da49-541e-4320-8db7-fb2badeafb63", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff597f50-0947-497f-a771-6a109c2de837", "sighting_of_ref": "indicator--040c8f9f-16c4-44b1-a1ad-54684629142f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d49364f-6f38-4d28-a2dc-e655d7a02573", "sighting_of_ref": "indicator--be3883a0-81b1-4717-9c9c-6f840c8d08a1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d3797db-c395-40f0-86d2-1cc32f3e0a66", "sighting_of_ref": "indicator--81249da9-48d9-43f4-84ab-9715f732106a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93744147-0ab4-4950-b11d-0796a517d3e7", "sighting_of_ref": "indicator--81249da9-48d9-43f4-84ab-9715f732106a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e8eeaf4-301f-4dc8-9fdd-57f5bdcd6977", "sighting_of_ref": "indicator--b85baab6-85ed-4d4b-89eb-4c7b52beb7a7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3abc6eff-d0c9-41d7-b7c8-a9345fdb5c59", "sighting_of_ref": "indicator--b85baab6-85ed-4d4b-89eb-4c7b52beb7a7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c836f13f-7a51-498d-ba8e-7a103f50c6bf", "sighting_of_ref": "indicator--0585bf15-d541-40b6-92ec-957886914bb9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18d9bebb-40cf-427e-ae5c-2bcdfb77eb11", "sighting_of_ref": "indicator--1145ef6a-d3bd-415d-a465-8cde1425574e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbc65d82-f97b-4d53-920a-2d4cb5b560b7", "sighting_of_ref": "indicator--fa48c0dc-41ed-485f-a8c5-9d21b639e355", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33e06bbb-4fe4-4ddd-86e7-b8d55d460209", "sighting_of_ref": "indicator--182b76ae-9dc7-465b-a7d8-9deaa1cbde38", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea695e03-2f8e-41a4-8493-c5309344dbff", "sighting_of_ref": "indicator--97154995-f1ea-4a52-9f5f-6bf00c2b8151", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68588f9c-9635-4693-8ae6-bbe1c06a2f68", "sighting_of_ref": "indicator--0c6d8125-d684-4964-8885-12513c07f7f2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f66437ec-a5fd-47f8-854f-95cf10d4fc0e", "sighting_of_ref": "indicator--d6619efc-6520-43a9-82c5-a8bea3d687eb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d7a1bba-d4d9-43dd-a87f-97d9281be72e", "sighting_of_ref": "indicator--12ec1ffc-7833-4422-9fa3-b0e76597376f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--577fadf3-5f40-4e52-a544-899651f92b52", "sighting_of_ref": "indicator--12ec1ffc-7833-4422-9fa3-b0e76597376f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90b841d1-1564-4dc0-8c47-42959e8519fc", "sighting_of_ref": "indicator--c573a998-8b4e-46f4-b423-0cc027452eda", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b25abc34-15ee-4613-8f49-de86e6804019", "sighting_of_ref": "indicator--bdb15d78-0ec1-42fd-bcd3-6c0cd5228d48", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--caa7125c-fd72-4e85-875d-d3ee6cf071a1", "sighting_of_ref": "indicator--77a18766-0ca5-4afb-9ae9-1730b3dd7c7a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3698ed08-585b-458d-b013-f78f1fdf0443", "sighting_of_ref": "indicator--6b53d6a4-15d7-42a2-a5d8-2c5cb2c634c9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e7ca4b7-697f-461c-93d3-886eaef111d5", "sighting_of_ref": "indicator--9152cd82-fd8a-4c17-8676-d9e22593f32b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19c96544-df29-466e-b3e0-dbfbc319f8c8", "sighting_of_ref": "indicator--9152cd82-fd8a-4c17-8676-d9e22593f32b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e305777f-bd68-42ea-8527-045f88bcc649", "sighting_of_ref": "indicator--f73555dc-3afa-44ab-9e5c-33396a1ce339", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4460d73-f261-4623-927c-6e85f729b989", "sighting_of_ref": "indicator--188406db-6fac-4a4d-a2ec-b8401826bfbe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bede3791-a24d-4b39-b2c6-054cca626b75", "sighting_of_ref": "indicator--fd840640-482c-40ae-aafd-ddc5f3ddf53e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70faf74c-762d-4096-9d83-ca202552a2b4", "sighting_of_ref": "indicator--fd840640-482c-40ae-aafd-ddc5f3ddf53e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfd1fb9a-44ed-4919-91b0-c5048f73d1f1", "sighting_of_ref": "indicator--33a0adc8-5a8f-488d-a49e-7e6d4a0de86e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d37ceb0-195d-4a44-b729-b018e7a1fbde", "sighting_of_ref": "indicator--cf69c09e-6339-4ba8-9d6c-2e88a0caa7de", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fef7c057-1e15-474b-bd5a-3f66b970f496", "sighting_of_ref": "indicator--23509097-3ba2-4ac1-9c1a-59a2d10edde5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9243db74-ef22-4c36-8f39-9f99a1522cf3", "sighting_of_ref": "indicator--2994d02a-1b8e-48b8-84ed-9651f3650401", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4179f5b-4882-4ccf-8d00-b4638a439629", "sighting_of_ref": "indicator--a68d2c83-65de-4565-8930-392178b704ec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27a23b94-8cb6-44f1-b9cb-b14cbc7b4b8e", "sighting_of_ref": "indicator--41eed1c4-7200-4033-ba5f-de16d7eddc9e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--904feed5-7ada-4463-94b7-b3425fb14673", "sighting_of_ref": "indicator--fe88e856-2767-4982-a2a3-f8204a55cd97", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b896233e-1185-47da-bcf2-6f7c52cb862c", "sighting_of_ref": "indicator--27146e4f-8bc1-4c8a-abd8-ba6b7a2fcb44", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccf0f30e-792a-4190-9d54-e5e54b4421e9", "sighting_of_ref": "indicator--2f5a07b3-1261-4bc3-a1e5-1ffabe011119", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2070530-ff4b-4c6c-b999-0dedcf3816ea", "sighting_of_ref": "indicator--59fbab07-0e68-4d5e-9918-a537447533d1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5105fdf1-903f-4438-b6e9-6f942182372d", "sighting_of_ref": "indicator--07d33ec8-bb70-4dfe-bdf7-4bed73a521c5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--003c228d-4ec8-4756-90ce-4e21f8bced47", "sighting_of_ref": "indicator--129dc67e-5e75-45d1-b28d-f627298bf99e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c318175-b1fb-4128-9e4d-f876f69b23e9", "sighting_of_ref": "indicator--4de0617e-98aa-42c1-967c-a5d4e429e9fd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9bf0377-60e2-4699-b1e4-baefb94c4e58", "sighting_of_ref": "indicator--7d76c129-b603-4230-9143-5cadadb95f7f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18294434-3e30-4869-9d8f-282610e174e1", "sighting_of_ref": "indicator--4782bf2a-a862-4f72-a8f0-e6316d93c31a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5ee8ecf-ef6e-4b40-8fe5-b19b5f9c5db2", "sighting_of_ref": "indicator--461a2bcb-354e-4a25-a7d8-fb8ee27362ec", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc1ec05b-564b-4ce0-9a01-afa8ef33a91c", "sighting_of_ref": "indicator--74c1a0a6-70c6-4f72-a061-938b4ee4f90c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--368d172a-1bfe-4771-adc6-804b0b246839", "sighting_of_ref": "indicator--2220c3e8-e405-4afe-b4c3-fa4992c54538", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d48894c-5467-4a26-88ae-1fdb385f95e7", "sighting_of_ref": "indicator--3d29301b-ca20-425b-83f5-99a705baa956", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2bed21e-84a0-495a-b445-41a88cf11182", "sighting_of_ref": "indicator--9009e5a9-05fd-4fcb-8222-4842187001ec", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2783d182-d47e-42b8-89e2-972897ab3d5b", "sighting_of_ref": "indicator--e0b693ef-9650-481b-aa1c-eade18773fcc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b13a9a91-71b6-4e59-a758-1c388876a01b", "sighting_of_ref": "indicator--152703a2-dfcb-41ff-a07b-8f0d2d81fe7e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a626c28d-3eb7-4cd6-9006-770f46033617", "sighting_of_ref": "indicator--3dcf68da-0eac-4786-bc3c-ee8a0886f8b8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1606da6e-1ffc-4403-af18-646b93e5d3cc", "sighting_of_ref": "indicator--8f88aa02-e33d-4ac7-a7ab-2ca8d41742ee", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--191d531f-2897-40a6-9877-b60350fd0bfa", "sighting_of_ref": "indicator--b5470c4a-3720-473f-a436-4544e33c3fe7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c34797e4-a64c-4942-8415-82fb9479dfac", "sighting_of_ref": "indicator--b5470c4a-3720-473f-a436-4544e33c3fe7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b20e933-f685-4a3a-a173-d87c53ccb1fd", "sighting_of_ref": "indicator--e997c6fc-c85d-4039-88d8-f3c6d9cf974c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ac85b8e-bc8e-4b52-a740-8a1876da75b3", "sighting_of_ref": "indicator--1d53531e-4aee-4b4a-98c3-db16e659632a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80a33fda-1e99-460e-baf1-4cfa4e189e8f", "sighting_of_ref": "indicator--6b784469-e993-480b-a8ca-51c81a6a13db", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e55db58-131e-410b-8542-66aa9f4c0f75", "sighting_of_ref": "indicator--a675be4c-b013-458d-b4aa-c3bc86aca923", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ba8b6a7-874d-4c27-8f12-0ea2375bd297", "sighting_of_ref": "indicator--c473b92b-0ee0-4a01-be1e-3a83fcd5054d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0319747d-0970-4dc1-9e0b-f8c50c582eac", "sighting_of_ref": "indicator--0cc37c4d-d167-4e98-a95a-775e4ac48dc1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adc06ce7-3569-49f2-abeb-e899ed865ba9", "sighting_of_ref": "indicator--0cc37c4d-d167-4e98-a95a-775e4ac48dc1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0257ad7-7b95-43a9-9a55-b9d667438716", "sighting_of_ref": "indicator--e5c68095-5723-4679-9a6c-49a2f77c0dc8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cbe5e04-70c9-443b-83a6-d63b306b5ea4", "sighting_of_ref": "indicator--5b590cd4-2a39-4cef-ad8b-303a491d6cdd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd425d28-189d-4d97-9f2e-d61812d2f55a", "sighting_of_ref": "indicator--da1ac49a-797c-43cf-bc2e-b08c7bc9516c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efebdf6e-6e8d-4855-b154-ca8904bca6a5", "sighting_of_ref": "indicator--da1ac49a-797c-43cf-bc2e-b08c7bc9516c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f17ab3b-ed84-47fb-9d37-fad22bf09fc7", "sighting_of_ref": "indicator--286e4e0a-52f6-4030-aede-5db2dc16e24e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27190e28-236d-4513-a9f3-846ddea63fcb", "sighting_of_ref": "indicator--ef93c956-0373-49e5-8837-47a9a18aaa4f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2950aff5-dae1-41b0-8226-35b06b2b0b9d", "sighting_of_ref": "indicator--5bf46631-23b2-465c-b863-79ff6915a8ae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba50016d-78a6-4408-97d7-5c51230947ac", "sighting_of_ref": "indicator--cffec1e1-b6f3-4320-bb65-be83673b6c00", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--014dcfe3-7c68-446d-b548-fd60f5c71415", "sighting_of_ref": "indicator--ca8fe609-464d-40ee-827a-9a83b5f3d8d4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baca6aa7-693c-4297-bc2c-8707df7c1a24", "sighting_of_ref": "indicator--ca8fe609-464d-40ee-827a-9a83b5f3d8d4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c37d6f1-6f20-431f-b794-0ee1659ee489", "sighting_of_ref": "indicator--d5fc262d-49b9-46d5-8c19-80584343d4ae", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d223c122-d1ef-4713-a670-26830db2dae8", "sighting_of_ref": "indicator--346ba0a7-b2b9-4abe-a39c-b05c3a66b904", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3775bd12-ef24-4767-ae33-e9697f5ff6b6", "sighting_of_ref": "indicator--e8b93afa-1bf6-46c4-a8a6-3761f3a93828", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50cf3340-1cdc-4972-9336-d8eeb33cfd79", "sighting_of_ref": "indicator--e8b93afa-1bf6-46c4-a8a6-3761f3a93828", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a375bd90-6f74-4dfd-9712-ec89d5110487", "sighting_of_ref": "indicator--5bd28d42-9084-40af-9d56-cc9dc3fe5ced", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b39d612-ec58-4662-87c1-ef6683b8f5a5", "sighting_of_ref": "indicator--e7a53438-438f-4b61-bcee-662d937227b2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df59ca03-9945-4147-bcdb-93dd17b38914", "sighting_of_ref": "indicator--9112e9c7-fcee-4d47-900a-23cd2d92be20", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9f21752-e326-4473-8e58-c3339bf5e1c7", "sighting_of_ref": "indicator--03fc7017-329c-4c31-a8b4-9c6698e663b2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8a03686-14b9-4832-a2a1-26b366733850", "sighting_of_ref": "indicator--b5336a65-9f93-429b-bb56-af371701d5e6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b896fbd-abaf-490b-9ea5-cfed973702fd", "sighting_of_ref": "indicator--c642f240-c8d7-41ea-8203-ed5ebbb7048c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b2e8112-4306-41db-8085-0a5da2f28aa0", "sighting_of_ref": "indicator--c642f240-c8d7-41ea-8203-ed5ebbb7048c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56c7eb3a-a0b5-47d1-b909-c85c4417f64e", "sighting_of_ref": "indicator--5bc4e5e3-7dbe-4a19-b5ec-dfdd30a44453", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09890b5e-87a7-4475-995a-6ba5bcf94461", "sighting_of_ref": "indicator--2a4c8a8a-0686-4a97-a12f-9c071082a54d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d3ba0b7-5e76-4549-bb4d-6bebe3b3e659", "sighting_of_ref": "indicator--6e7f7871-7320-4643-87c7-5b962d426ab3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bc9ed09-7515-47b8-bb65-406e948efd13", "sighting_of_ref": "indicator--9ecffac9-1565-48d1-8bc0-cc64378e9c6b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3641f0c-5e76-4e01-990c-8b4ffbc24f23", "sighting_of_ref": "indicator--5002d195-a732-41af-bb88-978b2a91a117", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e1bfc91-7661-45af-a6fd-f6e1ecf8ee6c", "sighting_of_ref": "indicator--5cdbca27-c13e-429c-90af-f9fbf3fba783", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f46cce7b-eea4-42a3-9c98-b140e9147edc", "sighting_of_ref": "indicator--521dad83-fc55-4aed-abc6-81048d9b9958", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a6a981b-17bd-4ed2-8763-788c9507d572", "sighting_of_ref": "indicator--2eeec665-84a7-4c9d-a32f-4b901e0b861a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69708e6b-c94d-44e9-9802-4589d2dcacaa", "sighting_of_ref": "indicator--f902d093-e732-4c0d-8416-373b8016a0a1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92fca5eb-24ac-4ba4-90d1-cea2238aa571", "sighting_of_ref": "indicator--a079f4d9-1b50-47e1-9bed-b80ede1c5035", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0986862-790b-4dbd-b314-45d511c7f032", "sighting_of_ref": "indicator--89e4895d-4011-4409-beca-0b5f039f01ab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aee7c232-6245-48ef-8e96-2c7ce0662665", "sighting_of_ref": "indicator--89e4895d-4011-4409-beca-0b5f039f01ab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88374afa-1fde-4eea-a12b-d759fe839473", "sighting_of_ref": "indicator--457f9b7c-1533-4101-92bd-7d2e6eb8c950", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29e94579-3265-4c57-bbb1-f20dfec100d5", "sighting_of_ref": "indicator--4e59dcd7-4d5e-44f5-8876-f7d1626c2010", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52990081-a4bd-46b6-bdb5-eb6430423110", "sighting_of_ref": "indicator--45a3c58a-1976-4496-bf59-cd13910accc4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a0fd40f-d508-48b0-a319-aab186fc9763", "sighting_of_ref": "indicator--cf0bbcc3-774d-4668-b83f-80304b05c663", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1697fe5-e251-4afd-bfa7-d631f56d4535", "sighting_of_ref": "indicator--d7c4a8ec-4bea-4671-bfc5-90663803d3db", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db6b2daf-539f-4cd1-a6e0-bf255dc6a263", "sighting_of_ref": "indicator--6624f70f-14fb-427c-8a40-b75b59c923ae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b370ebf3-4167-45c2-8ffe-86e150d2a26f", "sighting_of_ref": "indicator--c05ae1a1-6f32-452c-a494-67e17dae90cd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdb5153e-8305-4365-afea-12665f796392", "sighting_of_ref": "indicator--d95042b1-304d-44b4-ac3f-e0e0bc08138a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8773135-bbdb-4733-8353-63a3901c9767", "sighting_of_ref": "indicator--cb4167a5-ca1c-4061-a35d-1710872adb1f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88aea90b-5ade-42fc-9789-c35fc130df0c", "sighting_of_ref": "indicator--7208aa59-9f8c-4340-ba73-3b8f4080be8b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb95fddb-6099-4e5d-b7b5-e9f384b98a77", "sighting_of_ref": "indicator--1095814d-0b70-4db7-9355-d19984bddfe5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--654d1864-1fe8-4153-b290-f9ccc95e89ac", "sighting_of_ref": "indicator--0b9500be-fc02-4f61-8ef4-70ee8f3861d2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a648dee0-348a-4289-9c35-0836e7241f7b", "sighting_of_ref": "indicator--b30fa78a-d98e-477b-9a49-ffce3ca8f0e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77733dc8-fa59-415e-9311-8e8f5fbaf6ea", "sighting_of_ref": "indicator--29e92f91-51f0-4111-a587-954c623ead23", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f8c53b3-7e1e-4d53-af58-55436399aae3", "sighting_of_ref": "indicator--c384c53c-0b72-4ef6-b3ea-3953f126b028", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46d3e77b-939b-4915-ae86-8b4e204675f4", "sighting_of_ref": "indicator--d3b84a75-b188-45e4-8f86-d5d158508f3a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--210933ad-0c96-4569-8d2f-0904dec70234", "sighting_of_ref": "indicator--00363852-d685-4de4-bbf6-27b1b8d366cb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27e4e67b-ebce-42c4-9ff6-c3830067106d", "sighting_of_ref": "indicator--40214543-5725-4f28-8de4-c7fc2d40ab3d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0fe6133-89ec-4004-9a68-ba3d6c8f98bb", "sighting_of_ref": "indicator--355e846c-1471-45a8-b970-7f61c0974b54", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a9beb49-b8ce-45d1-9785-b45b4acbf801", "sighting_of_ref": "indicator--9fe99b7e-1cec-4c5d-9ddd-2c837b169fe5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84e00175-206a-4243-a268-6d99b030a874", "sighting_of_ref": "indicator--59fd3212-0890-432e-9e8b-34c6a151ba3a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bb1938d-7e84-489f-aa94-0776f61bacf6", "sighting_of_ref": "indicator--6db78fe9-dbc3-404b-93d6-662d02288c10", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02ab56cc-b5e7-410c-a3fa-db47f40858ce", "sighting_of_ref": "indicator--99eaf376-ba80-4efa-acef-40343e6c3a35", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db175746-b736-4654-b772-08a8dc596b25", "sighting_of_ref": "indicator--4b69b272-483c-4191-8f74-2069069487b3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--933cbb29-40d1-42b1-ac3c-e6aee5dd0fb1", "sighting_of_ref": "indicator--07562aae-6d7e-4dab-b465-fcf06827b268", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--551ef286-d27a-4aa7-aafe-1b9808e599d8", "sighting_of_ref": "indicator--321ccc6d-5dca-4a3c-923e-06ae4712e300", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--846b853f-0758-41a3-b1c7-6a5ecf894c92", "sighting_of_ref": "indicator--e35a4bfa-baf0-415d-902d-25f3b81691ef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e224996-4d8d-4031-a1b0-34d6f8e506f0", "sighting_of_ref": "indicator--8060830e-3a7e-492f-bacf-7c5d58e1b6fd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e69d4d56-33a5-470a-bf34-c8a8a83896e5", "sighting_of_ref": "indicator--8060830e-3a7e-492f-bacf-7c5d58e1b6fd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fed55902-3eb2-4b94-89c5-8fc17905fa88", "sighting_of_ref": "indicator--dcacaacb-5386-400f-9da5-6501e99aecfe", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e10f707d-dba1-4d0a-b472-3d9282815bdc", "sighting_of_ref": "indicator--24b1e6ad-0a44-4c5d-8245-b4ecb2eaee64", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8af2d38b-248f-443d-a885-2b6e566b8aca", "sighting_of_ref": "indicator--4b6e86eb-2416-4b3e-a583-09bb80477f82", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89f1a067-a356-4a04-a300-36315a494f4a", "sighting_of_ref": "indicator--e64d3e12-d7b2-4f8b-8748-4ad0cb484faf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c670cfc-5b3c-4f46-a04b-39d6a8b164b4", "sighting_of_ref": "indicator--c5aa16e6-ffde-4509-9d1f-d0b595316033", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d59e7244-814a-465d-801d-221d8ef536f9", "sighting_of_ref": "indicator--a8cf59e5-3724-45a8-9ea6-d13e997339f1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f1b7638-adb3-47ef-a66d-6c5f3fbab368", "sighting_of_ref": "indicator--987c877f-7345-4f13-b10c-265923de99c4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de2ee0bb-1359-4564-9f8f-36602887e14b", "sighting_of_ref": "indicator--ab7746b5-8be9-4102-ade0-cdfee19dfdd1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff92b496-c56c-45fe-a38c-b081172f9200", "sighting_of_ref": "indicator--1d3d6b53-9c01-4c47-a030-20afdeb90556", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--886945fe-ebca-4cf7-8a75-36302d2eef28", "sighting_of_ref": "indicator--940cc451-cef8-4cab-974e-bd95c73b64f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d783089-3960-424f-af9c-a7b0e3c8d91b", "sighting_of_ref": "indicator--8c989230-e844-45b2-bd7b-c3a7809d162c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5ee46e5-7d90-4b13-b777-a4545902ca5e", "sighting_of_ref": "indicator--8a10957d-11a2-4223-8db7-784196bb1896", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f84cee3-5daf-4242-bc7a-2fa361e580f2", "sighting_of_ref": "indicator--d5e71f57-11e5-426d-975a-50fbe7f766c4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a859246-0ae3-44b6-ac9f-f4fc3bc398a6", "sighting_of_ref": "indicator--a1ff2091-6987-4d31-aaa9-0cdb9455f5ac", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2261ebf-a521-40b0-8223-96b71e8a94b9", "sighting_of_ref": "indicator--f165bb5e-1513-45e0-8a67-34ff36192821", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa1c707a-94ab-42d5-adda-0275a519f931", "sighting_of_ref": "indicator--95c4dd05-dd31-43c0-95da-5eaa5981493c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b907e7bb-5d4f-482c-8c33-ec3e27c8b579", "sighting_of_ref": "indicator--d3accba4-28b1-4c50-9d3b-a5dd28f0508a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02bdb095-a644-4e6b-b40c-32464e3b2993", "sighting_of_ref": "indicator--6ab8dfd6-ee5f-43f1-a80c-0de798be3d68", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c290ccc-de3f-41d9-a8e8-a73bf7c16be3", "sighting_of_ref": "indicator--62e3d7cd-78c2-4b39-9aca-cd0d16f37578", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0070ef90-667f-4f01-a365-f7d93cd4b54a", "sighting_of_ref": "indicator--62e3d7cd-78c2-4b39-9aca-cd0d16f37578", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f239d1e-3b9d-4579-a6b7-f50823c553f2", "sighting_of_ref": "indicator--3a109c36-2db1-48ae-b4c8-081db08dc213", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9931239b-72ca-4b48-824e-f65a241937a5", "sighting_of_ref": "indicator--9a652f27-8f69-4ef6-8faf-b79214910247", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5df6e971-5d86-46b2-967b-bee4fd36acc8", "sighting_of_ref": "indicator--9a652f27-8f69-4ef6-8faf-b79214910247", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32151c3a-cb21-47b7-88a8-483611b86130", "sighting_of_ref": "indicator--91711d26-df49-41f7-a86f-2ee0452baa09", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--452ec1bf-a17d-4c9a-9159-cec78f62e933", "sighting_of_ref": "indicator--9743c628-12bd-49b8-9924-fbb12ac9f3c1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe24be1b-cc92-40c9-b9a8-fd476ef2deca", "sighting_of_ref": "indicator--3c149b10-0e62-4207-b2ac-57088f34c9c2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74b4aa6a-70ac-4f76-9417-dc2691ea61ef", "sighting_of_ref": "indicator--3f5d8ee7-336e-4ef2-b894-43f018179c1d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2f4c790-3017-44ac-aca5-59af15597c92", "sighting_of_ref": "indicator--dfc6fe97-6891-474e-ab64-6c6a7d9609e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aed7fdb1-252c-4826-b6d8-6deb20c5b35d", "sighting_of_ref": "indicator--3bb22698-4f2c-415b-8708-702c72eca409", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03230a48-d52e-40f2-ae83-843c54549e54", "sighting_of_ref": "indicator--46a09507-7c6f-4af8-9fde-3855973e1cf7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbeed4a6-1c25-45b2-82d9-bda51a514ebf", "sighting_of_ref": "indicator--de1cdd8b-68ef-4b9e-8568-4c0370d6e428", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05a85d20-2a5b-4328-abab-27d323a31791", "sighting_of_ref": "indicator--407d5938-c896-4d63-8049-60a1019daf29", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a597efad-e996-4a59-b583-06d8bd0ea10f", "sighting_of_ref": "indicator--407d5938-c896-4d63-8049-60a1019daf29", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e73e6e9e-1e08-418b-9492-4c3fc9ab8860", "sighting_of_ref": "indicator--66bcb84f-0b17-488c-bf63-54db42218b89", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9e397ac-4294-41a2-a4a8-76bc19b134c3", "sighting_of_ref": "indicator--612a541d-99c6-4f84-98a9-4749f1a529e4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aad04ead-d28c-4860-ae8c-9d54fa133d05", "sighting_of_ref": "indicator--0c73a590-2830-4aa8-8ad1-90f5d06df30b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ba57fc5-4441-47a3-ab1c-d74c604b1153", "sighting_of_ref": "indicator--bbe4b31b-6547-47f6-b207-154bb86f54e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60a9a972-df16-48bb-ae1f-070dae65f541", "sighting_of_ref": "indicator--89f3b7af-d56f-4000-97c2-b69b2715e06a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cb327c9-7a7a-4540-bff9-6038f0a6fe5d", "sighting_of_ref": "indicator--7d419c07-eb93-4c07-a255-28882a77c77a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--467a096c-0aee-402c-83d4-b90f0d26cff5", "sighting_of_ref": "indicator--d105a93e-f6d9-4e04-9488-3025d7f6ac5e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60bc3495-ae19-40d5-8592-9bb76f1854cc", "sighting_of_ref": "indicator--cc62130f-2701-4446-a277-b899f9d43ead", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85089e51-415f-4acf-9c71-d3531c7bc6f2", "sighting_of_ref": "indicator--137123aa-b63b-47e2-867f-6827f93bbe6a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2312280b-c68b-430f-b773-932cc17658bb", "sighting_of_ref": "indicator--5cb689b4-89be-45da-b829-c3314bd2d82b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e79c6fde-803e-415d-b1ca-71ea4d83ba67", "sighting_of_ref": "indicator--6689159b-7e47-4099-9939-e516c9b91aec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d34a289-bdc6-4f7b-a791-128326e8cf1b", "sighting_of_ref": "indicator--6689159b-7e47-4099-9939-e516c9b91aec", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01f7ca33-d39d-4539-9d1b-5b0de176394a", "sighting_of_ref": "indicator--1d361102-332d-4af2-ad46-3104a37ff4b3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4e9c1de-82d8-4c54-94a5-719d0ec4ad2f", "sighting_of_ref": "indicator--3093950d-ff79-4690-9c14-5587e304a7eb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29657c95-ec93-48a2-8359-0d03b4ef7a05", "sighting_of_ref": "indicator--8698fa65-b33e-44c6-a581-8179edbcfa0f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06d5068a-40ee-48dc-8aa4-cdab406caf06", "sighting_of_ref": "indicator--1446c9cf-9f4a-4099-bd55-b5c6dc30a316", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9388164-ebf4-481d-a8d5-4c790bc19d51", "sighting_of_ref": "indicator--1446c9cf-9f4a-4099-bd55-b5c6dc30a316", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--816e4afd-b57c-406e-ba4f-287190814988", "sighting_of_ref": "indicator--5476d9bf-dbc8-449c-9947-9bfec95556aa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0b9c95f-9d7c-40bc-9c92-d61688b1d1e8", "sighting_of_ref": "indicator--705000d9-b656-4a0b-ad01-9e5f95559490", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96063225-d1a3-4a12-9405-0cf862f15cb8", "sighting_of_ref": "indicator--71dce0de-df00-4680-9218-7385349b67cb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcde2476-6d61-4214-9537-81851e6119cf", "sighting_of_ref": "indicator--2c6c298d-50b7-4da9-ac14-00abeb63620a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03cfcd23-65cf-41a1-9afb-728a5d7153da", "sighting_of_ref": "indicator--a0e298d5-4198-4274-92d6-333b3a90d07a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef5dd419-47d0-4fc2-a700-550edfa7e51d", "sighting_of_ref": "indicator--01a000f8-2e57-4e3a-8b3e-47aab6d04852", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e43e67a-4ea1-41be-8772-900561a8993f", "sighting_of_ref": "indicator--e4c1ad4e-24b9-47ad-b242-cd4efd69d41c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d14d89ee-912e-4d0b-b3c7-c62899d22e2f", "sighting_of_ref": "indicator--e4c1ad4e-24b9-47ad-b242-cd4efd69d41c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5766c8d9-7601-4c15-8895-aaabbc44fcf7", "sighting_of_ref": "indicator--97e5e64f-7313-44d9-9782-0c1df44ee7f5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--194c6340-029e-4dbc-ae91-25d5600ad763", "sighting_of_ref": "indicator--d010cb5a-a0b1-40a7-ac86-096be18d721f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd4ce536-a627-4dff-a8b0-9689a08853fd", "sighting_of_ref": "indicator--cc6e59e3-5291-488d-946f-95b34aa1b69a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45fea301-6b33-4e7c-a0e9-f4037a602125", "sighting_of_ref": "indicator--2150ca8d-563d-4b6b-95eb-220ca7c7e60d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b19908e-f969-41b0-8df7-d6cacbf60885", "sighting_of_ref": "indicator--fa72fd24-c544-439d-b818-91a854e5d64f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--796a3d9a-5d7e-4fb8-a619-46e86a47d965", "sighting_of_ref": "indicator--e0594736-8cd0-41ff-b5df-93698008cd1f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--671d3c48-21c1-448b-84a8-b448301f4abc", "sighting_of_ref": "indicator--3cf21e14-29a7-43f6-ab7b-ad72820a5806", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed187ddd-0dc0-41e8-946c-b37220d90fbe", "sighting_of_ref": "indicator--26266c88-53be-44ad-96ef-2eb02380c200", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61c34ac8-990e-4b2f-8871-4ccc9b5fd1ab", "sighting_of_ref": "indicator--26266c88-53be-44ad-96ef-2eb02380c200", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ab9bfe0-126e-4e79-b3f9-82340df2b3a9", "sighting_of_ref": "indicator--bfcdc257-231b-4272-82e5-77788b73fbbc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc9b28f6-12c4-43b5-914d-ae1ff4ed4e9d", "sighting_of_ref": "indicator--19ea5fd9-cd57-4a84-83d4-4c06ce937a09", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39f84895-07ea-46c4-bf0f-b80bd12ebdbf", "sighting_of_ref": "indicator--91ca8d99-5e5e-4ccd-9603-d81abd6db7b8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8545da9e-b96e-42e4-b1f6-fcc5fe586d5a", "sighting_of_ref": "indicator--bc6a8e5d-b4c6-432d-97be-0e7e14544295", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c9e29cf-c6fa-4d45-bc10-32a7e7479e5c", "sighting_of_ref": "indicator--703b74f7-bcdc-4da6-b31e-49745e053ba6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5b2cc7b-19fb-482b-8fb9-87247f34ad46", "sighting_of_ref": "indicator--703b74f7-bcdc-4da6-b31e-49745e053ba6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4160bdb7-82cc-4469-be56-13f353b6159a", "sighting_of_ref": "indicator--e32c6576-a339-4cc5-bae7-a212238c0e44", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f3ab4e5-8725-4fba-bf95-aefbedc52e5a", "sighting_of_ref": "indicator--0241771a-ecf2-4cab-a04c-fb3c148854a4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60fe66a3-08ae-4216-9e21-983c8ef7f95b", "sighting_of_ref": "indicator--c432a5d4-0eda-4105-97c0-dfb68447932a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f894eb7c-b51e-4293-bb2b-a208a39a8d06", "sighting_of_ref": "indicator--c432a5d4-0eda-4105-97c0-dfb68447932a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3da43fe0-02e8-4e36-93e9-784716688da9", "sighting_of_ref": "indicator--c6c4afec-4c80-48e2-be46-407918a52f4d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc32353e-650a-4b6c-bd36-7ea3e9de1059", "sighting_of_ref": "indicator--0573f73f-ffe7-4514-bd1d-0175f9cea6c0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cef7c0a-a4e2-4e57-a577-ba4a5da614fb", "sighting_of_ref": "indicator--0573f73f-ffe7-4514-bd1d-0175f9cea6c0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--328c263d-094b-4533-8786-d53cde3c3ad1", "sighting_of_ref": "indicator--96a14b38-af73-41e5-9bad-4a2c890e324b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf8297ad-8182-49b4-a7aa-d3db02268985", "sighting_of_ref": "indicator--96a14b38-af73-41e5-9bad-4a2c890e324b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--242675c8-0146-447a-a3a4-e19d60dd50b0", "sighting_of_ref": "indicator--dcb990f7-736b-45e3-b86d-e5a0c022a794", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac90d546-9b66-4c9e-81af-446c86538371", "sighting_of_ref": "indicator--dc44a394-95ae-4c03-ba6b-dc0701312c42", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ad29151-4aed-4357-a95d-4b2d966e17bc", "sighting_of_ref": "indicator--57bc8647-669e-4b4a-a104-aac4895b9ad8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c8f935c-517f-4995-a949-813274a47bbf", "sighting_of_ref": "indicator--25ed4d50-c9b5-4940-9ea3-973d1f5de0b4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--defb8845-2835-4fc0-bac1-97d533e2f8c8", "sighting_of_ref": "indicator--672a61f7-e5c4-4b65-be0b-2f301b9c754d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01f40793-bee5-4b0b-a0ff-d2f66ff385ec", "sighting_of_ref": "indicator--d1777de4-ef47-412c-857b-f2df526a64df", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e1ea168-0406-420d-8f51-ad1aab79d66f", "sighting_of_ref": "indicator--4762155f-8689-4bb5-adc8-b53579462a83", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c35ed6c-aaf3-4a96-8c12-37e36f2d7a5d", "sighting_of_ref": "indicator--25944f2d-a961-4827-bf67-aa011f14c906", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97f5e07b-1630-4a23-b05d-548eacb5a638", "sighting_of_ref": "indicator--b7b9da39-3246-4de4-95e0-4d4b9a295666", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ef47c86-3cd7-4cbf-9e5d-777d0c76636a", "sighting_of_ref": "indicator--b7b9da39-3246-4de4-95e0-4d4b9a295666", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5324e74b-a31a-47d6-9c1f-52fc7a84a78d", "sighting_of_ref": "indicator--9742bc69-1b1f-460b-94ed-d2b83e9c0433", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffced027-330f-4fad-9da2-fa3838af2aa5", "sighting_of_ref": "indicator--5cfcc585-7f1f-4257-9b31-928e32fab88e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--deb8460d-198e-4973-bff2-b7ed5fab1975", "sighting_of_ref": "indicator--9b1f1d06-c9ea-4d5b-92fa-85e1609f8390", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9573f9f9-c288-40d7-b39e-8b70ef16c17b", "sighting_of_ref": "indicator--0d74deb8-4a09-4dd5-9ce7-e77871ef5449", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f431c494-ffa9-49cb-8fdb-1e90fe84df23", "sighting_of_ref": "indicator--bafb640e-0a62-4bec-a7cc-bfbd75a9fae4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d02c3f2-89ad-4d1a-bf85-4b532f7d35f2", "sighting_of_ref": "indicator--f5168e14-71ea-4e33-abdd-417e517bdf01", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fab19b1-015d-48d8-8eaa-9441b1f019f5", "sighting_of_ref": "indicator--5b63f39f-f622-41dd-a4a1-d94d833f98e3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12bd4acb-60e9-41b5-9ebf-e06449401b2d", "sighting_of_ref": "indicator--772d9410-e6f7-413c-92f3-567d9c729c46", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18467a0a-a1b5-4b95-945d-c7f4256a30ba", "sighting_of_ref": "indicator--01443d27-20fc-472d-9c93-b8d380420d2a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d13a57f-028a-4c84-b318-2707e5e430fa", "sighting_of_ref": "indicator--01443d27-20fc-472d-9c93-b8d380420d2a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--931833d3-192d-4906-a287-c360f8fcb5d4", "sighting_of_ref": "indicator--e18806a1-851a-468d-b519-8a1e30e4951c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--063fd3f0-0420-4340-8ef0-f3e52875ce5f", "sighting_of_ref": "indicator--e18806a1-851a-468d-b519-8a1e30e4951c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--060a7eef-841e-4f1e-87c2-48e23f51401b", "sighting_of_ref": "indicator--e409e279-7d47-4209-a391-35b73ee79737", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ae2b116-8fb9-4eaf-a478-62a73971367c", "sighting_of_ref": "indicator--a9ebf7f5-16d3-488c-9b21-779ba4c85265", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66534eeb-1f2b-4086-a68a-e04120b71709", "sighting_of_ref": "indicator--4a6b4e05-69dd-457b-9dd1-f46580afb173", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a1f48cd-1ccd-4db3-8d51-2c19855034d0", "sighting_of_ref": "indicator--0d017793-9511-42fb-b528-2e9a2a9f3cb5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--341c20cd-70a5-4a96-93fb-67e85329c10e", "sighting_of_ref": "indicator--d7b5822a-6c05-41c9-9d8d-e4758fa6a7a4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfd2ad6f-d3c5-4bde-ac53-bbf19e7d1432", "sighting_of_ref": "indicator--6685a25f-0459-4b8b-9115-cf15bbb3759f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c1c8b6b-6ee5-460b-9713-bc7af639ffc2", "sighting_of_ref": "indicator--e7ae619b-0840-4d98-9b6f-a65282364920", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a5a881e-458f-44b7-9263-bf11d949ae6c", "sighting_of_ref": "indicator--4e724aec-58d4-43aa-b4b4-43cd17df61fa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4a1dede-67b8-424b-84e5-12d82a7558f0", "sighting_of_ref": "indicator--ad84c5f4-7c80-4f5c-a42d-a09a057df0cd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7af20852-6c8e-4392-9588-89706584a1ac", "sighting_of_ref": "indicator--d71b22d2-8d2d-4f84-ac28-29c9b8cb916c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f0ce7c8-0a0d-4f6e-93df-311c77a45ff2", "sighting_of_ref": "indicator--344127d1-9c4d-490e-b364-e7ba35d2947a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a595b063-be67-4fd7-994b-fd51996658c7", "sighting_of_ref": "indicator--1d7f4fe9-81f9-4e1e-8df3-70baf14ae9ad", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39e9c640-e7a5-41bd-8bb9-b9981c529afb", "sighting_of_ref": "indicator--40a37d86-df9b-4966-af41-c0ffc94b31e2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83536a87-b806-44f1-84a5-5f930b7b786b", "sighting_of_ref": "indicator--4db394d5-cce6-4693-8ec3-4fed039f01d8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dbec573-bb73-4d1c-a124-6142f0061460", "sighting_of_ref": "indicator--8620f7e1-5362-4be3-969b-f0b3f6658abc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e313fef-f8b2-4b5a-be81-00259b032558", "sighting_of_ref": "indicator--8620f7e1-5362-4be3-969b-f0b3f6658abc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ee38d53-0d6e-4f9d-8a8c-db59edab6eaf", "sighting_of_ref": "indicator--fae489af-9ad0-465c-a81a-9f3f6ae2b4bb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30321b62-54bf-43d6-8be7-a48023f42dc3", "sighting_of_ref": "indicator--fae489af-9ad0-465c-a81a-9f3f6ae2b4bb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--963ce6ad-245f-4698-8da0-fde6c4b1753f", "sighting_of_ref": "indicator--0b2601ed-957c-4dc5-89f2-a3e5f39738cc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9078f1a2-874b-4ba3-a874-c6d25ee84f2f", "sighting_of_ref": "indicator--f8dd980e-b54b-466a-829b-2fdce073894b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffba414b-e624-4bb1-8d00-88b7d81eb25d", "sighting_of_ref": "indicator--c9ccf742-90a2-469c-9471-1c13760ab493", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc80496b-f57d-41bf-a34f-a2e870854330", "sighting_of_ref": "indicator--b318da0a-41b6-458c-befb-fd9d6e6ee242", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbdb7fa1-dc7b-4c96-9866-51db4d376b6a", "sighting_of_ref": "indicator--b318da0a-41b6-458c-befb-fd9d6e6ee242", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f07a119-e413-450d-913c-627f68f92164", "sighting_of_ref": "indicator--3407ea7f-ae81-47cc-ae52-401afc2a66b2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84cf7257-15b0-4d73-b3a6-79fa637687f9", "sighting_of_ref": "indicator--3407ea7f-ae81-47cc-ae52-401afc2a66b2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77582ef5-26ef-4700-94b2-a5a300913c5a", "sighting_of_ref": "indicator--3d71ae09-3bdb-4d08-8ce7-07b5fc016f52", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e24ae971-6447-440b-acd8-323496a7d27b", "sighting_of_ref": "indicator--3d71ae09-3bdb-4d08-8ce7-07b5fc016f52", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38d46d99-06ce-4483-8714-82833017b8d3", "sighting_of_ref": "indicator--ea5a2e0c-9433-4cb8-96a3-027f26b2cd66", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32a01844-ae57-4a68-b10b-8402a78b2fa3", "sighting_of_ref": "indicator--8154aecf-a20f-4dc1-8df3-45464ebe3b2e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--004faf38-fede-4875-8dd9-78964d521e3b", "sighting_of_ref": "indicator--8154aecf-a20f-4dc1-8df3-45464ebe3b2e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abdc28c8-5006-4704-bea8-28bf80e88645", "sighting_of_ref": "indicator--bc95ef00-652e-47e3-98eb-313dfcffb8e8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a3f57d1-de0c-4cba-933e-5d9a84254f0e", "sighting_of_ref": "indicator--7ce93c30-df27-4033-a178-b9e7e8c5e351", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cac1505-cc88-4ae0-8eb7-6a36276a29ab", "sighting_of_ref": "indicator--3fb7c8d4-7179-4499-9d98-b7a9503c4e97", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cf1c1e3-81a4-4f0a-9583-93b9d74cb98e", "sighting_of_ref": "indicator--23cb29ba-da36-4231-b22e-40164c836158", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--689926d9-312c-4ceb-8113-c3f759c4e50b", "sighting_of_ref": "indicator--0d39d42d-6694-408d-b77a-c73d3c3b169c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--572cadc8-0dce-413a-b712-f8b9bb8bfa1b", "sighting_of_ref": "indicator--476c0227-14cd-40ba-81bc-18235d6c49d1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--452502d5-b2fd-44fe-8c65-5f192ba61433", "sighting_of_ref": "indicator--7ca451f2-e050-4d8f-9b10-699110412b93", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7401bb6-7b2f-4e6b-ade0-a60b2843868b", "sighting_of_ref": "indicator--a5abe533-ed4b-4d8f-8d59-e7d59cfb77cc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b4e3032-3324-4ef6-9251-8b97356b98bc", "sighting_of_ref": "indicator--b425d6c4-8983-4fb9-8364-2cf7464d805c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c239876-3ffb-4f2d-a10d-a18dcf9e2a19", "sighting_of_ref": "indicator--58d42271-de1f-49a6-aadf-a22a34408234", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6334038-dada-4f08-900d-f52a8179b330", "sighting_of_ref": "indicator--9a014c92-4801-4b3c-9d27-7d181a4b8777", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--213bd8f4-d014-4f21-bc16-7dd17f865b87", "sighting_of_ref": "indicator--cd33fd48-813e-4141-91ba-8e24cc02aa1c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46e1a0df-6b59-4d44-9ee3-801dd4294652", "sighting_of_ref": "indicator--e48d569c-8472-48a1-ac67-593ea8ba053d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1558a38-f83b-4ea9-9040-055132111392", "sighting_of_ref": "indicator--3548506f-c122-4256-a85c-4f34c94ae48f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ddb979b-1ee5-4616-930f-608230561305", "sighting_of_ref": "indicator--feac29eb-eeaa-48eb-9fe9-f8f726ee1f8c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b10ba4ec-420b-49d3-beea-9f04244af70f", "sighting_of_ref": "indicator--f60ec18d-e623-4c8c-9f4d-a372f4a67931", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e535df17-47fc-47fd-a8e2-3cf49f740660", "sighting_of_ref": "indicator--f60ec18d-e623-4c8c-9f4d-a372f4a67931", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--332d736a-d209-43ce-9a9a-03a7cef55923", "sighting_of_ref": "indicator--3b95938b-6742-40b9-b3f6-bb4a7f27debf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9922de73-fa59-411c-a475-70772836809e", "sighting_of_ref": "indicator--92b80626-6510-4e87-90fd-ed9e0f1bf31e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98db33a1-6eeb-488f-ba6b-93efe4545189", "sighting_of_ref": "indicator--92b80626-6510-4e87-90fd-ed9e0f1bf31e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0430bc4e-8764-41fd-9423-26e8123fe344", "sighting_of_ref": "indicator--ce6b4feb-0bbd-46d5-9aac-967878fd5eb2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1aa98a7-113d-4586-81e6-7d43ffa843ad", "sighting_of_ref": "indicator--5580824a-0507-45cf-a8c4-0f38f419d199", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7190407f-e7e6-4e14-a1a1-010a0759f7fe", "sighting_of_ref": "indicator--5580824a-0507-45cf-a8c4-0f38f419d199", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f42d180a-ecb7-45a9-95af-495bf2e8203f", "sighting_of_ref": "indicator--07cc5fd0-a6e2-451d-a0a2-671be74cb686", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3c4a174-89fd-4494-9421-9a2a4e954a16", "sighting_of_ref": "indicator--8f83c5e3-df10-4d42-8999-3ef833676ed0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a70983c-2b16-4f10-8b59-dd1dcb13cd3d", "sighting_of_ref": "indicator--02b20ff4-c188-49d1-ba68-a90c865f924e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33cd60a7-3877-4263-9270-fbe2d684f99b", "sighting_of_ref": "indicator--9754631b-1a09-4716-a8ce-a46613c35d9d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18298a1a-27da-4045-8c93-c8b43014efa9", "sighting_of_ref": "indicator--91122a14-ba09-4bc3-956b-a2c01be878e0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc6c9aa8-ef50-479e-80b4-f7b468a525ce", "sighting_of_ref": "indicator--a5f4a4f6-5f44-4c4f-a32b-6f2f8d426dc9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62aad5ff-c355-4584-8456-e4d25bb4bec0", "sighting_of_ref": "indicator--a5f4a4f6-5f44-4c4f-a32b-6f2f8d426dc9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4027dfc-334c-4e2b-a6c8-bb35bd890d7b", "sighting_of_ref": "indicator--242955ef-9192-48bb-a845-032070525479", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79862591-7782-4234-8d12-025717b86509", "sighting_of_ref": "indicator--e773d80c-7835-4bdb-b6f7-c5d28e1cc541", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b61cd061-722d-4e7d-b141-4a5fbd1ae18d", "sighting_of_ref": "indicator--5036ce4e-b0f7-454f-8dae-d3b0e492b685", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8efc05a-bb26-4e40-8cbd-666d34897be7", "sighting_of_ref": "indicator--0dfb222a-3821-4b45-8f70-4afbad5f8969", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3df3ed7-ca74-44c0-8eb7-6b516c334471", "sighting_of_ref": "indicator--901c4d31-2e97-43d1-a59d-fbb403bef9b6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1320d13-8b36-4fcf-97b3-d327329fddf2", "sighting_of_ref": "indicator--809543d5-6b0b-4a9c-9d81-1fa735008317", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d9dc168-e0b8-43a8-bb72-6bab3ef4c939", "sighting_of_ref": "indicator--dd021962-b926-42ef-8acf-5bb9c2c9ec54", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7e55a62-2521-41c8-8780-645e191f0ee7", "sighting_of_ref": "indicator--e5c3d1b4-5824-468f-a853-89095e4a039e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--555d6c6a-c710-441e-9dd4-0c8f7d70dafe", "sighting_of_ref": "indicator--a48b9601-ed5c-4207-89c8-57be39def829", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0ca18a6-654a-4e5b-a5df-fb7a76fb9e23", "sighting_of_ref": "indicator--dd0a838b-ce60-438f-968e-5078a4e5e307", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd202253-5ddb-418f-a316-d15cd5bfa345", "sighting_of_ref": "indicator--dd0a838b-ce60-438f-968e-5078a4e5e307", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67971ecb-eb8f-4db6-bdce-bcf46cb99b3e", "sighting_of_ref": "indicator--4554145c-9fba-4585-a437-194119590cb7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d62f782-ab92-4ff3-b087-503a0f7a93ca", "sighting_of_ref": "indicator--7fdb109c-744d-4409-8a88-9ef915c78b98", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdfa0bdb-f9fd-4db6-901e-b071cf01cdfb", "sighting_of_ref": "indicator--45cb2c73-e26f-49a0-89fa-0c504a641e6b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75a64402-caa4-4bed-af5e-920486e655f3", "sighting_of_ref": "indicator--b1a61a27-38f6-4fed-af5b-6361865b8adb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3da87de-306b-4ed8-bef0-6c3c7cd07d71", "sighting_of_ref": "indicator--b1a61a27-38f6-4fed-af5b-6361865b8adb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e9a3d06-2b08-4354-a566-718fe98a5075", "sighting_of_ref": "indicator--059e22d7-22b9-4d48-bb07-063a2e33f48f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf22e189-996f-4dc8-b399-cb90ca139592", "sighting_of_ref": "indicator--765d8d0a-3d0c-4193-9dcd-36efc7634dec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac511337-e89d-4064-bac8-86212a8dfc5f", "sighting_of_ref": "indicator--765d8d0a-3d0c-4193-9dcd-36efc7634dec", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9489ea43-00c8-428f-a495-4654ded6e198", "sighting_of_ref": "indicator--2e31c6ab-7255-4068-9b47-d7b63b8975a6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4df4206-63fb-4cfe-be8f-964e2bf47701", "sighting_of_ref": "indicator--a6b5189e-d173-46a6-b33a-cdc277e4f7e0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27b1039e-15b3-46b9-bc2c-c475538fe489", "sighting_of_ref": "indicator--15c0c5cc-0a66-4b20-8743-1532237078f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49bebc4e-6092-464f-aa3b-0f2351b058d9", "sighting_of_ref": "indicator--99dc3f45-6ed0-473b-b41d-712be6f31eef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44a81cbe-0a04-48eb-be1e-baba257c8032", "sighting_of_ref": "indicator--ad64cea1-101f-407d-96e1-fa6193ff0cf5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7f20fe0-723d-4b7e-89b3-93c99b3a43bb", "sighting_of_ref": "indicator--86de05d4-3e0f-4f2f-b7fb-1c75f60876e5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1027fc5a-bbd8-479c-9784-3553b61b2c33", "sighting_of_ref": "indicator--86de05d4-3e0f-4f2f-b7fb-1c75f60876e5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--695c0aec-3414-4d93-a441-37e2f2ba51ab", "sighting_of_ref": "indicator--f66350c8-e474-452d-8db5-8e9b5176b4c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--483e177c-1e01-4929-a777-6da7ee18506a", "sighting_of_ref": "indicator--2910229a-7c43-4fdb-a19a-7e74e44716dd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cba92595-4ac2-4539-9a31-596df4e450d8", "sighting_of_ref": "indicator--82798cb5-839a-4fe2-9ba0-1bb621f1963b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9af8944-c8b2-43bc-abfe-81b3e8b004a0", "sighting_of_ref": "indicator--29bfef9e-b7aa-41e6-9853-136ae27c55de", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d876bf13-4091-4620-8c8a-df72bd17ea1e", "sighting_of_ref": "indicator--29bfef9e-b7aa-41e6-9853-136ae27c55de", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5c4feae-5e95-4dd7-9a0f-71830175bcd2", "sighting_of_ref": "indicator--de77317d-dea0-40e4-b044-76ef219e8c49", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--132ce7ca-693b-4fbb-ba63-c16809d96390", "sighting_of_ref": "indicator--92f40a84-8530-434b-a34f-9d627fdd2634", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2182b28-c3f8-430e-9958-1a205fcc284c", "sighting_of_ref": "indicator--3518113d-a78c-4d03-a8c0-b98626edd2b0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44639a4a-8688-4cfb-ac6d-880f6038e0c5", "sighting_of_ref": "indicator--e48677a6-0a5c-42bc-aafa-bea05e6bc800", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--345b1ef0-5569-4de0-8f40-052ff13b1fc0", "sighting_of_ref": "indicator--c8ab4eca-7681-4efc-86bf-f20d816f4698", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3d35cd2-e6a6-41a0-b3fe-08082bfdcea7", "sighting_of_ref": "indicator--4c61789e-412e-4e15-80ae-391179576327", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90b70d60-cc85-4d54-950e-59a7fcadffc4", "sighting_of_ref": "indicator--5afe67cb-be05-4128-a211-13f149371bb9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e0e557e-a10f-4940-9d96-16f349f0caee", "sighting_of_ref": "indicator--32e2212f-5aae-4101-8cfd-8276e189fa57", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4e248a5-f805-42ef-8574-0cbe71fb910d", "sighting_of_ref": "indicator--1c57f029-b20e-4710-8db9-745f302af6e8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7c08a8f-f4ae-4f04-9f89-31de37f378af", "sighting_of_ref": "indicator--2246a31b-6ea2-4004-8c06-28fb6709f573", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e64f1646-fc49-4fd8-9507-bd39a4d4220e", "sighting_of_ref": "indicator--2246a31b-6ea2-4004-8c06-28fb6709f573", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--067ef2e4-190b-4a6f-b5fb-84d0bad78219", "sighting_of_ref": "indicator--e6c17976-0473-48fe-9a31-a1b84e5d27ae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16e99fc9-cb80-4ddf-aabc-39048b6a23e3", "sighting_of_ref": "indicator--fe4076b5-9644-47a4-88f0-995faa7062ac", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b22a082b-c3a2-4225-89a7-866e21d835cd", "sighting_of_ref": "indicator--a83ecb74-81b9-4989-a27c-431df7bd319c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b06a636-1396-4371-8b49-cfcce19ad0ec", "sighting_of_ref": "indicator--a83ecb74-81b9-4989-a27c-431df7bd319c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79f647e3-00b2-4358-8efe-4eec455483c1", "sighting_of_ref": "indicator--57080c5e-711f-4753-9a85-363594d8a976", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6e66957-3b31-419b-a810-2e27e4426b2a", "sighting_of_ref": "indicator--57080c5e-711f-4753-9a85-363594d8a976", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16937d28-44d1-4009-882b-ebeca46e15ac", "sighting_of_ref": "indicator--c1921005-d77c-4fcc-896d-c3caef94e3b1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9427f7b5-250a-438d-bab2-fa98a5b0bf51", "sighting_of_ref": "indicator--5849a4ac-bcf9-476e-8fdd-da3a259ad13e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11c83961-7587-41fc-8fc1-5d0610de6e54", "sighting_of_ref": "indicator--86f4ce75-1be6-4e45-a14c-31155158d1d4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--131b2bb0-dd7f-4929-b405-6b29a64089d2", "sighting_of_ref": "indicator--86f4ce75-1be6-4e45-a14c-31155158d1d4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6820d20a-ff4b-4cf1-a31c-1b018d11fdaf", "sighting_of_ref": "indicator--43444bdf-47a2-45cd-a665-b4a32ae854ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdfedc1c-3bbe-46df-a0cd-663ba655b6c3", "sighting_of_ref": "indicator--1077cd7b-68de-4f8e-9f0f-4fefc885ac1d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b92332e-ea34-44e1-aa00-9dc3069ee0af", "sighting_of_ref": "indicator--ce5f1d47-c01b-4bd0-b7b5-ab025c083308", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--663645a2-547d-437a-a61c-e565034125b0", "sighting_of_ref": "indicator--9e7610eb-427b-4cbb-95b8-48281d3671c0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06f5f231-eb58-4a27-8a7b-5618054c17dc", "sighting_of_ref": "indicator--3fb9110d-b39a-4908-989d-d736b93412e8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f200a712-3b47-41f3-84b9-0d238cba0bfd", "sighting_of_ref": "indicator--3fb9110d-b39a-4908-989d-d736b93412e8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0145d595-8c21-4932-8402-b80439a4bd57", "sighting_of_ref": "indicator--ccb48058-fecb-40b3-ae07-9ec62ec412f1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad5375bd-d4ca-4048-a89b-c974d4826ca0", "sighting_of_ref": "indicator--18a19b42-ba42-43a2-a950-2e73071d37cf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b707d5f-17ca-4f2c-bb59-450b81e2995c", "sighting_of_ref": "indicator--18a19b42-ba42-43a2-a950-2e73071d37cf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--585d20a5-d778-4769-a9c5-32720fce4b50", "sighting_of_ref": "indicator--e2ae9af6-b993-45a0-9b8b-c34a5688b3d5", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baa00bfa-f067-4059-abc5-75266e3cacc7", "sighting_of_ref": "indicator--12d2c04a-5515-49c1-b162-f2a01ae1aa25", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef7bc520-3c03-495b-b3c0-0c7c3fe6ba69", "sighting_of_ref": "indicator--12d2c04a-5515-49c1-b162-f2a01ae1aa25", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e89dc232-af4d-4883-8462-c952c5e085bb", "sighting_of_ref": "indicator--7c6ca461-aad5-4ac9-92ff-100cb9740540", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec33c0aa-952e-4ec6-9110-bc1df89442bf", "sighting_of_ref": "indicator--91aba376-02bc-4b4c-9d8b-691e0fdc6444", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54777d44-5d11-47de-801d-7e939c4c19d6", "sighting_of_ref": "indicator--5041f0e5-d58f-4f8e-bd33-a6e6e9adfd94", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63644554-cb3f-4ed3-b282-587d614a9a2f", "sighting_of_ref": "indicator--ce8ad206-b571-4d9a-80ea-53d65a564f44", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e58b178-89df-47f3-8254-30ec8368ef93", "sighting_of_ref": "indicator--a6ddc985-8082-418e-8a39-509748cda39e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c935716b-2dc3-4ee7-ba31-ccc12054a4e4", "sighting_of_ref": "indicator--9f52179a-894c-4b9a-89ca-db7fe14efb26", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ad96cb0-beeb-4ad5-9c70-865e38d1be42", "sighting_of_ref": "indicator--25b28a50-ce87-4bd7-ba4d-06a315708928", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64efcaaf-8d7b-4c6c-89e7-190e86a04f27", "sighting_of_ref": "indicator--a26f3072-558a-45d5-9f71-16610308172b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a4c25c4-4216-40dc-aff6-4a5ebb864290", "sighting_of_ref": "indicator--03e6d31c-7fb8-4d33-8a96-b9760ac8ecad", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d81c449-1c50-4ea2-b188-c06cc8aa9041", "sighting_of_ref": "indicator--1d07e022-ee46-4e39-8c5e-489990b69cc4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd3d8fcd-101f-4566-8fa5-ba4fe4e4746e", "sighting_of_ref": "indicator--648efea7-c080-4e5a-930e-516d01c0d467", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--539d8348-262e-4037-8cb1-18d30f3893c1", "sighting_of_ref": "indicator--648efea7-c080-4e5a-930e-516d01c0d467", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7260a93-9045-4a36-9e0b-5e187a064cc5", "sighting_of_ref": "indicator--3b1b93e1-f8c5-421d-90a8-712404983291", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8285bb2-84c3-41b5-b5f4-7449e2ed40d5", "sighting_of_ref": "indicator--a5beb425-05af-4e51-b2cd-46bfdffe50f0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d42a58e-356c-4657-9cf7-dfd39eae9143", "sighting_of_ref": "indicator--c8b20086-0f1f-42fd-b35c-1663dc122f11", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8466bd29-a7ca-42f2-991a-1e6c70f941c1", "sighting_of_ref": "indicator--a3910bbb-3dca-4160-80ea-2ec6dbecc909", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8107e211-ef07-413c-ad6d-ebf6b379f302", "sighting_of_ref": "indicator--3afd075c-b373-4aa6-911b-4901b427e3ff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6b8de31-7c25-48b7-9109-56606cd9dd52", "sighting_of_ref": "indicator--3afd075c-b373-4aa6-911b-4901b427e3ff", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7ab2e78-213d-45c9-a4b9-e953b487b4b8", "sighting_of_ref": "indicator--204aa8e6-05d6-4c6c-bc82-29bf15cc9061", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65b6e573-2720-4b55-a221-73594f769898", "sighting_of_ref": "indicator--db101f78-92d9-4a96-a4a6-48900ea46ca0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fae6c4b5-8de5-49d1-9109-1b26a1337da6", "sighting_of_ref": "indicator--f1d1647a-6f55-4970-a448-90c162ceca13", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcd98d8c-f39a-4e15-acfe-22f3e0169920", "sighting_of_ref": "indicator--4ba8f7a4-4e87-462c-bdf3-e2c55da41c46", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d03a81d-ffb9-4a7f-9beb-081bf0e44494", "sighting_of_ref": "indicator--dc080659-1d93-421b-8005-da276ba3a749", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73d36fab-5363-4918-b995-c9fbaa69215b", "sighting_of_ref": "indicator--03dfcffa-c5a7-42df-b7da-3076f253f0cb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--330e0450-6e0b-4c20-a39b-4cedb1df09e5", "sighting_of_ref": "indicator--62c9ef10-370c-4dda-a360-aec839d88029", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd945eda-e222-4b6d-aff8-6e1070ff2f4c", "sighting_of_ref": "indicator--62c9ef10-370c-4dda-a360-aec839d88029", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea8445d2-f9b5-482b-b659-8e7747eb95f0", "sighting_of_ref": "indicator--86e5f9f4-de7c-4662-9a5c-3eb99450d67e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad97c36b-a06f-4e6c-8cff-3616177449f8", "sighting_of_ref": "indicator--c1d04a66-1b7c-491a-86af-6406f84f34b7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63e935ae-e77c-4199-816e-f98f689a909f", "sighting_of_ref": "indicator--186078a8-6705-4e77-9b5a-3da204902c26", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--466fc481-861c-4286-b3cc-11c788bcadfd", "sighting_of_ref": "indicator--68e01a62-cadf-4e08-858c-d8c083b99c3a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95c56def-3a4a-4909-bdef-ac65225b0ec9", "sighting_of_ref": "indicator--75b31357-697c-4864-a262-e0c2d6dc5998", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f254417-54f6-46ec-87d7-29b93e898a23", "sighting_of_ref": "indicator--12a56fe6-b9f0-47dd-b5e8-fb22fc0a80ea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de695d32-35f8-423b-85ae-b61670f1645d", "sighting_of_ref": "indicator--2875e839-3387-45ff-bbe2-16e0d8a11b07", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9ddc334-3ff5-4b72-aedd-d732731d1c75", "sighting_of_ref": "indicator--3314c071-9a40-42fd-8811-9609e4730ecc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06fa0a88-37c6-43f5-9fa0-cefc630086a1", "sighting_of_ref": "indicator--3314c071-9a40-42fd-8811-9609e4730ecc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66411d47-0dd0-4c36-8d1e-085b78ddab1d", "sighting_of_ref": "indicator--17ed6d19-12a4-435b-8379-13fd478273fc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37680fe4-4688-4680-9b01-410f3e65c558", "sighting_of_ref": "indicator--a58e903f-06a1-4db6-b260-4fdf76333009", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52679edf-3848-4bfc-af06-0141a8623a3f", "sighting_of_ref": "indicator--a2554a8a-6915-447a-9782-e163b4957433", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6fd4012-1b34-4db3-9f2b-5b3f9733f94c", "sighting_of_ref": "indicator--a2554a8a-6915-447a-9782-e163b4957433", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a35f436f-5c3c-4c62-8fdb-43811009831a", "sighting_of_ref": "indicator--2a0ef84c-2c83-427e-b7e2-795bb7dcb8ba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5a4d2f6-3102-4c97-af09-9d9e88ba7350", "sighting_of_ref": "indicator--37c04f4a-ceb5-442d-befe-e97e3eacd0d9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63fd4bb8-6e26-4871-939e-158970d808c4", "sighting_of_ref": "indicator--105939d1-1156-49ae-b074-d017950407e8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8b59b4b-9854-4a3c-b0b9-494dc9f6f1ea", "sighting_of_ref": "indicator--105939d1-1156-49ae-b074-d017950407e8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dd4ab77-b99f-4714-8473-9f68457f8615", "sighting_of_ref": "indicator--3e23417f-f88e-4a6e-abba-699b6da717cf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dd9d2b6-4bf8-4163-83b2-c780eb68520b", "sighting_of_ref": "indicator--3e23417f-f88e-4a6e-abba-699b6da717cf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a6468fe-4dd9-41f5-b3d9-21ff8363330b", "sighting_of_ref": "indicator--218b7a13-73f2-4249-9f25-06858fc469e7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5459d592-e097-40e7-8cc0-8cdb12d18abd", "sighting_of_ref": "indicator--218b7a13-73f2-4249-9f25-06858fc469e7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c35a7254-62f4-4f1c-965c-c9274c79f3d4", "sighting_of_ref": "indicator--ad7d9cd6-c68d-4c65-80f7-dd8509b04053", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--644f3e84-f408-40ce-9a98-4905cb122546", "sighting_of_ref": "indicator--5457333d-d8a7-4321-87d3-e742490e6679", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b6df5bb-449f-4f0a-92a9-7aa49aec9cb6", "sighting_of_ref": "indicator--2e4a7342-a3a3-4371-b613-690427161a74", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--564782c8-de81-4440-9f82-2d313a5d1bc1", "sighting_of_ref": "indicator--2e4a7342-a3a3-4371-b613-690427161a74", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55962f39-1fde-4bf5-a1a0-e8c13bced71c", "sighting_of_ref": "indicator--f0a548b9-a03c-42ab-a5f8-1c6d571c1702", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24992d22-19dc-4e44-ba38-1188ddfbff8d", "sighting_of_ref": "indicator--eed1d60d-f735-4d9e-a335-7a20c20b72c2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--396946e8-1cf7-4960-9d60-c24bc3ae1f9a", "sighting_of_ref": "indicator--850af6e5-ea4b-40d6-a7d5-dbbc630eb656", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--970d4cdb-5e6a-4ebf-9166-03cd26053b11", "sighting_of_ref": "indicator--850af6e5-ea4b-40d6-a7d5-dbbc630eb656", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbc00948-ab3b-438b-b64f-aec2a9da6cdb", "sighting_of_ref": "indicator--fee89492-04b9-4586-a648-7f15d42b75c6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7856e6a-e88b-4888-8e05-dc3e0dd44bf7", "sighting_of_ref": "indicator--fee89492-04b9-4586-a648-7f15d42b75c6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dceb0e1-8907-454b-aabe-fb4542904dfc", "sighting_of_ref": "indicator--6692ee8c-7d69-421c-a82c-d6b0af2794da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92392257-48b4-4b14-82ab-f6938d861e80", "sighting_of_ref": "indicator--870f864e-8aaa-4929-a793-31567ef7acd4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3766f35-d627-4f1e-888e-2a8887e36a1e", "sighting_of_ref": "indicator--1a18534e-a26e-4842-b70c-3b5bb3c54e5a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bddef3c1-6230-4a6e-9fa5-fb8829535102", "sighting_of_ref": "indicator--75cc2103-a71f-4e40-b5e9-5d13e0010136", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1ec64b7-9970-49ed-a39b-7e29939dc9c2", "sighting_of_ref": "indicator--3b8813cd-b1f9-496b-9305-48c96e6c7774", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8b9dd57-225b-4940-bccd-f558a38d4f9d", "sighting_of_ref": "indicator--58e8bd84-9e5a-49f3-939c-538daa842ae6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ffa1b4a-37fc-49d9-b8d5-2cff85d94be1", "sighting_of_ref": "indicator--c31d21db-00e0-455f-ad23-49a5fe36195d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27c6f36b-2959-4c47-bba4-85fbd41a97d6", "sighting_of_ref": "indicator--b0b54b21-1af9-451b-830c-edcdbac63b1e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44b239c4-5b4b-4b0e-b797-49da92755674", "sighting_of_ref": "indicator--7def71b1-ad88-4af7-8477-9cfa7becd6b6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca941895-b8c5-4a4d-b0a0-de38fed828f2", "sighting_of_ref": "indicator--a01af8ec-c481-4657-9002-e97b743b51b9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd0459b9-caaa-4646-b97b-4869114ffb69", "sighting_of_ref": "indicator--cc3988d3-3bcc-422d-8abf-cd29640e70f2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59a9ff57-684e-4de3-bf67-a7093b6cf091", "sighting_of_ref": "indicator--448ad064-ea55-47fa-864c-bb037c70dbf6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11f68260-a9e6-445e-a3ca-c71b2ae85bf7", "sighting_of_ref": "indicator--c01aae9f-915d-4fe2-83c4-9d5da40ad3e0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db3fa400-3a25-4a10-b62b-3a6a70f6c169", "sighting_of_ref": "indicator--b470d454-a5dd-44d1-9ac3-4f075ddf100a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2ab86f7-f8eb-4f29-b1d9-f195fd9e0bce", "sighting_of_ref": "indicator--b4bf4133-68ff-484b-9514-d32a11fbfdd2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc4f9aa1-2470-4247-bba4-d66fc02801c0", "sighting_of_ref": "indicator--ba895609-1b8d-4772-8cac-abf94c77129b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea74d78f-a929-42f9-9c94-8ebe00a2eea3", "sighting_of_ref": "indicator--b8e3cf8f-3339-4e7f-95f7-d34470a62bb8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b2a04e5-37b3-46f0-a963-dba7001f44d6", "sighting_of_ref": "indicator--527c7871-79b0-47ce-9602-65bd8d9d3d21", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13873142-91bb-4dc3-8d2d-56eb61439f3b", "sighting_of_ref": "indicator--527c7871-79b0-47ce-9602-65bd8d9d3d21", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f2f17e7-8619-4e07-8cd2-851e08b8d005", "sighting_of_ref": "indicator--91f207a6-e83e-46df-a028-e9cda01d4678", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d75902fe-c83f-4487-9138-05769bae04b1", "sighting_of_ref": "indicator--2171eb62-c531-4fdc-a5b5-d24a3f6a0784", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3790969b-8eff-4279-9318-4052fccdddb4", "sighting_of_ref": "indicator--42d266c0-4abb-452a-9bee-83b4569268cb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0d7729f-0aee-4e5a-b15d-193b4935379d", "sighting_of_ref": "indicator--94e77991-865c-49d3-8c52-1db3e6f2ecda", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0edff5c-55cf-41d6-8872-722436b9f398", "sighting_of_ref": "indicator--07a96484-c9de-414f-a4c4-14e35dbd44b7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24f1f889-489e-4319-a389-b95ca854ccf9", "sighting_of_ref": "indicator--da0cda28-f2c9-4b13-a4ff-00e2ab9996c3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52322468-491b-4415-a95e-2b9b630eedc2", "sighting_of_ref": "indicator--820c99a0-473c-4d80-9b9b-c80f8ba77ca5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--893bb887-d9e6-479c-a9dd-b8d32dd9aef8", "sighting_of_ref": "indicator--820c99a0-473c-4d80-9b9b-c80f8ba77ca5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3abc9b1d-6e71-4ae7-aa0e-07364cfd8a27", "sighting_of_ref": "indicator--c538c0fc-466d-4c6f-bbfa-9c87456ee039", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09e77276-9b9d-4569-8e1b-88e9cddbf9c1", "sighting_of_ref": "indicator--91456945-151f-41a2-9af1-312d9f8ea844", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e7fbf61-d21d-42cb-bdca-7d72ad767ddd", "sighting_of_ref": "indicator--253f4cc3-fb76-4cec-a66e-3cac92f11aee", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4c4d097-ee75-4767-a92e-1a47001e4266", "sighting_of_ref": "indicator--b6f548d0-198c-4447-8bc9-65c70bf45288", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4e001c6-c0a2-4591-a657-336ad9c016a0", "sighting_of_ref": "indicator--1e10b7a9-0ef1-4034-947b-e06c1d515365", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--daacebc8-882e-4ca9-8403-d9e592b85bd1", "sighting_of_ref": "indicator--d2e7e2ec-667b-49dc-98fe-f3265d13d348", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fecd0e8-636c-4421-aa9a-efb69f060d03", "sighting_of_ref": "indicator--4e488a59-c851-433c-968b-378c9154f8e8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c298bfb-ff99-4ab0-b33a-54d1f27c5868", "sighting_of_ref": "indicator--4e488a59-c851-433c-968b-378c9154f8e8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8edcfb8b-7c4a-4f78-b0a0-4f6f7edfb4fa", "sighting_of_ref": "indicator--1d4c323d-77e0-47f4-b902-56a7d4174a4b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--143e2b35-70f5-48ed-9c6a-d51d0612b935", "sighting_of_ref": "indicator--d52c0c5c-0ab1-46f7-973c-2980b22009ab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1068305-329a-473c-99d5-307c2ddf38d2", "sighting_of_ref": "indicator--23ee3291-cc49-4efc-ac76-03fc13120bfe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b618f94d-cec2-4426-b1ce-c2e9cbc3d459", "sighting_of_ref": "indicator--23ee3291-cc49-4efc-ac76-03fc13120bfe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1fe6217-87de-4481-812d-92040e99fe96", "sighting_of_ref": "indicator--b193b4e4-a8e9-4182-9ebf-fd56116b1300", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42c63d4d-b131-4736-a8f7-a53d337720f0", "sighting_of_ref": "indicator--b193b4e4-a8e9-4182-9ebf-fd56116b1300", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c6cfd51-5cc6-466f-8b90-5cfd22e6db60", "sighting_of_ref": "indicator--65de927d-ac55-4c2a-98c3-ed1eb75a98a6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52aabef5-69c1-4e32-9eec-84770cb7ea26", "sighting_of_ref": "indicator--84b72d97-d6c6-4aa6-9812-a0cd873616d2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68d87c04-01a1-43ff-baec-f55b53800d75", "sighting_of_ref": "indicator--84b72d97-d6c6-4aa6-9812-a0cd873616d2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd9555e6-64eb-4517-bf86-b1d5d42ca492", "sighting_of_ref": "indicator--ac542c92-6824-4730-b13f-c07aba370f9b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--897d2624-ddba-4f76-9e8a-5de966e0f410", "sighting_of_ref": "indicator--a7000593-9eb5-4b4e-bf32-8cdef19636e7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15a5adb9-aa47-45bd-8e6f-61cf956f99be", "sighting_of_ref": "indicator--285a1b5c-ae62-4992-ab06-312ee1fe4eec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67d8e998-eb0c-4697-9f2f-a5d9863f41df", "sighting_of_ref": "indicator--285a1b5c-ae62-4992-ab06-312ee1fe4eec", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--123254d7-195c-41f6-aac8-0ec30ab8dbc4", "sighting_of_ref": "indicator--62622d8c-998e-47d4-a44d-d15c973c9b00", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c142f78f-2651-44f5-a083-9d4c709601a1", "sighting_of_ref": "indicator--62622d8c-998e-47d4-a44d-d15c973c9b00", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2ea6656-851e-4fb1-919e-9f0b8622d3f8", "sighting_of_ref": "indicator--2278cc4b-8bc7-46f9-954b-c254228f2a11", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60d83127-168d-4d75-af5a-0565cfb9930d", "sighting_of_ref": "indicator--a49e1f54-acbd-4d1a-9202-77f904b41ab0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16818e68-e83a-44fa-981e-5394adab208c", "sighting_of_ref": "indicator--9c016f9e-ff5b-46c9-90b8-d6b02d0bf31b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5247cbd4-2b62-49a2-bb39-c9685457b0ee", "sighting_of_ref": "indicator--9c016f9e-ff5b-46c9-90b8-d6b02d0bf31b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52778529-1372-4a04-8cc8-45edb44f9a27", "sighting_of_ref": "indicator--fbe3ba90-8e95-49e3-b6ce-0b1dbda19099", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72228ebd-4628-4060-9aab-e6f329c9426a", "sighting_of_ref": "indicator--fbe3ba90-8e95-49e3-b6ce-0b1dbda19099", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--908fbdc5-af2c-458f-8771-66b6e8f87e92", "sighting_of_ref": "indicator--f01a348b-7aef-4cf7-b20b-b573b2d722a9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20c93e74-b057-4886-860e-7f021f366b78", "sighting_of_ref": "indicator--2c59873d-8a27-4dd9-a552-8fd607408958", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bea07ace-3598-4e83-8eb9-c3a2ba73651b", "sighting_of_ref": "indicator--a8c47d90-86e5-47ad-8730-8521ea11a888", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8676024-5814-4f58-b1d6-e230ce544d90", "sighting_of_ref": "indicator--9fbf3fff-522d-443d-b589-eadfe93df443", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9841d4ac-cde8-4372-951c-db8e4aa68d71", "sighting_of_ref": "indicator--9fbf3fff-522d-443d-b589-eadfe93df443", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--532309f0-24d1-4baa-99f6-758db1ac4ec3", "sighting_of_ref": "indicator--c9e9a3ee-9054-4222-8b2a-cf2ae96ca24f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bbdb353-ce00-41c8-95c1-1dcdc64658f1", "sighting_of_ref": "indicator--66516b02-4fb4-4572-8f1a-f16578425d90", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5454e060-ce96-4fe7-8671-5e546697c6d2", "sighting_of_ref": "indicator--f3d2d1f0-a3d2-4bac-91bd-d2af3a88ce73", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdb7837f-b10c-4649-be64-bff49267742f", "sighting_of_ref": "indicator--4c208d74-96cc-4218-9818-9eb14110a1a7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba610706-a05f-4fd1-87b4-35cb54a74e6e", "sighting_of_ref": "indicator--4c208d74-96cc-4218-9818-9eb14110a1a7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bea198a0-0094-411b-8ec5-5d85f6175c27", "sighting_of_ref": "indicator--46ccf14d-a984-494f-b84f-5d03fb3e89a6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6522fc4a-d26c-4f7a-b5b9-1d3a7e351b40", "sighting_of_ref": "indicator--46ccf14d-a984-494f-b84f-5d03fb3e89a6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a28c5b3-0d2f-4680-ba68-6b243310984f", "sighting_of_ref": "indicator--517bbfed-f89f-45af-8a99-306f9328e17b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14dbcea8-3c34-47fd-acbe-ab990c087e04", "sighting_of_ref": "indicator--7d2a0015-4f1d-4524-bc47-b3528f9693ba", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e076cfef-64b6-4ce4-ac25-abc51a096ac8", "sighting_of_ref": "indicator--d8dddc71-1558-41e4-855c-88a60c195a93", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63075a27-ff20-4f8a-979d-8b441342b7f8", "sighting_of_ref": "indicator--d8dddc71-1558-41e4-855c-88a60c195a93", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b5cb54d-2fc2-47a0-a989-18248e7a18a3", "sighting_of_ref": "indicator--04c79151-7660-4793-a5f6-a54ae1e947bb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae8de9fa-e533-410d-89cd-04b32965601c", "sighting_of_ref": "indicator--33d6e727-cd73-4785-9141-5af5eeffe56f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4245ddfc-5d6c-4e44-8335-35f3fb41767b", "sighting_of_ref": "indicator--6a9d612f-09b8-4a6d-b29e-c35e0c311202", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbdb8045-02af-4bd4-8af5-5eb770a41bfd", "sighting_of_ref": "indicator--4052dfc8-9325-42bb-95ad-8429612b3078", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1b235bd-cf8f-4c64-b020-31af5aa22a19", "sighting_of_ref": "indicator--4052dfc8-9325-42bb-95ad-8429612b3078", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04749edd-9b34-4f52-b47b-0ada53cc058f", "sighting_of_ref": "indicator--3d99d2e8-f864-42c4-be00-2fb19256e778", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b594d44d-5f16-429c-b8ab-22df002f58bf", "sighting_of_ref": "indicator--6bfbff0a-f95a-4bd9-a073-07b778d98302", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36c54630-5d8d-4e1b-90d4-8c6de793d44d", "sighting_of_ref": "indicator--77738561-d352-4b0e-a67a-50ea388a1432", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15b2c558-7185-4d11-8021-ca7b9c894862", "sighting_of_ref": "indicator--6c47f73d-61e7-42fa-b38f-650f1e624497", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c7ebf11-e743-4e52-861a-bf54ebdfa043", "sighting_of_ref": "indicator--6c47f73d-61e7-42fa-b38f-650f1e624497", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--019748d8-c8e2-4669-86ed-081ac546d86f", "sighting_of_ref": "indicator--92fb5af7-3738-4ba5-8515-e9782c80b672", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c67d4219-7c0d-48e6-8361-cc018331d51a", "sighting_of_ref": "indicator--ae234572-103f-48a4-aadf-2a630088163d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--479cb41f-bc25-44e2-9568-b278ad362d74", "sighting_of_ref": "indicator--74d3728f-9963-4a36-905e-a7a626698d31", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d9c9af6-1b21-4a94-9de2-e52b57b0e0d7", "sighting_of_ref": "indicator--74d3728f-9963-4a36-905e-a7a626698d31", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--438e6314-e414-49df-91f7-e4883bd5d2c2", "sighting_of_ref": "indicator--3467efde-b7fb-44bb-a503-f07c6f4a922a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3adc0015-89b1-4645-b50a-60f4a21545da", "sighting_of_ref": "indicator--0d9b3243-d50a-4238-9af1-9171c12cfc42", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40bf84fc-b1f4-4d74-8efb-cd45e681d73f", "sighting_of_ref": "indicator--e3687812-def5-4c86-aedb-5f1299e2b525", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--761a30b0-56a6-4fc1-bc14-9d462661cdde", "sighting_of_ref": "indicator--c38cef1e-64e2-4930-8938-f61d14cad3fc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e20453dd-1905-45a6-a390-9bb650d0f008", "sighting_of_ref": "indicator--c38cef1e-64e2-4930-8938-f61d14cad3fc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--564a0882-5e4e-4af0-915f-fe1973d90f02", "sighting_of_ref": "indicator--4513a277-262f-43c3-8c74-c98ce071bcfa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a49baf11-3e8e-47fb-a92d-705d50e2a4ba", "sighting_of_ref": "indicator--70233424-95d7-41e3-b67c-05005a166b95", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--428852f6-fba3-459f-b768-75d7b7bfd10d", "sighting_of_ref": "indicator--ec0be3e6-72b6-40cc-8aca-6166298bbe38", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2596dbc1-7dc7-408e-90a3-c594b3dc69ce", "sighting_of_ref": "indicator--e0500d45-2004-461f-b03c-cfb0d4d2cd47", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ff88838-5380-4684-985d-863ce99b2f0b", "sighting_of_ref": "indicator--e0500d45-2004-461f-b03c-cfb0d4d2cd47", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6be866d1-56bc-469b-b8c4-ee43a9234e40", "sighting_of_ref": "indicator--3846ddff-4a33-493d-88f3-cc964cd3599e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c405795-a366-4284-bcf2-3b5abd583f35", "sighting_of_ref": "indicator--153d7f63-05a9-4052-bac4-25bd00943cd1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79fc5ce9-77e4-4580-a06a-7d3341093aa2", "sighting_of_ref": "indicator--fa9227a4-ac5a-4048-8baf-74804e1d51f7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a02fdf6-09e4-410a-8b8f-a53394743380", "sighting_of_ref": "indicator--d7e43414-054c-4d16-b149-1f54c0339649", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee187a7d-1e05-42c1-8345-d60e6694303c", "sighting_of_ref": "indicator--ed7fed18-5c18-4b03-ae95-33a15e39b0fe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05dca429-8cc9-41b7-b7fc-ed107b440e0d", "sighting_of_ref": "indicator--ed7fed18-5c18-4b03-ae95-33a15e39b0fe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--915b008c-6fe9-46f7-beaa-f2fe08f41305", "sighting_of_ref": "indicator--ab97f637-6b34-44df-8c4b-7faa8ef7aae1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c28ce0d-0e0f-40b6-a98a-aa2d149dd903", "sighting_of_ref": "indicator--2696be62-1e8f-4d86-9260-352302ab66d3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db88588b-7483-494f-a2fd-ab1886835135", "sighting_of_ref": "indicator--2696be62-1e8f-4d86-9260-352302ab66d3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ee69788-f251-496d-897e-d77394d71b24", "sighting_of_ref": "indicator--cbf30a07-f0f1-4943-b0cc-22e84d3395a0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de463ddb-c388-408a-a0c8-c0a51998abf4", "sighting_of_ref": "indicator--791a5a40-ee9b-4632-988e-a61d3f8fb95f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--506ab2df-f3e5-4e95-b6dd-6a445d5a31c6", "sighting_of_ref": "indicator--95199265-ca09-4917-a30f-3e33acc0c7cf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d52f95c3-b934-444c-8f92-ea226084c339", "sighting_of_ref": "indicator--b4e14858-e11d-4324-b2ce-ab8e53cdfe72", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61b25654-7633-496c-8280-d894308aacad", "sighting_of_ref": "indicator--c5bd10c9-09f3-4c4b-9c45-d97ee243996e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cfffc48-eb0b-4c00-8fbe-124234da2a42", "sighting_of_ref": "indicator--1441d9a0-c123-4b2f-b00d-c0143890083e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1ad3119-76d6-4042-bb5b-546445d06c4b", "sighting_of_ref": "indicator--3d8d2e83-2b74-47ab-963b-2c71acd2602a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d554ed3-c741-4218-8c82-1cf78fac0619", "sighting_of_ref": "indicator--3d8d2e83-2b74-47ab-963b-2c71acd2602a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0ebba96-cd0c-4d25-a73c-a2a8c104ac52", "sighting_of_ref": "indicator--a775988c-acf2-4dad-95a0-bc5056ad910b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8588a53f-9119-4a92-b86f-043f43d51f51", "sighting_of_ref": "indicator--3e78efa5-b333-4545-9e56-e2da5842c475", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b96bae3a-50f5-4b97-b767-5e4069e872ee", "sighting_of_ref": "indicator--fad2f354-9dcf-4f75-acb2-37de82b6e1db", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9960a872-04ca-4834-a12b-c30cc0b12a24", "sighting_of_ref": "indicator--1a727e26-7f70-499d-a278-59beef299c3d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2e1b2c1-6b2a-4aae-87a0-1e1c91df7960", "sighting_of_ref": "indicator--7753ca2c-49fa-424c-a222-d8e6ab98cef5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e8d5c7a-d68c-44a3-87c0-757a963a1db6", "sighting_of_ref": "indicator--b5ba91f6-01cb-4b56-8a7c-74fb481f6ad2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b55f9aa1-3e52-41bb-bfd5-fdf7368dad95", "sighting_of_ref": "indicator--e222266c-2610-4498-89ee-dec8a96ab743", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9cd85ee-314a-4736-8453-67f8f86830f1", "sighting_of_ref": "indicator--5987599e-e42c-4af6-baf4-c259edf18508", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24015453-585a-4401-a441-4d3221c1f141", "sighting_of_ref": "indicator--edde8099-f96c-4c95-ba35-8ec67df17f4b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4ea37d6-e1c2-4411-b4f7-e7d0442cb4ae", "sighting_of_ref": "indicator--c7778f9f-ed5a-4eb7-a933-2450741aa0a7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc7c05f7-2315-4b99-8fe5-4c1017d79ff3", "sighting_of_ref": "indicator--81cd4ba6-4450-4bcf-901d-fb5f6a6bedde", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--771ef01f-0b9e-4720-98e5-597f7ca5a3be", "sighting_of_ref": "indicator--1962fc17-029c-4c6f-b599-0922cd5018ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b84487fa-8cf4-419e-80cd-0cb320bfd2e2", "sighting_of_ref": "indicator--68be37c7-1eff-4b41-83e2-b416e2148e53", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d851e50-4114-4135-9042-adfd36bd76ad", "sighting_of_ref": "indicator--344e80c4-5d3b-46d2-8cb2-55913d8ef27f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc851e06-c04b-4d15-abfb-7c5bf4e9a651", "sighting_of_ref": "indicator--255ac3e5-e853-447b-bb39-814a1cabe671", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec691a49-db2a-47f6-aa0d-3d737863958f", "sighting_of_ref": "indicator--255ac3e5-e853-447b-bb39-814a1cabe671", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c1d422e-4389-450d-ad34-6fff5eccf433", "sighting_of_ref": "indicator--601ccfbc-6d75-458e-a3cd-eb764fe92dff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c81582e-ea7c-48fb-81ad-901f9039cdd2", "sighting_of_ref": "indicator--601ccfbc-6d75-458e-a3cd-eb764fe92dff", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca9759b4-3d41-4a7b-ae94-b102d5cb3b51", "sighting_of_ref": "indicator--44d22ef8-0f3a-455e-b2d1-a87b2069c0c9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6e77696-42ec-4db5-bb78-7911e9805e60", "sighting_of_ref": "indicator--3a08b1ea-f751-415c-8cef-eaed222ffafd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b924af5-460b-491f-8953-facb3f11b459", "sighting_of_ref": "indicator--2d466c85-139b-4370-9df3-5c7169cf71d3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f42b0ee0-2483-4d0f-8907-53932cf7220d", "sighting_of_ref": "indicator--52c0a4bf-1f2a-4123-ae50-fb754daeaa09", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6026162-fd61-41cb-a495-d97b44279f0d", "sighting_of_ref": "indicator--a79fb3a3-f5d5-4966-9d39-a09bf421c7ec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71517104-b1ac-4bf6-ad83-46189cd71ef3", "sighting_of_ref": "indicator--94bad397-cfbb-4cb9-8a12-85e3c7394fc1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--448987c6-6aa4-4b5e-9e01-7d1e79f2c050", "sighting_of_ref": "indicator--17b64ad9-1368-40d9-b3ee-e5537e53aef9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69ab3428-35f9-4ce3-b534-e77584c91c89", "sighting_of_ref": "indicator--bab8e2b2-e0f2-4f2e-8841-69ed29697099", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f26cdee-de15-4542-84ff-d41f20b5af97", "sighting_of_ref": "indicator--86745203-30f8-40e3-8b51-5d7dd60ee60b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd5e6276-47b6-41d0-90c5-44e4b6b376c4", "sighting_of_ref": "indicator--92c569e1-b07d-461b-8e7a-b204afee6321", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4713f74-db86-4c91-91af-3826dde8a765", "sighting_of_ref": "indicator--837bc902-bb73-4953-944d-b081553470ec", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbf4c056-ebca-4683-97fc-cba1c16ebae8", "sighting_of_ref": "indicator--5ff32d61-3063-4bb7-9498-95fa741feed3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b76866fa-23bc-4fc9-a800-e3482a851cbf", "sighting_of_ref": "indicator--d7405d5e-caa7-4c53-9716-1bf570adcda1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a737017c-5947-414a-9333-9e35a22b01f5", "sighting_of_ref": "indicator--bbaea937-1a27-4e98-b513-62e262c62b9a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23ee4e95-4137-42a9-8003-31a5bfc9cfa5", "sighting_of_ref": "indicator--518fdbbb-95c5-43d5-b768-c4e5e24667eb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e12ba648-2e8c-438a-962f-021ce3c35546", "sighting_of_ref": "indicator--6fd1ee72-2f67-4f2d-805f-06a0060655f7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39aede9b-f003-4203-bf23-d7d7bc8e54a8", "sighting_of_ref": "indicator--8024b221-4025-4658-b59b-7b07df87b175", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56377caf-3aba-4d64-bef7-d79d418e68b3", "sighting_of_ref": "indicator--ffc6a12d-cac2-40f3-bed9-4f5db8bbc675", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad1e30b7-8cf3-484d-a351-6895da19285b", "sighting_of_ref": "indicator--206af775-f4be-4cb9-b509-6e2e2ab02308", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b7a93e4-9f92-4717-87be-c1909aaba3b0", "sighting_of_ref": "indicator--e8147fb1-75de-41e2-9cd6-bfc2c7412c7e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--955bddcd-ee40-4d61-bffc-d6778ea1c0aa", "sighting_of_ref": "indicator--8d57623d-de0d-4a41-9840-021a673d9be4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f2839ff-dd41-43d9-98d0-8b4698a2f57f", "sighting_of_ref": "indicator--8a52f995-e7ad-49ff-bcb4-e37e8b551260", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b15779f3-6dfa-4ba3-b42b-a24839ba3be1", "sighting_of_ref": "indicator--5f763957-5b64-438b-aa02-1dd9acc808ac", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2618c7b1-051b-41a6-85d6-af87f1910d41", "sighting_of_ref": "indicator--0a854743-6ff9-4467-88f1-4e0ea12eaa56", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe0bdba7-d89e-4511-a26a-1995c8eb9a04", "sighting_of_ref": "indicator--0a854743-6ff9-4467-88f1-4e0ea12eaa56", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c5255ad-a3ae-4ac1-85e4-89013a93fe80", "sighting_of_ref": "indicator--f2f0395e-ddad-4b28-ab2c-50d370b7b857", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d087edf7-8192-4705-9836-97facaed429a", "sighting_of_ref": "indicator--f9ab6498-33be-4110-8d57-49274d6b52cc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3abab331-976c-4bc9-ae07-554119c449f3", "sighting_of_ref": "indicator--13c7d06a-11ba-4910-b80a-452ba613b3e2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50e96616-f017-4263-8c68-84234f9e45ee", "sighting_of_ref": "indicator--13c7d06a-11ba-4910-b80a-452ba613b3e2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be7a36f2-6399-49cf-9180-7e8c0eb1ea8d", "sighting_of_ref": "indicator--7151b673-a662-4940-a812-7000c37f453e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--005a4d5d-dcee-4e0e-826e-f784bf23fa87", "sighting_of_ref": "indicator--a4cf22fd-9900-42ac-b8ad-a20c9f73b929", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b134034e-923f-47e6-a8ab-340d7eea8257", "sighting_of_ref": "indicator--a4cf22fd-9900-42ac-b8ad-a20c9f73b929", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95c6c352-7f20-4e61-9786-2c8833e31ce0", "sighting_of_ref": "indicator--a6dceaf1-7299-48d1-aa35-e4a1f6210339", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--555395af-a699-4098-9817-ca6e284e56b4", "sighting_of_ref": "indicator--a6dceaf1-7299-48d1-aa35-e4a1f6210339", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d66395c-bcb8-466a-b120-ba891b815bca", "sighting_of_ref": "indicator--83e081a1-68b3-4126-86f9-508ea612df00", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e35a541-1061-46b0-9cfc-02f7451056aa", "sighting_of_ref": "indicator--e3a4e90e-72ae-4611-9ac3-0d47bec1e02f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--566620b1-d0fd-4794-b58b-923a09f77513", "sighting_of_ref": "indicator--5cc0dad1-7bf9-42c7-a495-5e2fb201b633", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6aa4dfdf-e6a4-456a-853a-35c2417f7e47", "sighting_of_ref": "indicator--663cca86-f0d4-4289-9a08-d5cc599ef949", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9047798f-760d-4285-950d-62e0f3f80e91", "sighting_of_ref": "indicator--663cca86-f0d4-4289-9a08-d5cc599ef949", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--991f221d-13a4-432e-aa3d-21b22c664bce", "sighting_of_ref": "indicator--572eef9c-9212-4847-910f-c9d628083334", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed2d0038-1be7-414c-9040-70c11fb16974", "sighting_of_ref": "indicator--8603ea85-a2ad-47e7-8810-a362be940854", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0867d9f0-5ac0-49ae-8d11-b147fe262eb9", "sighting_of_ref": "indicator--bc53b6c7-62a3-4f7b-aee1-28f412b8d4c7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41cc36c5-27aa-4728-a3e7-0ee826426aad", "sighting_of_ref": "indicator--bc53b6c7-62a3-4f7b-aee1-28f412b8d4c7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa9ef99e-032b-4716-996c-a3b05dd63f8f", "sighting_of_ref": "indicator--a95e45d9-4ada-4e1f-8f04-fbf9e0d6a6ec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f02123d5-393b-4bd7-abd5-d589d484c2e9", "sighting_of_ref": "indicator--7f65cd56-886e-4639-934b-4f54be02eeb9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e5f6519-acdb-46b9-a3b2-8f99aa4ca311", "sighting_of_ref": "indicator--7f65cd56-886e-4639-934b-4f54be02eeb9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51c70510-b6c6-4b1a-98e7-579ccfd2e2b7", "sighting_of_ref": "indicator--91465347-bf0c-493f-84ee-55279cd93f7f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e71b67f-ff8c-49ba-ae69-2f831b474a89", "sighting_of_ref": "indicator--ef51d558-2129-4471-8ba6-cb4b9efe1ede", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c8f429a-09fa-43fa-a416-221c3b45b495", "sighting_of_ref": "indicator--a0ca7cd5-e580-475c-8412-af0248097376", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b128bb5-b848-4976-8fa6-c36f690107c8", "sighting_of_ref": "indicator--642a3241-3321-4828-9956-28bb2328514f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cd67a42-44e4-43da-9f17-bd1271fdeca5", "sighting_of_ref": "indicator--0f9058d3-cff4-468a-82ed-57e966cff346", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb25856c-cab9-4a04-9026-3f4ccba0e799", "sighting_of_ref": "indicator--0f9058d3-cff4-468a-82ed-57e966cff346", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c176160a-e409-4a88-9b13-2c1b0f7be30e", "sighting_of_ref": "indicator--52d630dd-3478-499d-a3e0-6c4c985dedfa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d13c1ff-c458-4383-8e38-5a4eac88bcb9", "sighting_of_ref": "indicator--52d630dd-3478-499d-a3e0-6c4c985dedfa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19bda7f2-0033-4a8d-a090-56c7d8d9bfc6", "sighting_of_ref": "indicator--5e4f2836-b90f-4f22-adf4-eaa2ad7ba317", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87f8a3c2-6b8c-40c1-a787-aaf3781669f0", "sighting_of_ref": "indicator--5e4f2836-b90f-4f22-adf4-eaa2ad7ba317", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d920f0b9-8779-4276-b120-0a4fe08b1baa", "sighting_of_ref": "indicator--8160dca7-e81e-46df-8c1d-278d1c1dc78b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3e37c0c-91e9-4afc-bf92-51806ad1874d", "sighting_of_ref": "indicator--8160dca7-e81e-46df-8c1d-278d1c1dc78b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74926d02-fc80-49bc-9dc4-7ebc970fd8d6", "sighting_of_ref": "indicator--35ae3902-a592-4c38-b499-4c03e510bcf2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4466717d-40a5-4fd8-ad3a-beea98582ed5", "sighting_of_ref": "indicator--35ae3902-a592-4c38-b499-4c03e510bcf2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10b53115-6000-40ef-86e6-413ef61b3edd", "sighting_of_ref": "indicator--1a6ecf32-6d04-4eee-b774-1e9b9caa878f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f845fd56-5c6d-4188-954b-a1a81dd22f6c", "sighting_of_ref": "indicator--999b5da8-cc8d-4417-b282-a8c47b82b176", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5b5470a-c6f3-4ded-8154-083b11f740c0", "sighting_of_ref": "indicator--999b5da8-cc8d-4417-b282-a8c47b82b176", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a620887-7222-4522-8190-504b788d41cb", "sighting_of_ref": "indicator--4fafb569-a2c2-48ff-979a-c9f95cc4683b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ef12583-c2e2-45d4-b332-a39608e8965f", "sighting_of_ref": "indicator--a07607f5-186a-44c9-b0ab-410a46b0b94a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf0288be-22c5-4183-974e-e1b23513693d", "sighting_of_ref": "indicator--ef9dfefc-b835-4d95-9a50-58315c29a83b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2815c5f6-a46a-4106-9726-1f048437e304", "sighting_of_ref": "indicator--ef9dfefc-b835-4d95-9a50-58315c29a83b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f62e76f3-bcf6-424a-b392-292e208fdc23", "sighting_of_ref": "indicator--7985bcb6-56a0-40cf-80c6-d29d06b0758a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e19db529-a2a0-43ca-951b-efccae1be680", "sighting_of_ref": "indicator--7985bcb6-56a0-40cf-80c6-d29d06b0758a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef64691b-2f24-4b2a-baa5-836ddd3c805f", "sighting_of_ref": "indicator--2b361f9b-9e60-40f5-ac84-bf0e22d19b84", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--931de024-7517-4230-ba7b-e6a12537328b", "sighting_of_ref": "indicator--c0ef3ac0-735d-46e1-afa7-caca03cc5d8b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b77bff17-2688-4a63-9cd4-4506c6b2d907", "sighting_of_ref": "indicator--c0ef3ac0-735d-46e1-afa7-caca03cc5d8b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0a4503f-7f65-4158-949b-8330fd2c13e9", "sighting_of_ref": "indicator--720dff46-b23d-4ba4-9aa1-7bfc618abeaa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4861550b-d063-458f-8399-2efca7105407", "sighting_of_ref": "indicator--720dff46-b23d-4ba4-9aa1-7bfc618abeaa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0e29712-5d1f-4e4d-9648-abaf46354a57", "sighting_of_ref": "indicator--7dc3dcfc-60ca-4d26-ae95-66d9a01999fa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1fbcdac-b328-4fb7-8607-2ed1355af85b", "sighting_of_ref": "indicator--7dc3dcfc-60ca-4d26-ae95-66d9a01999fa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1f76cfc-7940-4f59-a5de-2170d3a392a2", "sighting_of_ref": "indicator--df240f4b-7c7d-4631-9289-39cf08928524", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2cfd5e7-acf9-4acb-b8e3-fac434430d47", "sighting_of_ref": "indicator--8a59672e-4a88-4cf6-af97-63b8fd2c4336", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9356d733-b5cb-4a48-9ab1-152065929fd2", "sighting_of_ref": "indicator--aa032931-7528-4ad1-9a44-1b021e1ceeda", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7f8c2d0-8d3d-4549-908d-f97a0cd0406d", "sighting_of_ref": "indicator--9c12e25f-8761-4521-a4be-75b8882710c6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f96de0c-2e1b-496a-9ce3-9b5ae4f33e4c", "sighting_of_ref": "indicator--9c12e25f-8761-4521-a4be-75b8882710c6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7713c05-5897-4671-a0a6-da62e3d8e245", "sighting_of_ref": "indicator--0c79a7e2-47ce-43cd-aae9-57ee00ad6dbe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1abc1f88-c1f5-4b12-9775-11f8996d88e1", "sighting_of_ref": "indicator--78b227ce-a437-41dc-a1ef-0798b3292d01", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6497e67e-90ad-40ab-8c32-7a753ad7e822", "sighting_of_ref": "indicator--d81d79c2-5043-4881-96d7-2f3e258dc26b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb004144-699d-4a30-bc62-2325bd35d6e0", "sighting_of_ref": "indicator--33ec208d-a39b-488f-a634-8399421fcc80", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7171b75-c6ad-4442-8791-f9688a4d17be", "sighting_of_ref": "indicator--465f2d89-d81f-41a9-8828-aaf22a352c66", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f31eeda-b61c-4f12-8f14-d71d21854280", "sighting_of_ref": "indicator--c8750f59-0df0-4ceb-a51b-3df18514d019", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e61329d6-da8a-4d75-ba4d-c229b19d2f77", "sighting_of_ref": "indicator--98611d0b-89e3-40b1-b7da-40cfdadb6fc3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee4ab9af-2203-48e8-87f2-d8512652be48", "sighting_of_ref": "indicator--1d1698f8-64a5-4130-847d-10b7acfa0a71", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e85621db-91e5-4c9e-9ac5-cccb3b9dec3a", "sighting_of_ref": "indicator--e85ed528-37c3-4ac2-bd8e-905adf200dec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef919e00-b0ab-4422-a781-691278d67c33", "sighting_of_ref": "indicator--e85ed528-37c3-4ac2-bd8e-905adf200dec", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4230a0eb-c50b-4bc8-81dc-fddb0fa13bd8", "sighting_of_ref": "indicator--566e90b9-1e9d-4389-a87a-582fe53be69d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58189d88-eb23-4cac-99a4-7bf7e6d47fb9", "sighting_of_ref": "indicator--566e90b9-1e9d-4389-a87a-582fe53be69d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0403bd69-0321-4e1f-90ed-68c495ba645d", "sighting_of_ref": "indicator--9e8f55cb-e248-44d1-b44b-5a242b2d6716", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee0540ba-7bd3-4cea-936a-aa958e40776b", "sighting_of_ref": "indicator--a8c57818-5ed6-484f-a2a2-9e293c855276", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0905b33b-9dc4-4cc3-94ce-cff97cae022f", "sighting_of_ref": "indicator--39dd31f1-8e92-4674-9596-9de6f8a90893", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b0b80d2-dfca-41f7-8586-12c5e53c61bb", "sighting_of_ref": "indicator--fc8953f4-4ab3-4260-b347-e923db1852a7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e06e06a1-9c10-40cc-bcc1-0be0b91dd572", "sighting_of_ref": "indicator--fc8953f4-4ab3-4260-b347-e923db1852a7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c967fb1-d280-4ef3-9c7f-f9da74350617", "sighting_of_ref": "indicator--f2834bed-e7b0-4f52-99af-71f542f48a95", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34f1a1a3-06ab-418f-8600-735e0be9ff42", "sighting_of_ref": "indicator--f2834bed-e7b0-4f52-99af-71f542f48a95", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--605997b3-c963-4ff6-8493-35e9c6c2071e", "sighting_of_ref": "indicator--2f09cbba-0e23-4e35-a802-76dd1822ee35", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--356f5e0b-749b-4d52-aa4d-ba4391f56ae6", "sighting_of_ref": "indicator--2f09cbba-0e23-4e35-a802-76dd1822ee35", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04e48de6-8483-4ef9-bba9-932792aed33e", "sighting_of_ref": "indicator--da336969-78ef-40d7-a13c-847ba3b74e4d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f31cc7c-57b0-41d9-ab29-ba9be212c406", "sighting_of_ref": "indicator--da336969-78ef-40d7-a13c-847ba3b74e4d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e80b91ca-ef75-40bc-ad8c-03c58001e0ed", "sighting_of_ref": "indicator--dc5675c4-b4e5-4608-b5a2-2d4818ea1443", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55377daa-730f-410c-9972-f60c593a5b14", "sighting_of_ref": "indicator--dc5675c4-b4e5-4608-b5a2-2d4818ea1443", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99ecedce-39ad-4e59-95da-d6b026344211", "sighting_of_ref": "indicator--6d2bb719-330e-499b-a068-7081bac65c0b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37fa0dff-32af-4246-930a-5cee5ed20616", "sighting_of_ref": "indicator--6d2bb719-330e-499b-a068-7081bac65c0b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15860f5d-7dd3-4f58-9e7c-fa325d2a93de", "sighting_of_ref": "indicator--0ff8d8e3-3101-4bc7-a611-07ec9d7710b4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3164e6fe-76e3-4c91-94f1-07fa5770246d", "sighting_of_ref": "indicator--47d0f897-9af1-48c7-b96b-b2f6cabad8c5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30c76477-fbae-4c7b-b887-eeedcc135d77", "sighting_of_ref": "indicator--778fe931-d417-44cc-b2e2-e6266367fefb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0163b644-152f-49ba-91eb-2ca083ac0ca3", "sighting_of_ref": "indicator--b10bacc4-078f-42b5-9d6d-25338a9f4891", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e509cae-556b-4504-8625-79700a987fab", "sighting_of_ref": "indicator--99bfc855-213f-49d2-bd79-68752957fed3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c69aba18-8912-46e1-a1aa-9decb10c5267", "sighting_of_ref": "indicator--f1f5b6b6-607d-4ad8-96ac-a18381da6dd3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4680f548-ad87-453b-8c91-47e5a3876f3e", "sighting_of_ref": "indicator--acb62116-f694-4400-94e6-685c2dd113ed", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0304404-a6e6-4327-a5c1-7c99f94845de", "sighting_of_ref": "indicator--591be1a6-31ce-46ec-a7e9-d362008704da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fea7157-2809-4795-9a8b-48a483633830", "sighting_of_ref": "indicator--d321108b-a6db-4e1f-94ee-2762804579b2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--747f26ba-1813-4f94-8bc0-ff31ba85ce19", "sighting_of_ref": "indicator--d321108b-a6db-4e1f-94ee-2762804579b2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58a437ae-5329-4876-8174-ac3b85b4d556", "sighting_of_ref": "indicator--83282d71-89c4-4d38-8950-2543b79a1615", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bbe0589-313b-4bbb-b3c2-c1b41382eac1", "sighting_of_ref": "indicator--c773e362-f6be-47d9-9f8f-f9cee161c99a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c49ee1e7-c13b-4cd8-a4b3-d5edfcb386c8", "sighting_of_ref": "indicator--accbbc7a-4365-4c5d-ab93-59b9e944c4a0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d585946a-ee3c-4163-8c1b-a8519272a78f", "sighting_of_ref": "indicator--295afef9-675f-42f0-bb7d-f209ac0764a1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cb6efc6-985b-4dbf-89ec-5b7ad1b0814d", "sighting_of_ref": "indicator--da08bb07-f75c-48ee-bc82-b3ce3fd4a71b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6834769-92ab-4cde-81ba-f3e8ada69341", "sighting_of_ref": "indicator--649eda7a-d75f-4a69-aaa8-bcf78f50e577", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d850ede2-1b25-4989-8653-7b53093fd97a", "sighting_of_ref": "indicator--66b70192-450a-4862-aea9-672a7035cb7b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35400584-3d57-409b-8252-581d6dc88f42", "sighting_of_ref": "indicator--0a5ba6cd-f0e2-4732-b4b4-e6203504d5ea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ad366cb-de40-43a9-af0f-54e5a84673b4", "sighting_of_ref": "indicator--0a5ba6cd-f0e2-4732-b4b4-e6203504d5ea", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfdaec25-ec70-4a61-b870-eb6ac66c5d1c", "sighting_of_ref": "indicator--88a6db54-30ba-4456-8818-2c118bde8a22", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2f42302-d605-479a-9e8b-6f892919c237", "sighting_of_ref": "indicator--88a6db54-30ba-4456-8818-2c118bde8a22", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1edf8547-1d16-4c23-815c-e8077343fcef", "sighting_of_ref": "indicator--f9c9ec04-a43e-4de6-bbf9-75f7b3565d01", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0d37fdc-4eee-4d45-a31b-a1a569e3b0f2", "sighting_of_ref": "indicator--f9c9ec04-a43e-4de6-bbf9-75f7b3565d01", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f67d3e3a-9dce-4ce3-ab25-deaa824d566c", "sighting_of_ref": "indicator--d531d60f-cc31-4a1a-8af3-bc2da9dff9e0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd40cfa5-465d-43c6-bbc7-1a29980291ea", "sighting_of_ref": "indicator--d531d60f-cc31-4a1a-8af3-bc2da9dff9e0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebe6416c-50d2-4c2b-bf9f-0065b705d84f", "sighting_of_ref": "indicator--b736458c-d9d1-4fd3-b6ca-71e4fbaae5d5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ab317a7-7140-4096-b487-e8c2f2f0a388", "sighting_of_ref": "indicator--b736458c-d9d1-4fd3-b6ca-71e4fbaae5d5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b96152ac-b721-4fdf-adcf-230e75c9c189", "sighting_of_ref": "indicator--f3c6b66b-4d6f-48fa-bcdc-9779d1c2a377", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e9d2d42-f649-4e60-8e68-804b54032aae", "sighting_of_ref": "indicator--f3c6b66b-4d6f-48fa-bcdc-9779d1c2a377", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b09f6e81-1855-44de-9963-a793d2d718d6", "sighting_of_ref": "indicator--dafc86fd-ad0e-4a11-a77a-9565151e994c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--769e81ca-7556-45e9-b7ac-e55c1e6a32cc", "sighting_of_ref": "indicator--8a2bbcfe-3984-49a6-9990-fac6612ad094", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--244fd01a-3c06-4cc2-916f-236a752b33c5", "sighting_of_ref": "indicator--616044f9-b2b4-4a5c-8424-5dd9ef085050", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a995ddc-5e6d-4476-99fc-bdab81a7887f", "sighting_of_ref": "indicator--9f6e2d64-ac8c-47b9-b76d-c0889a5f5bf4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac27fbb3-ef36-448e-b0dd-87d03b9f23af", "sighting_of_ref": "indicator--9f6e2d64-ac8c-47b9-b76d-c0889a5f5bf4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ecb7fee-9016-4892-b244-574b52da1b67", "sighting_of_ref": "indicator--971ba8e9-742f-4623-ad77-4265c24201f4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58ff8533-cdcf-4a55-a1ce-cfe97a589268", "sighting_of_ref": "indicator--effd2322-ced5-4835-9caa-3d671e6d8ee3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11aa02c1-9570-4297-b843-6648af364017", "sighting_of_ref": "indicator--effd2322-ced5-4835-9caa-3d671e6d8ee3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--777358ed-1589-481e-8f9b-6f56acf82c00", "sighting_of_ref": "indicator--9375e620-29b8-45e0-9353-61570e96d8f8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abaa202a-f62a-4049-9be6-1afe983130df", "sighting_of_ref": "indicator--9375e620-29b8-45e0-9353-61570e96d8f8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f07f4a06-c45e-44e7-88f2-77914498765d", "sighting_of_ref": "indicator--5c7860a1-2b7a-4a4b-8247-29a2a15502e4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--097a4333-30ba-4875-ad33-33c8fca3d23e", "sighting_of_ref": "indicator--5c7860a1-2b7a-4a4b-8247-29a2a15502e4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d03adfe-069e-44fa-b000-0ef3b3faa032", "sighting_of_ref": "indicator--487ff3c8-92b5-40ee-9a0a-f0ea5bbd0372", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3380afbd-5a1d-4eb1-90ae-f2661b772ecc", "sighting_of_ref": "indicator--487ff3c8-92b5-40ee-9a0a-f0ea5bbd0372", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f176eb7-728f-4b96-8bd8-7065049d15c9", "sighting_of_ref": "indicator--f6fb8988-c5cf-49f9-b7c9-afba7c3241e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be184f56-c005-4ef4-a35f-6a3963bdefe7", "sighting_of_ref": "indicator--f6fb8988-c5cf-49f9-b7c9-afba7c3241e6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76a45e81-6382-4e74-bd2a-a228725c6786", "sighting_of_ref": "indicator--c0bad849-af2f-40e0-804e-1c65d6a76fbb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a31b708-ac16-4d84-8848-71bebedb3835", "sighting_of_ref": "indicator--885396c7-bcf0-421e-892c-4ba3158e83b9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a556ea94-c9b0-48b6-bfec-938946a15ee7", "sighting_of_ref": "indicator--885396c7-bcf0-421e-892c-4ba3158e83b9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee472e8a-048f-41eb-87ea-852b3f76d15b", "sighting_of_ref": "indicator--240ff185-e7b9-41c8-b41c-49cbb1c6c97a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c218ea68-f585-4d1e-b3dd-89d82361e6e0", "sighting_of_ref": "indicator--240ff185-e7b9-41c8-b41c-49cbb1c6c97a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34f398fb-5c33-4874-8973-1175c25049d7", "sighting_of_ref": "indicator--6901e27f-808a-4a90-8656-dbaaf057cba4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ad09ea3-119e-40b9-a722-d55da1adece7", "sighting_of_ref": "indicator--6901e27f-808a-4a90-8656-dbaaf057cba4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25f9c2eb-0e0b-4da4-b07e-daf4693e4e55", "sighting_of_ref": "indicator--268fbd22-e9fd-4e0f-9c7b-bcbf1df5b3e9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3c60ab4-ce01-4420-8a1f-363a5185f3bc", "sighting_of_ref": "indicator--268fbd22-e9fd-4e0f-9c7b-bcbf1df5b3e9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18ac45ae-a9fa-4ba2-b020-0ee35ef371ed", "sighting_of_ref": "indicator--8b3416e5-170f-42dc-8438-625d16419896", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76619ba2-8d7b-4b43-8efb-2d0db908a462", "sighting_of_ref": "indicator--8b3416e5-170f-42dc-8438-625d16419896", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b223f95b-288f-4895-9971-b0eb5fa9712c", "sighting_of_ref": "indicator--ad15821c-9d78-440b-9f6c-9971a912c0fe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7057aa3b-8d45-4c3f-b36b-ce6118f25fbd", "sighting_of_ref": "indicator--ad15821c-9d78-440b-9f6c-9971a912c0fe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5aa0627e-b162-487f-9045-25e3639b1ebb", "sighting_of_ref": "indicator--7b6e3a05-5c90-43df-ac07-a65965c62474", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1409416b-9fb1-4bc7-9c5d-e1a38414091d", "sighting_of_ref": "indicator--7b6e3a05-5c90-43df-ac07-a65965c62474", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c805cc0a-ed76-498e-a0b1-a87530f46d6d", "sighting_of_ref": "indicator--8bcd1c1b-54ae-492f-9350-11c3707ca31a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2964d47a-9972-453c-8d72-e47ae12e0a88", "sighting_of_ref": "indicator--f7d34d81-206d-4d57-87b6-72e96b9e2136", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b45a2bd-cf0d-46b6-ad4d-1d75691c0da2", "sighting_of_ref": "indicator--6e028884-dd7d-4cb9-943f-b2b52351a7a7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96c49ee6-739a-439c-8539-83cd07675c79", "sighting_of_ref": "indicator--7a4d654c-d0dd-459d-9649-905569956097", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a7e6612-580d-461a-bcfd-8bbcc0ee7d62", "sighting_of_ref": "indicator--a834782f-9b50-4fbb-bd2d-0ccf55e441c2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e87170fe-67e1-45d4-98f4-3fee96cbb44e", "sighting_of_ref": "indicator--3610a454-e45f-4e2a-9cce-4f17559b46d4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01c37636-205d-45b2-b9a5-fe2d7c27bf43", "sighting_of_ref": "indicator--e1623e82-c090-4889-8086-5d8a577408e0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--341b0d3a-7447-403e-8b69-ca399336b8db", "sighting_of_ref": "indicator--e7259adb-b392-4b93-911b-7dc0d950a033", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a736b791-f4e2-4610-90bf-dc19a364f239", "sighting_of_ref": "indicator--a6ebb202-7eea-489f-844c-f0946bb10d9f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d3ee46e-d051-4c72-9afa-4807cf82fd08", "sighting_of_ref": "indicator--09c33b63-8d7f-4ff5-ba55-9081d61160c2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08d67e4c-2760-41ed-b1a8-53094ff593be", "sighting_of_ref": "indicator--33e3d64d-dd92-46c8-9f63-33e6da742693", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29b776bc-84e3-408a-9e80-480b746c5b52", "sighting_of_ref": "indicator--c25ce4d6-388a-4d36-9847-151aa9904c1f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6b4f430-5f41-43aa-8a4d-32236b3d2b89", "sighting_of_ref": "indicator--c0c50cba-e0ae-48e3-aeae-21667720da55", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--feaad389-7340-4726-827a-f49fa818b4b4", "sighting_of_ref": "indicator--d9e0a792-77d0-43bd-8bf4-cf553575d33b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--407d2c6c-4138-4521-bab5-d4b578e8df95", "sighting_of_ref": "indicator--d9e0a792-77d0-43bd-8bf4-cf553575d33b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a31c9ac3-76a6-47d5-a2b9-611c445ec81c", "sighting_of_ref": "indicator--94b4db46-e661-4442-84b4-3c6ae98d20e3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--710b84e4-83ac-400f-b457-15b9a027adbe", "sighting_of_ref": "indicator--ad83c0de-d3f1-472c-a9e0-8d7c773ffe2a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23855659-3ebd-4a8c-bdbe-5cccacd731f6", "sighting_of_ref": "indicator--674f02e5-128e-4e81-a922-c60ef845a31e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9de54331-0bbe-4e43-be05-953ccf51ac64", "sighting_of_ref": "indicator--674f02e5-128e-4e81-a922-c60ef845a31e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c4b1778-1f57-4e56-a7fd-0d044a697e84", "sighting_of_ref": "indicator--53e9ea7e-fef8-49d3-8b08-f7093ce7b0aa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0723a8a3-97b7-43cf-9c8d-6b5be884f501", "sighting_of_ref": "indicator--6b595ce2-5ec7-404b-a594-1b26c8237c3a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61d6d84c-dfbc-4b4a-8efb-3d15c39b2a06", "sighting_of_ref": "indicator--6b595ce2-5ec7-404b-a594-1b26c8237c3a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09ec9501-3b77-4d26-9d5e-1ef3fe04b762", "sighting_of_ref": "indicator--75b9eecf-6de5-4272-a0c2-46bc82b410ba", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c332ae05-34ed-4c0a-ac76-91b36bf684f6", "sighting_of_ref": "indicator--75b9eecf-6de5-4272-a0c2-46bc82b410ba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08a11088-04e1-4cec-95c9-c497d4acfed5", "sighting_of_ref": "indicator--ff819e40-19d9-41ca-ab5a-dcfb3b38ff1c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8c19f71-cac6-491c-bc41-96cfa37a6388", "sighting_of_ref": "indicator--ff819e40-19d9-41ca-ab5a-dcfb3b38ff1c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cf4164c-ac20-4555-b762-45bbedfeceed", "sighting_of_ref": "indicator--04e87238-8cc0-4ec3-bcbc-0cbf30e7f28a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2406085f-00f1-4011-9801-643faa74f931", "sighting_of_ref": "indicator--37a1cd5c-8ef3-4e3d-9a0d-1d30fb3f50ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bdb1e7b-abd9-4f72-b366-2a151688c652", "sighting_of_ref": "indicator--907aac52-e403-4458-a6d1-fbdc975f28b5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b204390-8054-4278-b469-700ad9f9d767", "sighting_of_ref": "indicator--907aac52-e403-4458-a6d1-fbdc975f28b5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc412d40-f82d-4bc8-9b58-9847fb23d5ae", "sighting_of_ref": "indicator--830e2cae-f88a-4144-b010-16674111736c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b83d705-6efd-424a-9f8a-52c9087b0c37", "sighting_of_ref": "indicator--830e2cae-f88a-4144-b010-16674111736c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c64bb319-478d-4973-afa6-2b3d772cbaf7", "sighting_of_ref": "indicator--d5a664e9-92b6-4d17-b49a-762ef304a5ca", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5285b519-410c-4697-aa9e-2900c0c08bdb", "sighting_of_ref": "indicator--d5a664e9-92b6-4d17-b49a-762ef304a5ca", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c67ce06-eaa8-41e5-aba4-70f673fae1a3", "sighting_of_ref": "indicator--f826efd4-c22b-410b-879d-b254a6958182", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60b13440-4ee6-4760-971a-acbbbfddb3c1", "sighting_of_ref": "indicator--f826efd4-c22b-410b-879d-b254a6958182", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a268a467-23df-447a-8448-7a0b1309a4e4", "sighting_of_ref": "indicator--74875cb7-6eab-45e2-a223-e00521623d6b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5fb1cab-79be-4bca-83a5-4b3a48c66718", "sighting_of_ref": "indicator--74875cb7-6eab-45e2-a223-e00521623d6b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41b28861-7a29-4b8c-9f65-d422d34410ce", "sighting_of_ref": "indicator--c6f90620-27e0-4196-bc35-f6ed0a08cc96", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8109928f-9289-48e1-a46d-9f7735776ee5", "sighting_of_ref": "indicator--886e9086-cfb2-44fe-bca8-84bd09bcc495", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb6bb188-f63f-4ade-9d0d-84719a0bb0e1", "sighting_of_ref": "indicator--015baeae-e9f3-47cc-a203-835fe85634be", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00b3aa0c-4446-405f-9032-7d6605789e20", "sighting_of_ref": "indicator--d8393599-e573-43bc-a3a3-1e0f0c2d169a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fa451c2-a271-477c-96cc-0ab430dc9127", "sighting_of_ref": "indicator--e0095a83-bb1e-4f68-90b4-570db3e26a4d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0650726f-cef9-40ae-957c-244ca0ddff0f", "sighting_of_ref": "indicator--e0095a83-bb1e-4f68-90b4-570db3e26a4d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db16d8d0-3f46-4b83-a170-ee43d7856fe2", "sighting_of_ref": "indicator--3b1e54f9-46d8-4acc-9d35-25b4dcc60f93", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b16a4a07-7a15-4c5a-b0cb-a3d8e8d7c521", "sighting_of_ref": "indicator--3b1e54f9-46d8-4acc-9d35-25b4dcc60f93", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb86818f-f96e-435a-9b3f-a335cadb03fe", "sighting_of_ref": "indicator--d55a7013-0b01-492e-b01d-8ba2fd7244bc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--905a096d-9e18-436e-8a02-0de45b839087", "sighting_of_ref": "indicator--d55a7013-0b01-492e-b01d-8ba2fd7244bc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c182a681-3e50-46b9-82ba-06021dca31e8", "sighting_of_ref": "indicator--ae2656b7-a0b9-467c-a7a5-bd9de013ee59", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8c50aa7-4204-4027-836b-991aecb01e2b", "sighting_of_ref": "indicator--ae2656b7-a0b9-467c-a7a5-bd9de013ee59", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba043450-b21c-446f-861e-af4fec3a51ef", "sighting_of_ref": "indicator--8209d129-8b0c-4f88-9cf2-053f13183346", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca33d950-8ca4-4e6d-8665-a794e8ea71d2", "sighting_of_ref": "indicator--9d880709-04dc-46f3-bb11-33b66aa37a24", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4e2f375-c150-48d9-8477-c3d7f7e0a3d9", "sighting_of_ref": "indicator--3bc346e6-63a8-4af7-bc4d-7ecf24fbf6e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44044076-a9d4-45c2-98b9-1e79252b3509", "sighting_of_ref": "indicator--3bc346e6-63a8-4af7-bc4d-7ecf24fbf6e1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6266db6-7124-4f86-a6a8-b883a2a0f623", "sighting_of_ref": "indicator--87b96c37-68b8-4e13-94f6-8ad43779434a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58f556a8-7058-444e-83ac-7aac2786020d", "sighting_of_ref": "indicator--87b96c37-68b8-4e13-94f6-8ad43779434a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d33a4f49-1f5e-47df-9550-0f159f8357d4", "sighting_of_ref": "indicator--b0683d36-05de-4a96-ae9f-b0e9da348d0b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd79312e-346e-456b-870a-66075b850879", "sighting_of_ref": "indicator--b0683d36-05de-4a96-ae9f-b0e9da348d0b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00168753-249c-4814-99bd-2860ee860723", "sighting_of_ref": "indicator--184600f2-60ac-481e-b205-6f41ca51c497", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--854d1a38-04d6-41d3-8edd-a7e5a01a67a0", "sighting_of_ref": "indicator--5b57e7ef-5d33-428f-bec8-4a33c1173899", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--083e29f2-c900-4f3a-8512-5776c79aa94b", "sighting_of_ref": "indicator--b6a9ae45-16c5-4a93-bee0-963bcbe70c52", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af046492-168a-4da9-8007-b15fa13cbd48", "sighting_of_ref": "indicator--b6a9ae45-16c5-4a93-bee0-963bcbe70c52", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ffff6b0-9ced-425f-9799-59b592f99742", "sighting_of_ref": "indicator--6d8e14db-8094-4129-98bc-a25d5008d200", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee0ad8a5-b734-4b83-9a62-b775151e4254", "sighting_of_ref": "indicator--6d8e14db-8094-4129-98bc-a25d5008d200", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfcadfc4-9208-49d4-8d67-5acda4a9133a", "sighting_of_ref": "indicator--04c36f6f-231b-42c9-bc69-cee2f41d9fe5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15af8f8b-6f8d-48b8-858a-2a7b4f9aea98", "sighting_of_ref": "indicator--04c36f6f-231b-42c9-bc69-cee2f41d9fe5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a99f66be-8c53-46ab-906d-0cc84bc8f3aa", "sighting_of_ref": "indicator--968384b1-a6a2-4921-a069-0897c4c6b672", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--560efb48-71af-470d-9c2a-431afaa5c13e", "sighting_of_ref": "indicator--3ea68e50-bf34-4fdc-8f87-780bd5854343", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5e50abb-94ce-4101-b62c-57db35f577a7", "sighting_of_ref": "indicator--c4a6e98e-69b2-497f-a7b1-6c24f243e00b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d11d310-b58a-4ec2-ba83-97ff90aeff5b", "sighting_of_ref": "indicator--c4a6e98e-69b2-497f-a7b1-6c24f243e00b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2029c012-5155-4e3a-9ee4-4005a9c8722b", "sighting_of_ref": "indicator--5f1a0df2-b59d-4f2c-981c-7cec8f57e0bb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5ef3fd0-2bfb-4465-8f85-06f359108d26", "sighting_of_ref": "indicator--a03f5d7e-6f63-47e1-a5a3-1ae123a1b542", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5968cabd-89bf-4fd6-8c01-fea9380c9385", "sighting_of_ref": "indicator--e1444f5c-9201-4ccc-94ad-7ae327aa93a9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88a0b242-32b6-497f-b87a-a1c071f9f1f8", "sighting_of_ref": "indicator--e1444f5c-9201-4ccc-94ad-7ae327aa93a9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7fb40b6-9bb6-4b2a-97f3-9afc35d30038", "sighting_of_ref": "indicator--a8f476b2-ad4e-4108-8192-93d5351fba09", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76149308-c467-482a-9c4a-05a0c84ce495", "sighting_of_ref": "indicator--e7bba666-1149-40dc-acf2-0b690f679ec2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--963b956b-aff1-49e1-a6ce-206dc298f89c", "sighting_of_ref": "indicator--e7bba666-1149-40dc-acf2-0b690f679ec2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f96da26c-5842-4d38-898e-5670d6cf44ba", "sighting_of_ref": "indicator--e76d5a2a-c314-4814-ac2b-3271a07809b2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6ec5216-c029-40c8-95d7-2b67ba2d6ed0", "sighting_of_ref": "indicator--e76d5a2a-c314-4814-ac2b-3271a07809b2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8501b585-8a69-43ee-93ae-4107bdab10da", "sighting_of_ref": "indicator--f6278950-8143-4c43-ae77-c140e8a418d4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b3eee4e-9272-4f38-ba68-8274d62989b7", "sighting_of_ref": "indicator--28aa9976-9953-4f0d-a774-6424d2c0340b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8453e8eb-943c-4103-ae04-799d74b7a584", "sighting_of_ref": "indicator--c82450ee-1dd4-43f1-b003-11ae9c524739", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15df2057-f0b0-4726-83b9-2e691975e220", "sighting_of_ref": "indicator--c82450ee-1dd4-43f1-b003-11ae9c524739", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c00aacff-e8dd-43ac-ad3c-10d86426704c", "sighting_of_ref": "indicator--8fd39673-7ecb-4865-a454-c6b40669567b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52cc7c3c-e236-42de-833b-c751a894b8d7", "sighting_of_ref": "indicator--8fd39673-7ecb-4865-a454-c6b40669567b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14d17b2f-c202-4108-a81b-4421e56362bd", "sighting_of_ref": "indicator--ca4f45af-62cb-437f-87fa-9232250d0320", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14fb2a4b-1513-40d0-8304-2e34c0656956", "sighting_of_ref": "indicator--93d575d3-9089-49e9-ac97-0f4df0ba468d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5152171-d722-49e0-ac47-184e4cf345a3", "sighting_of_ref": "indicator--cb2f9f3d-2ef1-49a4-bae5-517c36b5452a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--582c1880-fe51-40c5-b06e-944f52c56f8d", "sighting_of_ref": "indicator--2f60e7a6-353b-4369-a8b2-9b8a2478561c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c70c514-4676-4f98-9953-4977e5aa9171", "sighting_of_ref": "indicator--3d1870f2-6b48-4b84-bac1-3c1fea8924ad", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c23562c5-432d-4807-a67d-a24433fc2bc0", "sighting_of_ref": "indicator--a160e07b-23c7-4947-801a-13c89d422eed", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f01fb36-a466-43fe-964d-07e90c327901", "sighting_of_ref": "indicator--b73d922e-dbed-44d4-946f-b7945f55fe5e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4461260-fe56-4493-bc46-7ab6fb498cd2", "sighting_of_ref": "indicator--27fe5682-ba62-4a57-a65a-453ffa7cbd8b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d2abe87-8b24-41c9-8182-49c5b9440bc6", "sighting_of_ref": "indicator--27fe5682-ba62-4a57-a65a-453ffa7cbd8b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1c6875a-6471-4914-aa8f-5c777e1b888c", "sighting_of_ref": "indicator--523bd342-26bd-4965-93d6-440add100323", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b0262b6-f800-4db5-b6bd-7e0dfdcc3097", "sighting_of_ref": "indicator--523bd342-26bd-4965-93d6-440add100323", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c6405f2-bcce-47ae-9329-e453edc1e9f8", "sighting_of_ref": "indicator--29aacbdf-da5d-427e-b6e1-30a4367b56f1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--440f67a4-d699-4f7d-a7f0-3ed75ee760b1", "sighting_of_ref": "indicator--6d61bc13-e4d5-48bb-8c7c-5896b4bcbd92", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc178d14-58e3-4f04-b978-cc9130b20899", "sighting_of_ref": "indicator--6d61bc13-e4d5-48bb-8c7c-5896b4bcbd92", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dacf13bd-5020-4d64-a9d0-fd5157d094c7", "sighting_of_ref": "indicator--ad5b93d9-1c6b-4a94-95c9-6e0737d5d15a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0002c787-cd64-45cd-9114-0ddb2fc4b5f0", "sighting_of_ref": "indicator--ad5b93d9-1c6b-4a94-95c9-6e0737d5d15a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ad89843-b7bd-42cf-962e-a77588411bdc", "sighting_of_ref": "indicator--3d5e85e1-0488-4484-b37e-3c81e1d507e5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e592492-0d2e-4c5b-99ed-74d22808db62", "sighting_of_ref": "indicator--3d5e85e1-0488-4484-b37e-3c81e1d507e5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e985672a-06b8-4f0c-a270-ab98a85968dd", "sighting_of_ref": "indicator--16f3f8bc-cc8d-4d43-b7a6-260dd5c8ded7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a48334b6-8d81-4c08-b79c-c882b813a153", "sighting_of_ref": "indicator--16f3f8bc-cc8d-4d43-b7a6-260dd5c8ded7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14f527eb-6b63-4123-a820-af354cb56718", "sighting_of_ref": "indicator--0ce2ca52-d55e-42e1-bafd-64b7cc26a132", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f819226-9100-4720-9e32-577b30ba4d53", "sighting_of_ref": "indicator--0ce2ca52-d55e-42e1-bafd-64b7cc26a132", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f8d51a2-5252-48d4-806c-76c00b89594b", "sighting_of_ref": "indicator--4f39d86d-5b1a-46c2-b9f0-21de91e791bf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec1b6080-8989-4ec8-b0f3-57b45ad11059", "sighting_of_ref": "indicator--ca62eca9-1d78-4cba-b10d-1f266c794e7b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43c5dd0c-b08a-43a3-aa64-a4db2c556dfd", "sighting_of_ref": "indicator--6d7dab38-a4f3-4f64-b4b7-826e4b08d4fc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d1ca003-34e4-4069-82f3-a076647b74c5", "sighting_of_ref": "indicator--6d7dab38-a4f3-4f64-b4b7-826e4b08d4fc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cfed72b-c59b-4e08-8058-2ceebbccc9b3", "sighting_of_ref": "indicator--7cc973f4-09e5-465d-97aa-8101d9875337", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86ead815-910a-4c2e-824b-e9886304c866", "sighting_of_ref": "indicator--297edf59-0a10-4604-a4dd-d61acedf6d11", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58d43fb1-fc48-463a-9b9b-2a69ef5051c9", "sighting_of_ref": "indicator--fee75ac5-e6bf-483f-ae6e-3dba997737a4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8b2e6c4-73a1-45fe-99c3-eaaa0fb797cc", "sighting_of_ref": "indicator--fee75ac5-e6bf-483f-ae6e-3dba997737a4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--879d3b0b-e324-4886-9879-857b5adc5353", "sighting_of_ref": "indicator--c710495f-b87f-4b38-9a6f-0032d89487ad", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c2176e3-ec2a-4897-baba-80733d4dce8a", "sighting_of_ref": "indicator--c710495f-b87f-4b38-9a6f-0032d89487ad", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7510b9fa-d51f-470e-89c7-7c62fb321264", "sighting_of_ref": "indicator--c4626463-5358-45b8-8070-d21f1b79f0a0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbbef1e2-db9a-4f0d-a5e8-5ef514340e14", "sighting_of_ref": "indicator--c4626463-5358-45b8-8070-d21f1b79f0a0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f215a248-b570-4b90-98e5-9d23d3c36898", "sighting_of_ref": "indicator--374c492e-e47f-46a6-897e-6a249cd07e0f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e58ff723-1b83-44f1-82e6-8748d89a8a8e", "sighting_of_ref": "indicator--9138211d-75f7-429c-ab03-88c0ba526ce1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6e679c9-3134-4422-86e0-f3867008de8a", "sighting_of_ref": "indicator--02a965ca-8353-4b55-95ae-202f198a29dc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e826d3f-cf4c-464a-9d16-990e58f29aca", "sighting_of_ref": "indicator--84d75565-c7be-42d0-bc59-803ca2320d73", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29248493-480c-4cba-9813-929816ba9029", "sighting_of_ref": "indicator--84d75565-c7be-42d0-bc59-803ca2320d73", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfad3d7b-2abd-4e2c-9558-e1fb9e25596e", "sighting_of_ref": "indicator--38363357-378b-4b2c-b209-85bb013a83d8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--741344fd-6d51-4b83-aa35-fab0875d390f", "sighting_of_ref": "indicator--f42a837a-3f10-4db1-903c-c148b3b3d3da", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e77dca60-9ba7-46c7-b440-e418d132cd2c", "sighting_of_ref": "indicator--f332d1ce-c5cf-4edc-8298-67a46e7c0ee9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33494b12-7838-477c-a761-862788acea87", "sighting_of_ref": "indicator--0ea326e1-2dd2-4056-86c5-b18e18a22b8e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e07ba0fc-ef5d-41e4-b1f6-abaff0dc6dcb", "sighting_of_ref": "indicator--34cf0efb-ddb3-4dd1-8021-b317c6e0d175", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8209011c-6ced-40be-8a00-c50387d6533e", "sighting_of_ref": "indicator--9b18c496-9759-45ce-9b1f-5c3cf94c87df", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f37e395-c841-45b8-82b0-ee6614efa0a5", "sighting_of_ref": "indicator--dae5056c-3847-42d4-a9e6-b173c442959e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed118dd3-6d81-4c3f-a634-a9622eff26ee", "sighting_of_ref": "indicator--470d4037-9999-41e6-b5a6-a110671b1917", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d51f197-e22a-4db1-9e75-cadfd1447921", "sighting_of_ref": "indicator--cb23be46-e793-43a6-98cd-68f1ea777607", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d3b35a2-bb55-4866-8991-8ec55275c2d6", "sighting_of_ref": "indicator--ea0a2883-ee01-42ae-a895-d8ab8331036d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d35c4aa8-5531-436b-a57d-c85bc9405abb", "sighting_of_ref": "indicator--3a9ffd14-337d-4348-bf46-b3a1127532ea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a48f4749-b310-4f1a-9e5f-432dddb7d4ce", "sighting_of_ref": "indicator--bff71e86-7753-4c9c-90e5-2060aa85fdeb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29aa998e-7644-438b-81fc-0733fbd32959", "sighting_of_ref": "indicator--ab98296f-2453-4f19-976d-b8550ff0963d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0211fb2e-f1d1-403e-9a58-2ae085f675a2", "sighting_of_ref": "indicator--82c47f75-5480-47ed-b12e-2e89e39c4cc3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95224b26-0eba-4653-8cc1-8043cc9503f1", "sighting_of_ref": "indicator--e09363a2-0595-4355-a03d-9c19b4c2c754", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9408e453-7d2f-46b0-8602-622a2b5d0fbf", "sighting_of_ref": "indicator--fc5e47a2-8ca1-4b49-b162-4ea687668e08", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0722ee1-e19f-4eda-bc52-b7f74b2f37a2", "sighting_of_ref": "indicator--3fa131cf-577a-4553-8d27-7a3501b74b56", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52015e1f-3c85-4cf3-9955-f9a7308f544a", "sighting_of_ref": "indicator--7b72c42e-1f72-40c3-9a5d-d24c4d125ca9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8366e2a8-e4ef-4984-9b9e-8c569b0067e4", "sighting_of_ref": "indicator--7b72c42e-1f72-40c3-9a5d-d24c4d125ca9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--424c5cc7-dec2-46ae-880e-1a5eca28623e", "sighting_of_ref": "indicator--697a7176-3e07-452e-aa6f-745605a16233", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef1e4d6c-37fb-4ebe-be5e-0f65e2d04c03", "sighting_of_ref": "indicator--e957ad6f-5dfa-4d1f-b786-568033d71c60", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e3fc17f-5fb9-4496-aa67-4657b7ceb045", "sighting_of_ref": "indicator--e957ad6f-5dfa-4d1f-b786-568033d71c60", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e55c1b40-35a3-4008-a027-ca1195a6fa49", "sighting_of_ref": "indicator--c434cbab-0e1b-43ab-8ba1-763930b10919", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62ca586e-127c-451c-9b4a-ae858d90ecb7", "sighting_of_ref": "indicator--5838f1bf-0c7b-4b99-b7f0-ca6a1e5cd8e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d183d7c5-5665-4300-9e7c-e08989fb2a9a", "sighting_of_ref": "indicator--ebedd33a-3538-4622-91ab-52ccd049b429", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b16dd522-2afc-41ec-b962-ef97630ebf06", "sighting_of_ref": "indicator--6dd64461-c113-4a75-b67c-52c1a16ddfbe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e88863de-4025-458d-b413-3ee3a9dac7f7", "sighting_of_ref": "indicator--840febe0-65c3-4cd7-b1a5-47131ba08d8e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e154365e-4515-4d84-9181-b96b44f98139", "sighting_of_ref": "indicator--840febe0-65c3-4cd7-b1a5-47131ba08d8e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f91a598-de07-4470-935c-317d1a055598", "sighting_of_ref": "indicator--36540227-f6e8-4642-b5ef-b51ae75a1fc8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0de43fc4-c2d8-4a45-939e-31f734401ff4", "sighting_of_ref": "indicator--a3f64a3f-9dbd-4f5c-a8c3-cebee43dfd91", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3693f2c4-110b-4675-ac03-c7636edaf825", "sighting_of_ref": "indicator--a3f64a3f-9dbd-4f5c-a8c3-cebee43dfd91", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d9423fd-c586-4121-9487-346c6ce17b2e", "sighting_of_ref": "indicator--e7195058-0520-4e87-b4a6-23acc822521a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7a4eb58-1e41-48ae-8efa-8c7f133ba0ef", "sighting_of_ref": "indicator--e7195058-0520-4e87-b4a6-23acc822521a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--542f39bc-d66b-4a56-9ce3-ab53357317e8", "sighting_of_ref": "indicator--0ef3564f-7857-4f6c-a3a0-64cedacc4934", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51b7a5f5-e49b-4a43-a5e2-5b3273e0533e", "sighting_of_ref": "indicator--0ef3564f-7857-4f6c-a3a0-64cedacc4934", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6af78670-5645-43a6-bcde-e9367bc2c09b", "sighting_of_ref": "indicator--bb63bf75-40e8-493f-adc1-b368aeb23521", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a44b9bb6-eae8-4b41-9677-d2c91628b14d", "sighting_of_ref": "indicator--bb63bf75-40e8-493f-adc1-b368aeb23521", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcac2d65-7029-49ea-b970-6e18aef5d316", "sighting_of_ref": "indicator--f3cb259e-e108-4a03-9279-f4f3cb64e642", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f66c912-1332-4aab-81da-308e09271edd", "sighting_of_ref": "indicator--f3cb259e-e108-4a03-9279-f4f3cb64e642", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c59e4db-a1fc-4feb-8049-916ef8bdf8cc", "sighting_of_ref": "indicator--b7144492-a9e7-4ed7-844e-f51e4169cce4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef5e9471-49ec-45a5-8afa-d3180f53e1d2", "sighting_of_ref": "indicator--3822e06e-57bc-4603-8e77-2b4a0a7721f7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68091880-596f-487b-a241-14764af25bf7", "sighting_of_ref": "indicator--3822e06e-57bc-4603-8e77-2b4a0a7721f7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--717cf2a9-4d1d-4e50-bbdc-a9e3ce93d95d", "sighting_of_ref": "indicator--86803d1b-d420-4164-991d-1369670ba149", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea9853d8-4f95-47e3-b797-105bd5bffa6b", "sighting_of_ref": "indicator--160e6142-f41a-48ed-b6c1-2b296ad0d7c7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54130e67-8bfe-40f6-9029-a551e9820b40", "sighting_of_ref": "indicator--c878ca82-9276-4a53-9e82-13677fa43c31", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e189f41-5b40-48a9-b5ad-2e003771ef52", "sighting_of_ref": "indicator--c878ca82-9276-4a53-9e82-13677fa43c31", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aed1dbe5-7e49-413d-8cdd-84c9577c6179", "sighting_of_ref": "indicator--6ea8afd5-a482-4227-9bcc-1e8e091f6b80", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a29c374-b867-4a47-a14f-507da02a38f9", "sighting_of_ref": "indicator--227d5d9b-3581-4c53-810d-ab3acd14a35f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--855ed2c1-3d92-4ce7-b7a3-7cf7a1ec4c4d", "sighting_of_ref": "indicator--a8066b52-9809-4b06-b762-6ed40fef3f88", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c8431ce-13b4-4d5c-87c5-d04b749839c0", "sighting_of_ref": "indicator--6f9c97a6-2ce6-446f-9345-c5ffed5c73fd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--009bc73e-67ae-40cf-8481-f14e21a77571", "sighting_of_ref": "indicator--a746d5cf-227c-473e-a5e0-d644b401a865", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80201147-903e-4ede-afba-960c45ed9589", "sighting_of_ref": "indicator--ced11628-34b4-406f-ae68-167509cbc2d1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68537d73-829c-4e8e-98d8-60ffc587ac28", "sighting_of_ref": "indicator--ced11628-34b4-406f-ae68-167509cbc2d1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be75e4b6-3c81-455f-8937-3158936d2c6e", "sighting_of_ref": "indicator--8ff5709f-62a5-4469-8fa5-75d98b3e1d4f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2835a0aa-a948-408b-b8bb-da8a07289b90", "sighting_of_ref": "indicator--8ff5709f-62a5-4469-8fa5-75d98b3e1d4f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdf6f8be-e79c-4411-8883-d4d47c6e760c", "sighting_of_ref": "indicator--1439fef2-135c-41e3-90b1-a609e08492f3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c5a524f-43dc-417b-891a-2931cef2ddea", "sighting_of_ref": "indicator--fef129d8-78eb-4fb3-a914-d45121120a9f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1525873-9410-4677-bc5a-bf5820779ef8", "sighting_of_ref": "indicator--e49c3372-46b8-45f4-92c0-2ccea46324d2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2834687b-0761-4b43-ba1f-9501e3053af9", "sighting_of_ref": "indicator--33515414-871d-4e93-a123-1ffd29bd20d4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b3cd3f3-ca60-4a54-91c7-e1d2a1ec0f38", "sighting_of_ref": "indicator--f93f51b3-667c-4e00-adba-7dc962453514", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff983082-e6fb-4a58-9412-fc31e5f4ba4b", "sighting_of_ref": "indicator--bc0e4640-ce11-4998-a5d8-ead711c235d6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca0ceff8-a672-4412-adb9-81ac01ad5de1", "sighting_of_ref": "indicator--bc0e4640-ce11-4998-a5d8-ead711c235d6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a27b3e2d-6d77-4462-a6b9-57c172bdbd66", "sighting_of_ref": "indicator--40fb987c-cc3d-4580-98bf-9bdb4fa9fc0d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28818a40-34ff-408e-a519-d70991785acf", "sighting_of_ref": "indicator--1659a1a3-32b7-4de7-b8d8-181431fee783", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6737b2e-915b-47d9-aeae-fefedde5bf0d", "sighting_of_ref": "indicator--1659a1a3-32b7-4de7-b8d8-181431fee783", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f98cc19d-f199-4c7b-8319-1bc82f782c73", "sighting_of_ref": "indicator--b5604bdb-cfa0-45bf-b22b-e22e05da9d8c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39582b2d-f3b2-4a14-bc5c-bfebcfb78523", "sighting_of_ref": "indicator--b5604bdb-cfa0-45bf-b22b-e22e05da9d8c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca978e87-9b14-4448-984f-c1aba2951a28", "sighting_of_ref": "indicator--947a7006-d80f-44ba-9c28-b7e6f08ea22e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d84bc428-1a1f-4b08-95d4-608600bd01f9", "sighting_of_ref": "indicator--947a7006-d80f-44ba-9c28-b7e6f08ea22e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6c888cf-d56d-4428-929b-7089c180f2de", "sighting_of_ref": "indicator--159808c0-96d9-41ab-a415-bfaf9424858e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4851c0ed-8159-46ad-8c8e-e706357c6322", "sighting_of_ref": "indicator--159808c0-96d9-41ab-a415-bfaf9424858e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7944bfcc-613c-450c-9d32-9f9a68ea16d7", "sighting_of_ref": "indicator--770a02e5-3ac5-4f5e-b9b1-08b22a0cc18a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--361ca0d1-9f81-4be2-8a54-58a936a99ae5", "sighting_of_ref": "indicator--770a02e5-3ac5-4f5e-b9b1-08b22a0cc18a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea42064f-7889-4371-924e-2ecc828dad40", "sighting_of_ref": "indicator--2954e006-634b-4eba-aae1-68992ee1dd57", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d77d94e-412b-4bab-8520-d48a3ba457b9", "sighting_of_ref": "indicator--2954e006-634b-4eba-aae1-68992ee1dd57", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81bcdac9-df1b-489c-8cd7-e5fed283604a", "sighting_of_ref": "indicator--2f3e2a70-5d47-44f6-ab45-04c5c53089b4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f795ad6a-4567-499b-b18e-5c4ff6dff953", "sighting_of_ref": "indicator--2f3e2a70-5d47-44f6-ab45-04c5c53089b4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2f30479-b8da-4c16-9a93-cd6b4b4e3853", "sighting_of_ref": "indicator--3e8fa95a-5bac-4d5b-a2f3-2987f327ed32", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27429826-eb92-415a-820e-42812174cad7", "sighting_of_ref": "indicator--f7685588-68a8-44f0-a0ee-425a2a5ac0d0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62df57da-360c-4701-87a0-5e4d5b5ef14b", "sighting_of_ref": "indicator--6359a434-029e-464a-944a-b6f02ae960f4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d24ffec9-ea30-4814-8cd9-fc8b40b3da50", "sighting_of_ref": "indicator--6b85f8d2-1890-4aa5-9da0-f8384bdde05c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d73827b7-2536-4b59-80a3-607bf041b8a1", "sighting_of_ref": "indicator--687cdd18-2e90-463a-8882-7004a48b595f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3b3bbb8-1b1e-43db-b44a-cb2288a1a97b", "sighting_of_ref": "indicator--bd834103-3a10-4a5d-b1da-586dd9b7fdde", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a768be8d-170a-49f4-8ce7-5c9b38b350f2", "sighting_of_ref": "indicator--99f7713f-8f16-4d0e-9175-2eb2bbc87cd2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--189ee431-543e-4749-8210-122aff4bc576", "sighting_of_ref": "indicator--52799475-8a69-4ab1-962a-1125fc6fa291", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2982ace-9b23-448f-8a63-3c65f31cb7b2", "sighting_of_ref": "indicator--3ed6222a-cf76-4267-89b5-928e25c0965e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d7e3690-0c34-4bdc-b8e7-3a427de62dcf", "sighting_of_ref": "indicator--6a0688c0-2f67-4ec5-b415-3b63a61f0ec5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28446fc0-cd16-4adc-8ae6-1536b818bbdb", "sighting_of_ref": "indicator--8d06252e-023c-4164-aae4-2c8e4382221a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cb7f99e-416c-427f-b2ff-7a046d9488d7", "sighting_of_ref": "indicator--243ea716-b7b3-4f68-b095-96b48c72e580", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e6043cb-b283-4fd7-9ed0-4ead40935f9e", "sighting_of_ref": "indicator--0a76db66-8214-4bf1-ae39-a559cdc48178", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43585b3b-a8ea-43ea-98f8-845697081eb0", "sighting_of_ref": "indicator--78f1945a-b98e-48a4-8b7e-7618bcea5bc7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5679aed-aefe-4c00-96c1-eb9144e40f2d", "sighting_of_ref": "indicator--04abd59d-aa2d-444b-9ee8-186a09620ce0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fecf9b8e-6fd0-4e9e-9966-1970521b02c4", "sighting_of_ref": "indicator--e67dbd8f-0157-4df5-bcc4-007626525bd6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4701e17-3a0c-46e7-9efc-18e602d436fd", "sighting_of_ref": "indicator--ee68a55b-62c6-4d31-9ffc-aa6009d8d76a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e959f36-137e-4b93-bfb0-0f8b4901d24d", "sighting_of_ref": "indicator--ee68a55b-62c6-4d31-9ffc-aa6009d8d76a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1bd160d-48d6-4588-b4bb-f6ea3483a287", "sighting_of_ref": "indicator--5c90fee1-9cf6-4faa-a5c1-f68bbf395291", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73a57870-39f6-49b6-9624-01a2960f5172", "sighting_of_ref": "indicator--aef2032f-b1e7-4e34-a084-f56eb9059411", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3f456b8-a82e-4173-b2d7-1d94d3a432c0", "sighting_of_ref": "indicator--d87274eb-4f12-416c-aebe-943eb278d054", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf4554e4-e131-403a-891e-f5b51c366172", "sighting_of_ref": "indicator--0ea6debd-afd7-4ba7-b104-c17f7d26d109", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62c151b7-67a8-4197-b611-2461533f5610", "sighting_of_ref": "indicator--4c36468b-f59c-45db-8a66-c38d51e131dc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59eeacb6-0a78-43a9-9761-fc6226a622d8", "sighting_of_ref": "indicator--87d6c0e8-b8a4-4c87-a352-382317f0e83b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--884ead1c-6350-4b12-ad57-4df7795db3b7", "sighting_of_ref": "indicator--ed702255-894d-442f-8b15-57ab58a7e05a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af98cab3-dd70-4ce9-ae2b-00525f2e988b", "sighting_of_ref": "indicator--6e697818-7997-4da0-8b87-034e789f5b7c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48045239-94df-42f6-8a52-15bb2837473b", "sighting_of_ref": "indicator--ad577447-3a7c-4d3f-98a7-a68f59536918", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4147f14d-f062-4640-b2fb-f1a900359aea", "sighting_of_ref": "indicator--ad577447-3a7c-4d3f-98a7-a68f59536918", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5e02bbd-4140-4f24-a081-1bec4ff36338", "sighting_of_ref": "indicator--22366ccc-f1ef-426b-ab09-92ec874991b5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8e44531-9cef-4482-b862-843e749206c7", "sighting_of_ref": "indicator--fdc21351-e9a8-4be9-9f57-cd2c1f2326d6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--808fa2f4-09e2-40b3-88b9-7e8ca2cf7ab1", "sighting_of_ref": "indicator--d63290fc-76e6-44cc-9a47-40401a68e559", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6325e12a-660e-465e-a021-5e8439ae187c", "sighting_of_ref": "indicator--6f468bad-d1b4-4d5b-956a-cffa3972fe4a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2595b664-2eb1-4472-a4cb-6b44462bdfbf", "sighting_of_ref": "indicator--bb8507f3-ddcf-4eb3-ba9e-1b19c331827d", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54128162-addf-429d-a394-3c0385f09b64", "sighting_of_ref": "indicator--5c35e79c-65dc-4381-b371-1c900f564ced", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b580ed99-d976-4d10-9eb3-2d4e253136c7", "sighting_of_ref": "indicator--5c35e79c-65dc-4381-b371-1c900f564ced", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c5d0f08-7b5d-410a-8621-63d8a26ff94f", "sighting_of_ref": "indicator--64665dc6-c82d-4f76-a489-8d55a3757ad6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e75259ac-8920-488e-b1c7-9a03afd6d040", "sighting_of_ref": "indicator--ea1f4d47-6570-4683-893a-5f93ada1580e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad6a2e5b-8912-44c5-87c2-1e8fda96672d", "sighting_of_ref": "indicator--aca793cb-4b81-4ef0-8108-63003da36c65", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5bfc948-a3b2-432d-ae0c-7f282f8270d6", "sighting_of_ref": "indicator--8fb1230a-f63a-479b-93b4-8bdf8d1440fb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dea61503-6289-48ee-94da-aae7eda1ff15", "sighting_of_ref": "indicator--049e7bec-fdcf-4f40-8bb6-7eb5fabb3c03", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46dd17c7-9d69-4250-8f15-a21efc71c687", "sighting_of_ref": "indicator--c3cb5420-3bcc-4178-8c03-30175341080a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--144f836f-0848-4cd3-8277-fea358de2c20", "sighting_of_ref": "indicator--62a9ebfe-d1e6-40ce-8061-b07d859c0beb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ab80b48-86a6-4240-99f2-88f64112958f", "sighting_of_ref": "indicator--62a9ebfe-d1e6-40ce-8061-b07d859c0beb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63f6c4a8-6b0a-40c1-9860-28fbfd0ae5ad", "sighting_of_ref": "indicator--087ba77f-4058-4cdc-bc08-4e5cc73e6fcd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b8728a2-5bfc-4e45-827c-1e2f756d380a", "sighting_of_ref": "indicator--648236f8-5326-433f-a62a-22db1f1b7d0d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d971f57-19f4-4935-86b7-f8985f488adc", "sighting_of_ref": "indicator--648236f8-5326-433f-a62a-22db1f1b7d0d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80c32a47-afaa-44c1-a228-5c5a4873e071", "sighting_of_ref": "indicator--01921b48-8d7e-4852-bda9-c8ff4c89d83e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e627df3f-d98c-44ae-bc76-a73a8f2c31e0", "sighting_of_ref": "indicator--01921b48-8d7e-4852-bda9-c8ff4c89d83e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c061439a-2e6c-4048-9a2d-23104a76a0d0", "sighting_of_ref": "indicator--ec06c724-08fb-496b-a5e9-221526cb1db2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d9849a7-9a7e-44a3-a9ab-823e3c9bbb24", "sighting_of_ref": "indicator--9974f2f2-46d8-4424-9ee6-dfa52b57a174", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--911de6e4-7bb2-4184-ae90-48f361224654", "sighting_of_ref": "indicator--742f394c-251a-4f12-8271-7718d77e5dbc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e9adb25-0f97-4c59-aefd-262e27950752", "sighting_of_ref": "indicator--0b4e491b-1125-43d1-9970-af0a8f2ad7a3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a907738-e25a-4778-8f99-fe950e3421ef", "sighting_of_ref": "indicator--fe712c50-8317-4f9e-a900-371e4f681fef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f50c8ca-27fa-4152-94e2-de3b77eefbde", "sighting_of_ref": "indicator--477b57d5-9557-46b7-9288-f82e0e31d2d4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cc39268-4d3e-474d-9e62-91efd652ca29", "sighting_of_ref": "indicator--a83595eb-1f21-4c00-b28a-e9cbfd760eda", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b93e6aa-39df-47a3-b7ef-a88f45b813f0", "sighting_of_ref": "indicator--8ef8d8bc-ba33-44f2-b002-f13f27788c34", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--536e14ba-bd9a-4ef4-add0-15907f42c0f9", "sighting_of_ref": "indicator--4783a219-cefc-44a2-a8cc-9fecd4c6a927", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0846b8a2-9c59-4eb0-b5ca-73b6ba867e23", "sighting_of_ref": "indicator--8d749140-173e-4474-9c85-b1089cc9b7e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b3095ca-232a-4aa5-b05a-e4f99075dfa8", "sighting_of_ref": "indicator--8d749140-173e-4474-9c85-b1089cc9b7e6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09189694-eebc-45ec-8541-753b5276e362", "sighting_of_ref": "indicator--c934cd86-b4c7-4f67-bbde-bd2c87b97cb3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74cee197-0d03-453a-a09d-aa90f7bb9b8f", "sighting_of_ref": "indicator--c934cd86-b4c7-4f67-bbde-bd2c87b97cb3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--018567e2-0427-48e6-b5fe-61e07768f7cc", "sighting_of_ref": "indicator--a73b048f-db87-4b48-a75c-62bb8e8e1e02", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b19d3cea-2e06-4927-a644-952ef41c8263", "sighting_of_ref": "indicator--4c703d1a-007b-4489-9078-14b839a2b3cf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ef79b81-ffca-407b-abfa-2c46cc51155f", "sighting_of_ref": "indicator--6945b116-69f7-45da-93bd-020854224883", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed950036-f408-46bb-99c6-142a7b1a1942", "sighting_of_ref": "indicator--3064df54-7252-48de-94b6-33b2f3ea25fa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f033de5-44e4-478b-ab7d-171a21a2c8ec", "sighting_of_ref": "indicator--5ef031bc-cd83-42be-ba0d-efafb0ef7f61", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7257823-aa8b-4cdd-8b68-19ac60e9991e", "sighting_of_ref": "indicator--2261316d-73eb-4dd4-9af4-9e5d383820f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6db57a4b-f0dd-429a-827b-016276bebd81", "sighting_of_ref": "indicator--2261316d-73eb-4dd4-9af4-9e5d383820f0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2903af72-f95d-4d54-8c4a-f76978696995", "sighting_of_ref": "indicator--b13d95c3-a6d9-42ad-bf79-2a6d7d3f1513", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80a46142-f331-4edd-9120-c2824afbf4df", "sighting_of_ref": "indicator--52c70879-c1de-4840-89fb-c6920567ff99", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b75af26b-6559-4a33-8d7b-0e5a12458261", "sighting_of_ref": "indicator--6ceaed7a-dc60-417c-93c1-e625b5272fdb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e16ee167-6679-4cd6-a18b-abcb7cd9ddcb", "sighting_of_ref": "indicator--6ceaed7a-dc60-417c-93c1-e625b5272fdb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d7a48bf-b033-4e0f-bf8f-daae2d7330bc", "sighting_of_ref": "indicator--f1861aff-729c-4bbc-81d7-838d85396dee", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aca5f8c0-71f5-4f62-8d69-fdf324138733", "sighting_of_ref": "indicator--58e4cb38-f161-4c3c-9fc5-a7099e11fc45", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0cbc49b-c73f-430d-a47a-afe6d83bae1d", "sighting_of_ref": "indicator--58e4cb38-f161-4c3c-9fc5-a7099e11fc45", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--389a87c1-b018-4b7f-85dd-d39b4e23cc6b", "sighting_of_ref": "indicator--fc97d612-aa58-468e-8a06-44cd8916863f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8172b6b-44f0-4c87-be1f-843e6d3ae5ee", "sighting_of_ref": "indicator--fc97d612-aa58-468e-8a06-44cd8916863f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc036a11-99ae-46f4-97bd-e42dc6a7b256", "sighting_of_ref": "indicator--b3e4bbe9-a91a-4666-9d2a-fc54eb6e6919", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2021c6a1-e3eb-4ec5-97d4-fa0ce49aee5e", "sighting_of_ref": "indicator--3261f0a4-148f-465e-9388-742d6b2cfed9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6de7ccec-4541-4193-b95c-014e363d1179", "sighting_of_ref": "indicator--eca88b0b-3eaa-4f3c-8263-8a9d093eccd7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2319a10-cbc1-4bb1-b269-8053fcaa09b5", "sighting_of_ref": "indicator--eca88b0b-3eaa-4f3c-8263-8a9d093eccd7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a54bc7dc-4650-49d2-aad6-7e8f30952eb2", "sighting_of_ref": "indicator--29cb3449-afcb-4bc8-8635-a9d480e1b7e8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13a3e73d-e67c-455d-8326-507c962344f8", "sighting_of_ref": "indicator--c5fcc918-b8a0-4ffd-820f-9e56352d9045", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff3e39cc-fd20-4a65-9606-98a1a3b273a4", "sighting_of_ref": "indicator--7d0a6c04-7b75-468f-adb3-a0be47fe2610", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1c6d732-01e1-4a4f-bcb5-2ec23c5a9390", "sighting_of_ref": "indicator--59850ac1-eb59-42be-91d0-b57c6809fc7d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8633d5d0-6e4f-4285-a0a5-85b721587478", "sighting_of_ref": "indicator--b48ee430-d287-45fe-b378-aa8311c85d78", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03b627bc-a3bb-4a21-abf0-18ff10fce50d", "sighting_of_ref": "indicator--2ab0fc17-f660-4736-93ad-2b5ec0792c44", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91a55f5d-310f-472b-9f35-b68236ea3ea1", "sighting_of_ref": "indicator--2ab0fc17-f660-4736-93ad-2b5ec0792c44", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8755170d-b054-44ee-b0e3-70fd01aa7397", "sighting_of_ref": "indicator--c70ef136-4666-4a67-b0d4-e42c5461fb4c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f641f54d-d724-4f57-8aed-2932ecb3be05", "sighting_of_ref": "indicator--62340a5b-405d-49fb-8532-a66eb9482c22", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8545e144-dba2-4106-a229-0cc7a5afc84b", "sighting_of_ref": "indicator--69e7eb12-7602-49d7-9872-138ee52448ed", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8af7151-b7c8-47c8-bd58-16de1ed6afc2", "sighting_of_ref": "indicator--2378b207-af6e-4200-80f0-08fa8ab4fdcd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fa10459-2dc7-4932-80ad-90b2e5020579", "sighting_of_ref": "indicator--2378b207-af6e-4200-80f0-08fa8ab4fdcd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d1166be-1ad8-4582-b5f7-dcdb2a57348f", "sighting_of_ref": "indicator--df3abf18-d791-4043-9db3-6520d0e6ebac", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc1050be-eba5-46de-839e-5067cb3a9054", "sighting_of_ref": "indicator--df3abf18-d791-4043-9db3-6520d0e6ebac", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4872aa86-e9e5-4dd0-b0bf-bcce2f2f82ed", "sighting_of_ref": "indicator--5aa61f73-3146-4b5f-8503-968dd887d7b5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3f77b3a-b47e-4e8c-b70a-93c1042be438", "sighting_of_ref": "indicator--721de374-07c9-479b-a9e9-372279e5bdc1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bc91dbb-8338-47d7-9109-7457c21b4922", "sighting_of_ref": "indicator--721de374-07c9-479b-a9e9-372279e5bdc1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--889e201d-83b1-42bd-8a90-bcdefd460d44", "sighting_of_ref": "indicator--94de079c-3415-444b-a3b9-44230f2eb540", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b29f59a-434e-4421-9db4-862d1941ecc8", "sighting_of_ref": "indicator--6ef889b2-4291-4669-9243-2892e2df69f7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--516cd461-fcdc-4429-af16-b2887d2396af", "sighting_of_ref": "indicator--b3e9e10e-4d74-44e6-81cb-be2e6d0396e2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22b55ebe-b11b-4cf6-89bc-3c2c5b348225", "sighting_of_ref": "indicator--046dce7c-5efb-41ec-9708-73baf69c1129", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c933fa5-d627-436c-84d1-21a933db1dd3", "sighting_of_ref": "indicator--b4c5812a-98ec-44b2-8b6a-69b01a12e389", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0943c89f-8af7-4fbe-b81b-a75fcdeaae98", "sighting_of_ref": "indicator--ed1be9e1-3c65-41a6-9069-f59df9d19556", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a95dad4d-c4e4-454e-a40b-bff67b5baeae", "sighting_of_ref": "indicator--8bd8e6eb-a52f-4f46-a171-3a1d22600039", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--203fe911-9ec0-43fd-a6c4-a985f79cddbb", "sighting_of_ref": "indicator--a08872a3-70e8-428f-bc23-7df770eb9024", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc586378-3ba0-40b9-b345-68ad19b10f5d", "sighting_of_ref": "indicator--9205c89f-ce96-41e9-a2a0-f5c8384cb636", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c68ef343-98c6-47b2-a68d-64f5b0dcbba1", "sighting_of_ref": "indicator--9205c89f-ce96-41e9-a2a0-f5c8384cb636", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9180b5e-6263-4217-b3ed-6985359a3737", "sighting_of_ref": "indicator--cfd292ab-44e7-4237-b671-cb5e85f6a936", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1c6fb4e-fd78-436a-9638-a1b8f2b4820b", "sighting_of_ref": "indicator--8405bc02-cfe8-47ad-ba93-3207fffff9be", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d08ba54c-5f3e-4977-a4c7-716a96b03758", "sighting_of_ref": "indicator--ac1ecc2e-6731-4eb7-9dd9-253b5bff4afd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f75540f-29f3-4a7e-8c6b-3c090f15029f", "sighting_of_ref": "indicator--ac1ecc2e-6731-4eb7-9dd9-253b5bff4afd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07977049-4055-4ef5-8e77-4689f2133df6", "sighting_of_ref": "indicator--e2abfc7d-de49-40eb-973b-2dfdc9832c08", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cc34609-1ae8-49fd-903e-63bf57e1519f", "sighting_of_ref": "indicator--b1ab377b-8a4d-4f1d-aa97-3cc7aae3778e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13eba52a-120c-4b71-b718-f673bdacf850", "sighting_of_ref": "indicator--e40c9126-ea3d-4cc1-8150-a82f6e81bbad", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fac8189-ce26-4b89-bfa4-bd6a4154bf4c", "sighting_of_ref": "indicator--e40c9126-ea3d-4cc1-8150-a82f6e81bbad", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05a0c573-9aeb-4e87-bc1e-6091d3fb611a", "sighting_of_ref": "indicator--d0aeff93-6015-4131-b3b7-809f26c3df43", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b091fd1-7242-4ce0-9062-dcba894a68ed", "sighting_of_ref": "indicator--41b6481f-82ac-45dd-a55f-2d767708f068", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e841819b-ea48-42dd-8873-b8b5557fe9b3", "sighting_of_ref": "indicator--41b6481f-82ac-45dd-a55f-2d767708f068", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e512ded-2e1a-4a0b-9f82-096d66f361ac", "sighting_of_ref": "indicator--b70695d9-b828-4a79-ac64-2db8c81744b0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c7f4993-d1e2-4b05-b2f0-1d56402986cd", "sighting_of_ref": "indicator--b70695d9-b828-4a79-ac64-2db8c81744b0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81aec2a6-8567-485f-a0c9-4fe9a0d82bfe", "sighting_of_ref": "indicator--d940568c-5baa-4184-bb38-d3ca0f4258e9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36f5c439-e355-4334-8a86-bed64bbc8636", "sighting_of_ref": "indicator--623f54f0-bf29-4553-aa50-955a14fba66f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a2a1da8-08e9-4953-a587-b75e0d245b7a", "sighting_of_ref": "indicator--b4b19a14-67d3-4cce-9f3d-243f6ae219ea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3de35741-519d-43d4-ac02-f7f13c749c74", "sighting_of_ref": "indicator--e54afad2-ca5d-4f5b-aca5-d2326aac24da", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdad09ed-c3e3-4001-9444-86dd6cad7cf7", "sighting_of_ref": "indicator--e54afad2-ca5d-4f5b-aca5-d2326aac24da", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54a4f441-e962-4df3-8e49-c67bf6feedf4", "sighting_of_ref": "indicator--c8cd4da5-8019-4ad7-801c-56526e1b6497", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d23a9c98-19d2-4f34-a1d1-f1c2893b7b9b", "sighting_of_ref": "indicator--c8cd4da5-8019-4ad7-801c-56526e1b6497", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75a2ee8e-5b34-4828-8cbc-c5f4f42f0c26", "sighting_of_ref": "indicator--961057b9-14a8-4a79-9ec6-c1a0b11cf54b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1bf15a2-2437-44f0-a648-95679a42d1e9", "sighting_of_ref": "indicator--961057b9-14a8-4a79-9ec6-c1a0b11cf54b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cc7179a-f251-432b-8cc3-40aa69d6ae12", "sighting_of_ref": "indicator--dfe4a38a-125b-41d3-bb08-1d275f79ba80", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66e77539-06cc-4eac-afe9-23097a7822b3", "sighting_of_ref": "indicator--dfe4a38a-125b-41d3-bb08-1d275f79ba80", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3441c048-fc8d-4f08-88e1-8dd87555edb9", "sighting_of_ref": "indicator--cf9ac537-10ce-44b0-9b65-ae2fbbac3880", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2546e519-b81a-4555-847b-4a744da4fb1b", "sighting_of_ref": "indicator--0af89f37-c2a2-4e93-befc-e6b4259f37db", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e25f63a-fde8-449a-9a4a-86e19ca62160", "sighting_of_ref": "indicator--d2bfd207-0c23-4698-8bf8-61bcee797c5c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcb7a84f-0325-4231-8a38-6ce26d2c4851", "sighting_of_ref": "indicator--d2bfd207-0c23-4698-8bf8-61bcee797c5c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c67642e0-e9d1-4368-8dd4-9d547d2b34a7", "sighting_of_ref": "indicator--e05c5670-8573-49df-9711-9bd44c821bbe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--092b3d7e-b905-46da-8e64-81909e8640a9", "sighting_of_ref": "indicator--e05c5670-8573-49df-9711-9bd44c821bbe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dac8c26-24c5-4d9d-b4a8-34cb46637901", "sighting_of_ref": "indicator--1cd35d0d-86ff-4eaf-aae0-9b0002be0154", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c4ff1df-23a2-4062-ab2c-891c2dea18a5", "sighting_of_ref": "indicator--7cfc34b4-b1fb-4786-9292-bacc9def79f8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60765419-4bce-4bab-9e2c-ea1e7694ae04", "sighting_of_ref": "indicator--7cfc34b4-b1fb-4786-9292-bacc9def79f8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--019e6fd4-75ab-4543-b48f-4016ec28ffa3", "sighting_of_ref": "indicator--1ce93089-e1d9-48f8-9f50-c1d7f578102a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f261f047-9389-4435-be80-d2a8778539d2", "sighting_of_ref": "indicator--a8e1ecf1-235e-4bc2-8912-6db74d44b367", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88b4c24b-31ec-47bf-8da3-24660c823eb1", "sighting_of_ref": "indicator--bb71ef66-bbd4-4485-914d-d757103062a3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--917ae456-e0f3-462a-b3f9-5cf0eba566c9", "sighting_of_ref": "indicator--d85a6418-045e-4e68-b5a1-575ea013c828", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--301587e3-1b8d-4aab-b1df-c3367b5f60b0", "sighting_of_ref": "indicator--fad2eb6d-b20d-4cbd-b11c-98175fdd50c2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d0ab230-fec0-4255-8f58-942f1904d22a", "sighting_of_ref": "indicator--513a2f00-71a8-4e83-8848-dcfd5b444ac7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb71826a-97fb-4a5e-91d6-8cc009235595", "sighting_of_ref": "indicator--86d42b7e-b36e-49b2-94d2-826dc0daa39a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aebf76f5-9ba6-4e60-bcd7-8d5ad1731cbc", "sighting_of_ref": "indicator--9be3e2f3-987c-41af-8cb4-152ab14989c3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3d45b75-7098-440f-a200-9e7ce7a71102", "sighting_of_ref": "indicator--9ce52b4f-4a21-44d8-80d7-516765998909", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cf3fc23-4413-494d-ab7a-e343ee4ec9d9", "sighting_of_ref": "indicator--0d7c41bd-48bf-4153-96cf-5baa97e3cb36", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24c9d5f1-9fbb-4643-8f11-72387e1d3bd8", "sighting_of_ref": "indicator--0d7c41bd-48bf-4153-96cf-5baa97e3cb36", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dce820c-c188-4dfa-93c3-6ce00c0e2c3f", "sighting_of_ref": "indicator--7044973b-461a-46ad-8c23-b5ea4097b2bb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d11b6fd-eeaf-40a6-87a5-4e8b6b6c0460", "sighting_of_ref": "indicator--c858978a-7999-45a1-b9dc-05ce9c3c59c5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0131b9f5-6a8f-47e6-84d7-7b30e08a1302", "sighting_of_ref": "indicator--c858978a-7999-45a1-b9dc-05ce9c3c59c5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76b37dbf-cda8-42d6-a783-66d813d09f56", "sighting_of_ref": "indicator--99a95a72-5d9d-48f2-b512-a2f0b835ce91", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d470264a-aec5-4096-888e-c9e113135e11", "sighting_of_ref": "indicator--28da78ee-ef93-4f6c-b9c1-417be1f523e7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a074675-340b-4857-8b1b-59f20f8ca5e7", "sighting_of_ref": "indicator--1c3921f3-fa53-4723-9d4d-72c084f73fed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--193f16fb-5a52-4b6f-bbc1-b9d09acc9a63", "sighting_of_ref": "indicator--1c3921f3-fa53-4723-9d4d-72c084f73fed", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7832837-dce0-4af6-8597-2c36c89a3277", "sighting_of_ref": "indicator--666f54ce-5151-45bd-8d88-4d0ea03216cc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d0d1273-346a-46c1-b409-55faa7eaef8f", "sighting_of_ref": "indicator--a95e5f0d-bf45-4e6e-bf1d-60501e141736", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9320fbc6-59cc-45d7-bca8-28a2edfc57bb", "sighting_of_ref": "indicator--16139a08-0894-4dad-9514-65a4d18612d1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--465d246c-2d30-4640-a861-852e5b912fd7", "sighting_of_ref": "indicator--16139a08-0894-4dad-9514-65a4d18612d1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7ea9bd5-9093-4237-84cf-667e7df441d6", "sighting_of_ref": "indicator--bb2a251d-80f3-4bbb-8bf8-298046776f35", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--741d6002-6a70-4a54-9225-4808b2d032a7", "sighting_of_ref": "indicator--1c92251c-0bf5-4e8b-b08b-22bdf28cf935", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--653d416d-b9c1-4ec2-b146-bd0b92325e06", "sighting_of_ref": "indicator--1c92251c-0bf5-4e8b-b08b-22bdf28cf935", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db06c23f-2a88-49b0-8bf6-7f4e85659593", "sighting_of_ref": "indicator--a7350c00-41b8-4418-a951-f600bad01ab3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4885d785-59df-41e5-bfed-c32324efb737", "sighting_of_ref": "indicator--a7350c00-41b8-4418-a951-f600bad01ab3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8d2cc43-8574-4d35-be35-2e9f0490edf7", "sighting_of_ref": "indicator--9b5f8cfc-ce1d-463e-9852-035c619294da", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95c8b3ea-84fd-4139-bdc5-38caaac5adda", "sighting_of_ref": "indicator--160f2a2f-ea29-4790-8c74-186267ff73f2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e203c1d3-2f41-4c91-b3c4-17129c132ac8", "sighting_of_ref": "indicator--160f2a2f-ea29-4790-8c74-186267ff73f2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac135f84-8160-47b0-b803-569ca3522619", "sighting_of_ref": "indicator--d037bb5c-ce83-494b-bc6e-af37c949cb83", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc1ca547-c5a1-40f7-a9dc-1343b069faf7", "sighting_of_ref": "indicator--d037bb5c-ce83-494b-bc6e-af37c949cb83", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71cbeb6e-0366-4a52-a261-082bdb5fe663", "sighting_of_ref": "indicator--63867894-22fc-4f88-9f30-95dfb0079cf9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ec97931-2904-411e-93cd-5922208c9deb", "sighting_of_ref": "indicator--435a8ea6-d42b-45f0-bd78-a26a583b0f08", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39ef21c5-b429-4c70-85ce-b5b28c08e47e", "sighting_of_ref": "indicator--abea95b0-e4a1-466b-8956-581ec41bf19d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b35b080-89a2-48ec-8bac-f0ce85e67315", "sighting_of_ref": "indicator--847f70b9-58f8-46b3-a228-261426cd1e91", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42117d76-0873-4421-9ab6-a0950efc9844", "sighting_of_ref": "indicator--36e0c469-e004-4c77-a28a-a3af21ccbdb5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--787c1837-5e0c-46fb-9a33-f52db735b73e", "sighting_of_ref": "indicator--ba691e6f-6495-4c31-900b-54b4dafec45a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f86956e2-5871-49c0-ba39-2d048a842878", "sighting_of_ref": "indicator--ba691e6f-6495-4c31-900b-54b4dafec45a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--706ef96f-5849-4775-bfee-11804bb701c5", "sighting_of_ref": "indicator--10b59f64-2f96-4198-872e-233a2a8356ae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17439f59-52ba-4fde-8dc5-0f2bdb209b31", "sighting_of_ref": "indicator--10b59f64-2f96-4198-872e-233a2a8356ae", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--414bcdc1-2225-43d5-baf4-2bcc1429689a", "sighting_of_ref": "indicator--e6f6bea4-e062-4297-a123-c2d5f281509a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93157937-ead0-4413-9597-85f63434c7f3", "sighting_of_ref": "indicator--e6f6bea4-e062-4297-a123-c2d5f281509a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5819946-9eb6-4433-949d-995417fb8972", "sighting_of_ref": "indicator--8760351c-1cd7-428c-8f77-e9cb3aa34173", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--341471ba-f084-4671-8c32-d30cfd857523", "sighting_of_ref": "indicator--8760351c-1cd7-428c-8f77-e9cb3aa34173", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10a5448f-2a2e-408b-a04c-14f30c351e38", "sighting_of_ref": "indicator--28e5208e-f7f7-440e-bbf9-a630fdba7ab0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd0f0b91-f63d-45f8-997f-7ac5ae858229", "sighting_of_ref": "indicator--27df5ef6-1294-4e98-b063-d88395d3d0c3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de992b76-3db3-48d9-b37f-b8425ee03e24", "sighting_of_ref": "indicator--50c7412e-dfd6-4502-a26b-e807c43ba685", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--feb5ed5d-4df9-46b4-a980-a3a1dd48eeb5", "sighting_of_ref": "indicator--16d5dc4d-e5ee-4838-83d7-66b41171734f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--328785a8-f8ff-47a3-9b06-9ec87ff315d5", "sighting_of_ref": "indicator--7f79be64-87b1-4f02-a5fe-a827b28150d0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88b90933-4ae0-46be-b5be-5f7e12ec3f34", "sighting_of_ref": "indicator--7f79be64-87b1-4f02-a5fe-a827b28150d0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ef3e8df-7981-4996-a578-ff61284962de", "sighting_of_ref": "indicator--010d0064-6b56-44df-a46b-cf64510261be", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d2f005d-7f85-4b0d-aa4a-9f27620824c1", "sighting_of_ref": "indicator--aab613cb-a5d9-46e6-810c-a901f743fcc9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df982395-c907-49f7-af7f-a0e99abc56ae", "sighting_of_ref": "indicator--e7471a98-8c89-4af4-b8de-1960ef841a2e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--820cc2c7-ad6a-4ce6-8444-8ee47829c5b8", "sighting_of_ref": "indicator--74522c86-1901-4a1a-93fc-d2895d824b8a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fae9356-50f8-476c-9cbe-abe62cf1dbbb", "sighting_of_ref": "indicator--ea3914b4-6c76-4733-9f67-eb0af99303a0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c5d9eb1-d0ff-4551-8db7-7ba1f6f89ec8", "sighting_of_ref": "indicator--04049bcd-44ff-453d-ab9a-1eb8d3ccb2f9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fb10a31-0de2-4f4e-9b8b-6247ba6ef716", "sighting_of_ref": "indicator--a108b4e3-e257-4b0d-9845-b0e596037b9c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38fbb659-cc8b-479f-afb6-08011f942909", "sighting_of_ref": "indicator--1dacf780-4568-4824-aa34-5be0846f1c03", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--556f6b3e-9be8-4475-aa84-f21eae88e7dc", "sighting_of_ref": "indicator--1dacf780-4568-4824-aa34-5be0846f1c03", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--952ba29f-628a-4618-84e1-3bdd32cab48f", "sighting_of_ref": "indicator--cac224bb-2e34-483f-9d04-79ce407f0484", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0af4f53-f8a1-4328-82bf-7f75b82d0ec8", "sighting_of_ref": "indicator--b609d343-2f7c-4430-9e7a-21338abe967d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d1ef8d2-7681-42cb-b1b4-9ef5f4a1e3cb", "sighting_of_ref": "indicator--5f469882-4be2-46a1-87f8-2fea2d5f903a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74186d70-ac1f-4831-950e-65416b3b1628", "sighting_of_ref": "indicator--cecc93f5-2f44-44fd-b73e-2e405748c487", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc088355-c85d-4b6a-bd4f-8bd16bf8d4ba", "sighting_of_ref": "indicator--cecc93f5-2f44-44fd-b73e-2e405748c487", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e197208-6ab3-432e-a578-fe8394673f12", "sighting_of_ref": "indicator--534bded7-37a5-4d4c-a54b-3fb7c5ac13d6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cba2d7dc-31e6-4da5-9ff7-8ae130be0ad7", "sighting_of_ref": "indicator--534bded7-37a5-4d4c-a54b-3fb7c5ac13d6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1ea6480-5377-4b1e-adda-c4a5f431b7da", "sighting_of_ref": "indicator--2bf199bd-3fbf-42cb-9de4-0100f442804b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f173afe-4810-4c95-8303-118b67d5a264", "sighting_of_ref": "indicator--55aad2d2-c6a9-4310-a227-a25c56bc8a96", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1fb66a6-3362-4181-83ec-5419cf0a1ffd", "sighting_of_ref": "indicator--d6406b0d-ef3a-4227-b27b-d01285bd2879", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--032bf9b7-dcee-4c6c-9233-ab548e81d64c", "sighting_of_ref": "indicator--ad42ec91-5b70-449a-a85b-c565c03c05e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0eded21-02ad-41f7-9b3c-f03100e2a993", "sighting_of_ref": "indicator--fafb2fe7-cdee-4d82-bd91-1d7bca074cfb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba401d66-46b4-408c-ab24-b9d89aa49d8c", "sighting_of_ref": "indicator--fafb2fe7-cdee-4d82-bd91-1d7bca074cfb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c06c5c7f-59a3-4c8f-bf93-bac9df5904a8", "sighting_of_ref": "indicator--01047782-5439-442f-8d8c-f1f483153363", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9df92224-4da0-4fbc-832e-7a60cb58f75d", "sighting_of_ref": "indicator--2324e6c2-6f9e-43c7-b69d-a647a1edfaa4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--829fed59-c857-4619-b5e0-dd27cf2b8335", "sighting_of_ref": "indicator--cc89029e-ea8c-497d-8e2e-4254f40cb9d5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48c61975-2c27-44cf-a67e-3961cbbad858", "sighting_of_ref": "indicator--cc89029e-ea8c-497d-8e2e-4254f40cb9d5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14b49220-a17a-4593-9ed2-15a17802957e", "sighting_of_ref": "indicator--f11cda4a-a980-4cf3-a081-b59f4e4dc016", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b84e1b1b-fdce-41f5-bce2-5fa52809c006", "sighting_of_ref": "indicator--f11cda4a-a980-4cf3-a081-b59f4e4dc016", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d592f218-b955-436e-b9dc-b046c6294e57", "sighting_of_ref": "indicator--2b685e88-b4d5-49b5-8fc0-36798bf2e26d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83d01df0-9b74-4f48-a941-84a056b8e5f7", "sighting_of_ref": "indicator--2b685e88-b4d5-49b5-8fc0-36798bf2e26d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8f2b824-3401-4ba5-bf94-e8938af14bd3", "sighting_of_ref": "indicator--ae3c74d0-c1c7-4db4-a8cc-796bf6395d8f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b345433c-1208-4af5-84a3-f862cfdb212c", "sighting_of_ref": "indicator--c0283fd0-3e86-4762-bb4f-1429330dbe46", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--064440fa-aa20-421a-90d9-a8275bb54133", "sighting_of_ref": "indicator--87460cee-97ab-417b-857a-d2dbfa59bf9d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34426039-0109-4ae1-b76f-7fdf14bf74b8", "sighting_of_ref": "indicator--54a0875f-4473-46da-bb7b-a739b162bc26", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bebf5602-4a0a-4ede-bc52-fb4384f8e867", "sighting_of_ref": "indicator--5ae2fe4f-7346-453d-8eac-40915adf119c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa2201d8-78ad-4afd-8fb7-06a705fdae4f", "sighting_of_ref": "indicator--2128f7be-f79b-4d60-bfea-f23c522f14ad", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48daaf34-dbb8-4c8a-9eb2-e689482123e6", "sighting_of_ref": "indicator--74e86fae-dfc0-4bc1-952b-7884f4168a8f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3f6a5b7-27c6-496b-8a2d-fde512773000", "sighting_of_ref": "indicator--c36388b3-43cb-42a6-b72c-526579d9dc51", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a393183-0c6c-4f88-80fd-da7f76593990", "sighting_of_ref": "indicator--e824cf7d-22bb-4ddd-8251-21e3fd31170c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ef0f972-ebec-486d-b9fa-c13b3718479f", "sighting_of_ref": "indicator--8b8752b7-4104-4b08-99d9-e9d44eb0a9c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b44f2e01-d35a-415e-a50e-5cc22549f9fc", "sighting_of_ref": "indicator--49c996d4-4d4f-4d17-b8dc-24c165dc4688", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e551741-d082-41c4-8c08-5cde15f0f9fe", "sighting_of_ref": "indicator--4c85a4d4-b054-4bda-aba5-071dae048716", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5de01f10-e686-44ce-bcbc-0902afea7f1f", "sighting_of_ref": "indicator--09ab0ddf-a78c-4611-9b22-73d72026aeed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e3b464f-475b-402e-9061-e2ad1bf73f2d", "sighting_of_ref": "indicator--92f1a3fd-a15e-4276-9f5c-ca1b32114501", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d8f837f-835d-4a1d-b02c-d13472bb8059", "sighting_of_ref": "indicator--10de3714-82ba-4f38-91d4-881c9c6d013c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f926529-28e4-4193-b51d-89ea2871f228", "sighting_of_ref": "indicator--c58061ea-e0f3-44f9-bb17-db54455b34ff", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f54c9ed-3534-4c03-96c4-0673d987fc95", "sighting_of_ref": "indicator--3d19ce2b-7ff0-4b31-953f-f74f057bb27c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f02085a-f011-45d6-870b-b1df8ab18548", "sighting_of_ref": "indicator--da928a5c-bb7f-42bb-8792-52d0b0aa0ab2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57a0fac4-96c4-42c2-b5b0-bb00c6f29945", "sighting_of_ref": "indicator--a9dd92bb-d84f-44d8-b2f3-d2507e7994c8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d2adfce-82e0-46e2-98ad-9a52507f45c1", "sighting_of_ref": "indicator--a9dd92bb-d84f-44d8-b2f3-d2507e7994c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1be864cd-3c88-4b17-9ec4-1be0223e400e", "sighting_of_ref": "indicator--4bcd4ff5-bf95-4075-af2c-73d9c71eaa8d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f110aae7-cb40-4876-a4a1-85033315307e", "sighting_of_ref": "indicator--a6c15498-0de4-458b-a426-ea017b289351", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1eff95a7-f9e6-4f01-b83a-ac61d9862ced", "sighting_of_ref": "indicator--7aa76ba2-3966-4cd2-9be0-50f251e12540", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95248e58-fcb3-4bc9-a25d-31d802ed211a", "sighting_of_ref": "indicator--6d572991-f528-406d-8a9b-6662b6f39965", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d42e87f5-e569-48b0-a0bf-dde9a5b081eb", "sighting_of_ref": "indicator--6d572991-f528-406d-8a9b-6662b6f39965", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d0b69a2-ffe3-4159-896e-35e5e723bc96", "sighting_of_ref": "indicator--a004639f-46aa-4155-b34a-397fe3b236d2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d6e7510-ccb7-491f-813d-8f31b4bbe1e9", "sighting_of_ref": "indicator--a004639f-46aa-4155-b34a-397fe3b236d2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb4a8c90-8529-403e-abf1-bca92e17076e", "sighting_of_ref": "indicator--4c7cb538-bfad-40a8-98b6-27c8e8aaae3a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b37c2c6d-991a-449c-ad1b-792168c5f306", "sighting_of_ref": "indicator--e2a0344d-d900-498f-8e4f-af91114277cf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e13f04c9-36dc-487a-b59a-84f7c51a4795", "sighting_of_ref": "indicator--e2a0344d-d900-498f-8e4f-af91114277cf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f60c7158-6e76-41c5-809f-505fce7fff68", "sighting_of_ref": "indicator--7239b174-0457-43c4-8ea3-d00a19d4f1f9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8eb63091-d365-41c8-a0f6-fef508677361", "sighting_of_ref": "indicator--7239b174-0457-43c4-8ea3-d00a19d4f1f9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--106170f6-db3c-406b-aca0-ada2faddd487", "sighting_of_ref": "indicator--213dc033-695f-4517-b88f-1823815ecd9e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddc402c7-4283-4afd-ad40-0f481fa5df01", "sighting_of_ref": "indicator--c07f87c8-8766-4bca-900e-23c7c0c7ebe4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ac1e8ca-f162-433f-a008-df54bb90449c", "sighting_of_ref": "indicator--c07f87c8-8766-4bca-900e-23c7c0c7ebe4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3de89aea-06e4-4130-887b-70c9957a8b40", "sighting_of_ref": "indicator--86425841-32b0-4454-a6fb-b7db55db638a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8880b389-5703-4c86-bfd7-c37e553dc8e2", "sighting_of_ref": "indicator--86425841-32b0-4454-a6fb-b7db55db638a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc3ada93-64c8-4185-90a6-8475a9ff3feb", "sighting_of_ref": "indicator--caeba06c-126b-4b62-816d-97d2598dadd4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70f5d3d5-10cd-42c6-9cb4-5ca56cfd684b", "sighting_of_ref": "indicator--caeba06c-126b-4b62-816d-97d2598dadd4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdd1e61f-0810-4cd4-8879-6ca419f6443c", "sighting_of_ref": "indicator--8c4317b7-27ee-4c5f-8ebf-451d5db03092", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--081d8359-ee6c-40c4-815d-5e21febe13af", "sighting_of_ref": "indicator--dd035c83-f378-444d-92cc-474f5d2aa841", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--283e3298-2f26-4f98-88ea-53d445cb1c0b", "sighting_of_ref": "indicator--c34231ae-d17a-43c2-beee-ce5795b9f446", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--453a400c-56b5-4a89-8508-ececa7c56901", "sighting_of_ref": "indicator--09f51dd7-e498-4ef5-affd-51f33cf5955e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b702244a-03ea-45ae-bd26-921f02a67ecb", "sighting_of_ref": "indicator--09f51dd7-e498-4ef5-affd-51f33cf5955e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a2eadb7-fa07-456f-bdbb-c2fe120203db", "sighting_of_ref": "indicator--ca5cc23d-c617-4cdf-a848-245fa06417f7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7156c93-2050-4b16-8ac9-3f3d8e12f34e", "sighting_of_ref": "indicator--9c91e46f-7109-45fe-8468-90fb915842d2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57751840-38b0-4ca8-9e18-128539378e07", "sighting_of_ref": "indicator--fe3d4c30-f340-4666-8068-66c81e3a68ac", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dbaefae-e305-4e65-ac7a-2a828951f8b8", "sighting_of_ref": "indicator--ffe46f0a-3926-49dc-8c42-7be8b196a197", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9942503a-c313-4d19-ab96-7ea989438733", "sighting_of_ref": "indicator--0d735d0b-a2b9-4293-a6dd-7d7a8640831c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3868d865-0914-47f8-aab5-f1e76ac5ec44", "sighting_of_ref": "indicator--294719ee-a530-455d-80e0-14b196a4f3bb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecea4566-917d-44e2-8a15-c17853dc7623", "sighting_of_ref": "indicator--f1bcd03c-eefd-463c-9eec-b45353c25778", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73c59fb7-36f5-4c25-862b-0243712e1531", "sighting_of_ref": "indicator--f1bcd03c-eefd-463c-9eec-b45353c25778", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4648a43c-bb9c-49d6-964b-1f68a9c7538f", "sighting_of_ref": "indicator--d7b312c5-13ba-4f77-a615-257d7db5056c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1494406c-a4ec-4242-b6b8-5d97504b8dd4", "sighting_of_ref": "indicator--3eb629e3-0eec-4027-9bc8-eff969026acc", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--534101da-488d-4334-b94a-1227d8fd2b05", "sighting_of_ref": "indicator--6134e942-0ae1-48c4-bb21-5c2ab2aedb6b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93c6b29f-20f7-4714-9da0-d8a32185bdf0", "sighting_of_ref": "indicator--dcea4700-bf02-4203-90f8-33d97e4a200a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--343cfd7b-f063-446a-ab8f-b451b27c2753", "sighting_of_ref": "indicator--c2e575e9-ffd7-4ca2-ae50-d4ace68013e3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42c59930-38d3-4161-8ba0-77c027a21540", "sighting_of_ref": "indicator--1f54155f-ed90-4630-8801-b51e5b3bcbef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f93af21f-78d6-4d0c-a66a-b874358d3798", "sighting_of_ref": "indicator--2e4a4c0d-6143-4b27-aa65-c5e990efb12b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a869b48-fac3-42d1-8826-7668d6ee5ff8", "sighting_of_ref": "indicator--fed0e16e-0135-4300-bfc0-9e04ea89b518", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4e20743-7ce3-4b85-a3ea-f45796bb4964", "sighting_of_ref": "indicator--99717759-c430-4254-86b5-952c00f449e9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--938cd24d-3a69-4984-aa0d-b1b3d3b20b7b", "sighting_of_ref": "indicator--99717759-c430-4254-86b5-952c00f449e9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb21f050-e0f8-44e4-b80f-76d78a17970e", "sighting_of_ref": "indicator--adb4dbca-af90-48de-9b89-f228ab04329c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b26dba09-2969-48ad-b89b-a4f481bf6cae", "sighting_of_ref": "indicator--80e61ed2-b30d-40b2-89a2-78df91795a85", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f6bb45e-e4d4-4839-8a24-aadc6694e835", "sighting_of_ref": "indicator--8256573b-58c4-4766-a7a0-6b401c7d15ee", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9be791a1-9f97-4fb7-a82e-0c408db23fc8", "sighting_of_ref": "indicator--c94e8eaa-738c-48c4-931e-9fea183477a9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02099d2a-f0f3-4d8b-9b65-e7c5391f58e3", "sighting_of_ref": "indicator--18c46ca3-deb8-490f-94cc-005d43c11cf7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4e8bdab-1f41-4f97-b720-0a25c80d56b6", "sighting_of_ref": "indicator--85ddda13-87fb-4926-ad23-a317ab6d075b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50b56909-a17c-4335-92eb-842fe2b49b97", "sighting_of_ref": "indicator--af5ff636-ff64-4c1d-84b0-8663e1590320", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eba5d9ac-edbf-4141-b974-f21e12a16ff5", "sighting_of_ref": "indicator--33346248-4fbc-414a-af52-9a3c2a29ea81", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e367d23-0cd6-4877-bc42-20b37eb3555f", "sighting_of_ref": "indicator--eb241fc4-6cda-4468-87ed-4daa737cdeb6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24539971-e690-4a7c-876b-a6348e752dfb", "sighting_of_ref": "indicator--c4313493-2984-47db-8d7b-a88a079688af", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0092e6ca-14ab-483a-925f-20ff8e0c5d83", "sighting_of_ref": "indicator--c4313493-2984-47db-8d7b-a88a079688af", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f54764c-b331-4af3-a042-d701de7c250e", "sighting_of_ref": "indicator--7a8cc554-ed8a-4ee4-9b5e-0c04a530f2f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c431922-bb25-4b15-a715-6f48ab2bfcc4", "sighting_of_ref": "indicator--062e0e32-1d0e-4b63-9b0e-2f1f2f1837b7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1da9a21f-9185-4fed-b353-59bec919c5d0", "sighting_of_ref": "indicator--062e0e32-1d0e-4b63-9b0e-2f1f2f1837b7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2b269b2-09de-4bd9-8604-42b1e8352c92", "sighting_of_ref": "indicator--52391058-c415-470d-8fa8-1984d8bcec02", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cd672af-6dc6-479f-98bc-9f78f644d02e", "sighting_of_ref": "indicator--78417989-331f-4e38-8ea1-d6928a15bd4d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce7c45ba-abf3-4fc3-8ef7-2570b75cc578", "sighting_of_ref": "indicator--ec65d2fc-5022-4beb-aacf-82f1196c61a6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88594e83-c600-4f2e-a06b-aa165af09759", "sighting_of_ref": "indicator--02da3373-a35f-4e49-8bf9-d646ca60dd85", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bcfa410-9d18-4c17-b2f5-c8967257f489", "sighting_of_ref": "indicator--053f2785-14ac-4ea5-a5f5-d72a29e522ab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b69faa3-b84b-4a3d-bd37-092883f0ea3f", "sighting_of_ref": "indicator--8a9a516a-8d2e-490b-a54c-c7d0f8fd8791", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3675876d-5882-495d-8f9f-9c4d5819ea00", "sighting_of_ref": "indicator--6ab98924-7ad0-48bd-9559-05d90e3e62a8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--033ab61b-bc27-4565-9d72-31575b2bb9bb", "sighting_of_ref": "indicator--08f7b77b-d4d8-4130-81a2-86a3b03b41f3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85179c64-20d9-4b4a-82e1-75253a4aecec", "sighting_of_ref": "indicator--3b072ad1-9956-4609-b36b-695456d99eae", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba3e66cf-e46b-4053-964a-04a48aa394d9", "sighting_of_ref": "indicator--f44316a5-86b8-43d8-bac0-3a5da5f1fe7a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dc72c54-6dd0-4f0b-bc98-5d8d2ba35ad9", "sighting_of_ref": "indicator--32e151d4-eabc-48ff-bfd7-a28c89c805a1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ba00894-f0de-4a53-a5d0-3f2d5956ee69", "sighting_of_ref": "indicator--c25aef3a-15d5-4fb0-80f0-2b2037400163", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b9e2981-27c6-4205-82fe-d71004502501", "sighting_of_ref": "indicator--6c066a21-3291-4e8f-8752-af9eb7bec591", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2c095c4-6235-4b8a-a172-6da17a563f1f", "sighting_of_ref": "indicator--d3a0dac3-266c-41fa-9a50-568679c6f812", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d310f0a4-4e6c-466b-92ce-c43813b87b0c", "sighting_of_ref": "indicator--c30cfe33-05cc-4a58-a641-ac566d5d3ddc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3eae9101-e724-4d06-a871-3b99ef1c69a1", "sighting_of_ref": "indicator--88b1d981-bd8d-4ece-8408-0e7e06d32405", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1989c230-1383-4aa6-878b-9f9cbe4cd679", "sighting_of_ref": "indicator--a4fab777-96ca-418b-9532-9a87efd7a199", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e799f210-6134-464b-82d2-b6a04280cec9", "sighting_of_ref": "indicator--e97026f7-aabb-4bba-91ab-6e65c5380a52", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce1b79c7-221c-43a8-8e3d-67a5b8515ecb", "sighting_of_ref": "indicator--4968f45d-4214-4b44-beb8-75dd63fbfcd9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d34d89bf-60dd-4336-94d3-3f55c8a91907", "sighting_of_ref": "indicator--02d1f2a2-6cfc-4d21-95ca-e6315e6ad496", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c9dc9e9-5b5a-4c15-bce5-3d094554d3c6", "sighting_of_ref": "indicator--ec294648-1ad8-4357-aa50-d7be4da36c6b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1787a38-d991-44fe-b914-b0bf9ce43f58", "sighting_of_ref": "indicator--344d785c-0db2-43d9-85eb-e3fc76aca2a3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--773b7ada-f209-4f83-af2a-ed31298b8e05", "sighting_of_ref": "indicator--bf2720fb-f821-45d8-bd12-e4cacbb59d98", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69e21b50-5ad4-467b-87d6-ecd2ab400776", "sighting_of_ref": "indicator--ab512b40-a98a-488e-80e2-0e60b120c908", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1684592-59c9-4b53-a080-8c37b4eb22e3", "sighting_of_ref": "indicator--ab512b40-a98a-488e-80e2-0e60b120c908", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--674a4b0f-28b9-46c8-94ca-2a322a1b8d07", "sighting_of_ref": "indicator--1db4c9dd-a0d7-4982-8815-7c8026e5bd5c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9665c45-663d-4b99-91df-c1f635c29521", "sighting_of_ref": "indicator--436456d8-d0a1-4c1f-be8a-dafde1f126af", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f7535dd-0e89-43a3-b18e-81a223ac736a", "sighting_of_ref": "indicator--436456d8-d0a1-4c1f-be8a-dafde1f126af", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2de3c553-3f47-43fe-886e-0ba589034822", "sighting_of_ref": "indicator--7f0f698f-e6b1-4951-be3c-c7de4a355058", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2079c79-b891-4c60-bf09-1f7f13190e0c", "sighting_of_ref": "indicator--903b9a64-345f-4bfd-9ff4-bbd007f9868f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43f77378-8a36-4c64-8b86-4a8ccaabe41e", "sighting_of_ref": "indicator--926fdac2-cb63-454b-8d0c-4fa5ae13921e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c3de840-090e-4087-a0f7-a124300da81c", "sighting_of_ref": "indicator--0d5ea210-348b-43fd-8a0c-bfd418f40418", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2a79b52-0904-4b6b-b871-9ac4c7c444fb", "sighting_of_ref": "indicator--e4c508ea-275a-4e5d-a200-7d229e633ed7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3a4065d-a1a7-47d8-a2ec-0f559a1da4a6", "sighting_of_ref": "indicator--c5d8031f-4f87-4ef0-b9b7-2ada34e74a00", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c964893c-956e-4f67-99b1-37a1d130dffd", "sighting_of_ref": "indicator--9e5a509a-d85e-4b33-a775-59642b98142b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4daa00d5-9324-4ccd-a164-6f978f3cba04", "sighting_of_ref": "indicator--c489a80d-a168-41e0-bb7d-166e30d48d2b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e34ef86-e74e-42e5-b0c4-0cb0987f5905", "sighting_of_ref": "indicator--e0ae23e2-c5df-451f-b3cf-6eb5755f496d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10977294-e221-4c20-b1cf-fcd3f0c260b4", "sighting_of_ref": "indicator--a5052e49-8d05-4417-b9c7-15c50bc8d102", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8676b15-ef6e-49af-aa96-b349d39f134b", "sighting_of_ref": "indicator--185c49d1-d175-4be5-83b0-65681d066c38", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2898207b-80fa-4ed9-8d26-86c2b9db122d", "sighting_of_ref": "indicator--d8c8d9c9-2865-44c7-b208-6bb2bb2948fb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6f95dec-1722-4422-9b87-fbbe0c74c23f", "sighting_of_ref": "indicator--164f9af1-d86f-4e4a-8bd2-98e21fe3eae8", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--465ca432-23b3-40cf-81ba-fd4cc2fbe304", "sighting_of_ref": "indicator--cd61258e-a049-4b7a-9f8c-76b3e52cbc72", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87693bda-dd6d-41c0-ad45-5c9492e5b950", "sighting_of_ref": "indicator--ab1e3f15-e527-433e-907b-99a3f446e685", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4c6e14f-c5ed-499a-9af4-335a053ac25b", "sighting_of_ref": "indicator--ab1e3f15-e527-433e-907b-99a3f446e685", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d46d78da-49b7-4027-83cd-662fda2eb6a6", "sighting_of_ref": "indicator--afea2eda-55b9-48b1-961e-0e06cb48c7db", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdb1ba86-ffa6-4466-b4fd-0caaa68c2209", "sighting_of_ref": "indicator--afea2eda-55b9-48b1-961e-0e06cb48c7db", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68ff9dd0-45b1-4bfc-9637-cf6ccf88204f", "sighting_of_ref": "indicator--5d8058f9-6d53-40f3-89df-601c1b96c277", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2341ef37-6024-44c2-9dd0-62809cae8393", "sighting_of_ref": "indicator--f596b7c2-3ac0-47d0-9e80-bf117e09dfe6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f09b190a-21fb-4bdb-9edd-1d25a8a8512c", "sighting_of_ref": "indicator--f596b7c2-3ac0-47d0-9e80-bf117e09dfe6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b23e9d2-75ba-47a1-b5d1-67c4acb958c3", "sighting_of_ref": "indicator--2344f899-5985-4d1a-8cbb-1864d2f1816d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dd5ba0c-ad02-49c0-be3c-a1c0c3d5d232", "sighting_of_ref": "indicator--2344f899-5985-4d1a-8cbb-1864d2f1816d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4577763c-2067-4127-88eb-bd52afcfae40", "sighting_of_ref": "indicator--30804179-b560-4e89-a2b5-ef9774a493d3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--517d06dd-3d0c-46fc-9758-7fb9b0c870c2", "sighting_of_ref": "indicator--276679ae-8988-44a3-b5b4-625f90dcc73a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5bbc96a-bb6b-4a10-8d67-27db78093c4d", "sighting_of_ref": "indicator--276679ae-8988-44a3-b5b4-625f90dcc73a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8ab73bd-997b-461e-ba63-4e92d153cbc9", "sighting_of_ref": "indicator--64060310-8244-443c-9f06-b63990e4786d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7607a28-311a-4216-9841-2b16f9ec2463", "sighting_of_ref": "indicator--2655c0d8-743f-4ef8-aa78-b6395520db2b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a779af2a-9dd5-492d-adfa-e4e8b3cf0239", "sighting_of_ref": "indicator--2655c0d8-743f-4ef8-aa78-b6395520db2b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6932cb3-0246-4fcd-bc0c-90d46bb3df94", "sighting_of_ref": "indicator--6c99602b-b733-4ba3-b3ec-99f23578dea5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--776a8906-f526-4cfa-84eb-0c7f33f023e1", "sighting_of_ref": "indicator--8366fbe4-dc90-4afa-9d58-05a4ce42c8aa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3fca78b-45f4-4f88-a723-4daa130e1ef0", "sighting_of_ref": "indicator--1d11ae53-7532-4e05-9365-0f678d115b27", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04a5c8ff-c6d3-4b24-b42d-92ca80166b21", "sighting_of_ref": "indicator--1d11ae53-7532-4e05-9365-0f678d115b27", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b9562ea-58ab-40d9-8b13-5b442a5b82e7", "sighting_of_ref": "indicator--bce5e330-a819-4143-9190-2068c4d1cfe0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5744275-13ed-45ac-b75f-4bbf450d51ec", "sighting_of_ref": "indicator--e416d5e0-c36b-408f-823e-b2d7f0821914", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f5a9ac1-3866-46ee-9942-0d9dbc090a30", "sighting_of_ref": "indicator--f939fa0f-46e2-4f6a-97a5-c106c730283a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b00679f-3c6a-413b-9f2b-a95b2226e18a", "sighting_of_ref": "indicator--3e678bae-5203-4296-8e03-8fdd5b9287d5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afc06c69-8fb1-4dc1-892d-6e9558ad838b", "sighting_of_ref": "indicator--2884f4c6-e9a1-4ef3-acde-d1bc3ef77efa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--229c50db-9bdb-499a-87e2-ee840ae9d582", "sighting_of_ref": "indicator--7cb5c76d-93d1-4e7d-8755-e4f9fe42f39a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de6f3861-12eb-47e4-8455-2c1cd57bc104", "sighting_of_ref": "indicator--7cb5c76d-93d1-4e7d-8755-e4f9fe42f39a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a047e5ba-a994-4317-bf96-3dc0f5bd0048", "sighting_of_ref": "indicator--3df22e58-f253-4cf6-b1ee-57f6ff9ccd08", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f741bb8-29f1-474e-b7c3-9332bebe8088", "sighting_of_ref": "indicator--3df22e58-f253-4cf6-b1ee-57f6ff9ccd08", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef7a76a9-7162-4200-9f61-bb85f6ac3b3a", "sighting_of_ref": "indicator--760a476d-30fa-45a0-b2a9-fca5a86f3300", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3bd00b1-0abd-4066-86de-e5b744a828e4", "sighting_of_ref": "indicator--760a476d-30fa-45a0-b2a9-fca5a86f3300", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab37b14b-90ea-4e6f-8d83-2088632c2ddf", "sighting_of_ref": "indicator--82ff1ea8-79a0-4971-8496-62e3de2dc67b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd1191b4-ab0c-494e-800e-1eed4026efde", "sighting_of_ref": "indicator--82ff1ea8-79a0-4971-8496-62e3de2dc67b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdda553a-e2f0-4766-b6de-d4e2a9b3833f", "sighting_of_ref": "indicator--8ccd758c-a8de-447b-829d-505411ed74a9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4149d848-38ad-41d5-909e-512a1caa36f0", "sighting_of_ref": "indicator--8ccd758c-a8de-447b-829d-505411ed74a9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ee0b6e1-dc50-4225-a0dc-365dc0f943c6", "sighting_of_ref": "indicator--93dae356-404b-412c-94b9-d9daef2fd9df", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4d4023e-8e9e-4b1a-b507-33532e60e3da", "sighting_of_ref": "indicator--93dae356-404b-412c-94b9-d9daef2fd9df", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b793305-0a42-4652-9d47-71f796af403d", "sighting_of_ref": "indicator--5621bd05-99db-4c7e-9027-27f4ce7c1865", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01ca95eb-3bfc-426d-802e-3135cc576560", "sighting_of_ref": "indicator--5621bd05-99db-4c7e-9027-27f4ce7c1865", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26e91e88-b1f1-405f-be5f-9da4e7d3443d", "sighting_of_ref": "indicator--d3de9c2e-9fd4-49aa-8d94-a6da04da57a8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4e4e861-8917-45ef-a2d1-6592422b5357", "sighting_of_ref": "indicator--d3de9c2e-9fd4-49aa-8d94-a6da04da57a8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6eb38e52-05b9-4428-810f-22f0341a8f6d", "sighting_of_ref": "indicator--1b535b4b-6f72-4fbf-911b-7ef4f1c2632b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7445e91d-fbed-455b-942c-c6db2bfde82c", "sighting_of_ref": "indicator--38e96e5d-d1d4-44b1-9b68-9d99d1e3a5d0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--360e065f-e5f7-4934-88a0-03a6391682eb", "sighting_of_ref": "indicator--53a107ad-5c0f-4d37-98be-ff25a8a09801", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57cac7db-975c-4f0b-b5bf-dfcc622ed8b5", "sighting_of_ref": "indicator--53a107ad-5c0f-4d37-98be-ff25a8a09801", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e2f86ff-a7ac-403b-8782-1865d9ae7835", "sighting_of_ref": "indicator--25a0688a-50ea-445a-9956-b91ec4039b06", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7a05a6f-a545-4c98-a9fe-c503df205770", "sighting_of_ref": "indicator--b877cbd4-3d1e-4c21-899c-449faafe70df", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5c4be67-0d8e-41c3-aee9-8cffb9d8d20f", "sighting_of_ref": "indicator--2f431261-ae6f-4a01-948f-f5773e0d8a3f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc43b7bd-d21d-44e8-9773-6ef532f9cf05", "sighting_of_ref": "indicator--2f431261-ae6f-4a01-948f-f5773e0d8a3f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9795a19-fb97-444f-9f13-91abee4936cf", "sighting_of_ref": "indicator--dd3c3e93-d35c-4046-9316-aa361cbc9055", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5469aab-1322-4c95-a5c2-ac67fd4d047a", "sighting_of_ref": "indicator--50161a25-d622-4169-96a3-8979af730d0a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--513cad66-d448-4944-aa02-717b931417af", "sighting_of_ref": "indicator--48be25fc-6649-46c6-ac60-6d7ef8d6b2d6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b63e9f5b-dbc1-4e93-88ec-5d15c993b26e", "sighting_of_ref": "indicator--2d355116-7069-46b4-89b7-f65717cceb6f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31209b61-13cb-4f17-9d38-a55f78eb2fdc", "sighting_of_ref": "indicator--aaadf063-2b5a-4737-a77f-30cc422d23de", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b763cd7-fe0e-437f-9869-7431102d2752", "sighting_of_ref": "indicator--aaadf063-2b5a-4737-a77f-30cc422d23de", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10a0324d-3878-4984-92b3-bf794ac4890a", "sighting_of_ref": "indicator--2e1b63eb-c5d8-438e-9441-ce7609dbc577", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adb12646-7a3a-4e86-a005-70bf95498047", "sighting_of_ref": "indicator--2e1b63eb-c5d8-438e-9441-ce7609dbc577", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13648497-d451-41eb-99e3-b8078a154931", "sighting_of_ref": "indicator--cdf54ec5-8938-425a-9d89-0a88c6f0b511", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6a06c3e-264b-4b41-8450-6371f595a2c5", "sighting_of_ref": "indicator--cdf54ec5-8938-425a-9d89-0a88c6f0b511", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d8d4226-3fcf-4bfb-9fae-04b7788c1228", "sighting_of_ref": "indicator--6da91aec-82b8-4c28-af30-d96143d71c20", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abf9d054-b47e-49e4-a441-c743a3023163", "sighting_of_ref": "indicator--6da91aec-82b8-4c28-af30-d96143d71c20", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c8f96a8-fcc1-431a-a0eb-7fc722c66663", "sighting_of_ref": "indicator--339e2137-5cb8-4d20-bf27-a6da60b58dd0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58d778ac-2339-4981-9563-d4444afd0787", "sighting_of_ref": "indicator--339e2137-5cb8-4d20-bf27-a6da60b58dd0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c06d875a-825e-4a8b-8288-a722204cf90a", "sighting_of_ref": "indicator--f2a7b6c7-2818-4d1d-8ec0-8ec4ea1b62c9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e993dba-79a0-4e55-bd08-82cc7588ab82", "sighting_of_ref": "indicator--f2a7b6c7-2818-4d1d-8ec0-8ec4ea1b62c9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5077272-7ffc-4424-bf90-fc5132749f4f", "sighting_of_ref": "indicator--ece6ebe9-5042-4a97-aa20-b914ee907a4f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51110282-5e12-408a-abbc-f13cbcbb6c66", "sighting_of_ref": "indicator--ece6ebe9-5042-4a97-aa20-b914ee907a4f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a03791c-5d37-4085-ab3f-fe386cda7569", "sighting_of_ref": "indicator--69d42c03-a89b-4fa3-a1b0-f5a8e1f31a49", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c65a995c-84b0-4b3a-a298-ebe45125f287", "sighting_of_ref": "indicator--69d42c03-a89b-4fa3-a1b0-f5a8e1f31a49", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2ce37e1-d72e-4294-bd55-24a603e92d83", "sighting_of_ref": "indicator--5a63577c-c7ce-424e-80d9-0e2af19d2b9a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b547d234-cb2a-49eb-9ed1-25e9e531126d", "sighting_of_ref": "indicator--5a63577c-c7ce-424e-80d9-0e2af19d2b9a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f21f499b-20a3-461c-9fd7-1ae61abd418a", "sighting_of_ref": "indicator--5856c0c5-2606-498e-9c31-c38672d04aa7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6252228-6a8d-4bb0-a1a1-ea880ded49ce", "sighting_of_ref": "indicator--5856c0c5-2606-498e-9c31-c38672d04aa7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--832355d7-097e-4f31-89bd-42756b8b66f0", "sighting_of_ref": "indicator--f27e2234-7572-4266-b6b2-7b463c28f4e9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2b7be7a-e4f7-4b9f-b2bd-1a79a0168646", "sighting_of_ref": "indicator--f27e2234-7572-4266-b6b2-7b463c28f4e9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39f84094-5089-4083-816a-c809a44d6d02", "sighting_of_ref": "indicator--136a1580-839b-4d76-b859-c500421e705c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9602428-37eb-4835-a616-740af030dda3", "sighting_of_ref": "indicator--136a1580-839b-4d76-b859-c500421e705c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15bb0d6d-e46c-4a30-ba23-911b43fcfe22", "sighting_of_ref": "indicator--7666cf83-ce49-4e5a-9733-57a99dcdf676", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf37ad7b-ef25-49fd-ae75-1329b6c28d64", "sighting_of_ref": "indicator--7666cf83-ce49-4e5a-9733-57a99dcdf676", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--684a4b25-f179-48a4-a76b-98f20e0cc170", "sighting_of_ref": "indicator--5bb0fd37-3f0a-4284-a39d-aa5d5b065392", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4b885eb-0878-4060-abce-c8b8d50c452a", "sighting_of_ref": "indicator--5bb0fd37-3f0a-4284-a39d-aa5d5b065392", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2098ed3c-4c77-47b9-92f5-7ce60c0ec62c", "sighting_of_ref": "indicator--38db32b5-b5a2-46f0-b6ee-1873b7cd9f64", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d4ddd29-54d5-41b8-bfe8-9ac6f0472aa4", "sighting_of_ref": "indicator--38db32b5-b5a2-46f0-b6ee-1873b7cd9f64", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--275854e6-8768-43a5-90d4-c4acf2b14e73", "sighting_of_ref": "indicator--9359c4d7-3722-4087-b0e1-ab985779d916", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d3a9267-8702-4c57-9c56-c7a7270b547b", "sighting_of_ref": "indicator--d477ceff-de66-481a-acdb-0d675de9f2f5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0afd944-67ca-470b-8a51-969d69c18ba8", "sighting_of_ref": "indicator--b168eac1-0875-414d-a5ea-c6c359f73b16", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--803b264c-ab97-4433-8b08-c65f6fe266ce", "sighting_of_ref": "indicator--92688ea0-8311-4e3b-a5ce-6a6edfc5b46e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88f0627e-a73c-4dd7-a7b5-8585a7ab1f89", "sighting_of_ref": "indicator--e361f283-ea09-4275-8f60-d0fa28f6e0a6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3858375-0bac-430e-b0e8-646052d77de2", "sighting_of_ref": "indicator--60967c84-8dc9-4ef2-a361-7d95170c1eb4", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--874fe5a0-54fb-4af4-b80b-7133ca305953", "sighting_of_ref": "indicator--5d66a09f-342f-46b9-8259-7b7a328929f8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cd4305d-5ce5-477c-bb3c-756c3bbd2b28", "sighting_of_ref": "indicator--2b459192-8ab1-469d-83f5-e094b3e26180", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7ca3c4e-3ffc-476f-8ca5-6cf767749c00", "sighting_of_ref": "indicator--440ed617-6834-4d15-b730-16069b77578f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a95bd74a-a6fe-4f57-b8de-9733697adc23", "sighting_of_ref": "indicator--5e3cd5b4-ce16-4f57-9664-bf901e58ae2b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dbf629f-3a94-4faf-b7ad-2d71d412f8e3", "sighting_of_ref": "indicator--fc639075-7559-4380-ba53-45cfc6194087", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbc9dc35-b7e9-43a3-a4f9-a1998d6495f1", "sighting_of_ref": "indicator--27a00ff0-09ef-4108-ab81-b5157323b1ea", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d22d6432-7f33-4dd6-ab5d-8feee1ac5008", "sighting_of_ref": "indicator--27a8381d-1b3e-4b2a-84ee-f816e3fafb85", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--241b74b9-4a3d-477a-8550-21a51a3af4ce", "sighting_of_ref": "indicator--800aa807-a01f-4ac0-bdf8-83c06c8bb909", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66c8c1b6-452f-4f9c-b778-965343e0b378", "sighting_of_ref": "indicator--bcd2fb6e-88e2-45f3-8725-6cb7051ffecb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fffa9c6-302c-49df-890a-66504006c6f5", "sighting_of_ref": "indicator--053bbca0-6976-43cd-b9d3-7ae707dc7eb9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--517a460a-ee3f-4b6d-956a-619e6dca1522", "sighting_of_ref": "indicator--8cea021f-4ca7-4c24-8b55-b51304488aa8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b6e8a5b-94b8-40c5-b937-0918ae093141", "sighting_of_ref": "indicator--09e08a5e-87d8-4d06-9008-c5751034fba2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--945a3b9f-77c4-4450-a1d1-82c6a7262127", "sighting_of_ref": "indicator--3af26253-1899-461f-92bc-a14ce46088c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99cd6233-5b65-4452-bff5-bb2750f7a2c9", "sighting_of_ref": "indicator--e66ac102-fcdf-4ce3-985b-4e015ad870c6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce902247-5226-453a-9ab9-61ed85096be7", "sighting_of_ref": "indicator--8d0c5d23-850c-4fc2-a05d-bd7df4e26b2c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a47557a-a9bb-491b-88fb-c1ee9bcec33b", "sighting_of_ref": "indicator--00d755c2-d75a-4fd5-bbc8-ba30ac72eb23", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18f5166a-e218-41e9-955d-efd47960ab26", "sighting_of_ref": "indicator--d631d05c-b93b-46ca-8d27-be4e8e49498c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f809c39-540e-4fc2-9e27-8b34a6fa9c5a", "sighting_of_ref": "indicator--c1c11296-94bf-4ada-b8c7-8bdcfcb14096", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4f0258a-1979-45c3-accc-13d57ae181af", "sighting_of_ref": "indicator--03dc2479-cdc1-490b-9d6e-768a0bdab6bd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dabf2686-42d8-49a9-960a-eb783aca37bc", "sighting_of_ref": "indicator--d78a3bc8-4b63-4602-aea7-6c201fada872", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0da65166-6546-436b-bf67-c6db979529fd", "sighting_of_ref": "indicator--2d3e2979-ed97-4758-8f58-e2b2647ef7e8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ba5cd9a-e955-44fe-b8f4-f845b8d7c0cc", "sighting_of_ref": "indicator--cfc6b1bf-c9f6-44f0-8763-b22917ee8783", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77e11328-7f1d-4339-80d3-c18a209c038e", "sighting_of_ref": "indicator--4a26e130-bd04-4b0d-945a-fb4e806820e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa3fb809-75fa-48f6-8726-1c6eef335ad8", "sighting_of_ref": "indicator--7a3b6b69-d3ed-48ba-9ddc-74d549c921f9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2e32900-4be7-4243-9abf-762623d90733", "sighting_of_ref": "indicator--e9d069d7-7ef0-420c-b48c-94d0dda903a2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b710c421-dc01-404b-acd2-0727b9136484", "sighting_of_ref": "indicator--dbaf0a44-0c48-4145-b861-04a7228cac0a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f67fc07-75b6-4c7c-85fa-eea452df8ba4", "sighting_of_ref": "indicator--3902b494-692f-4107-bb82-b9d9a412b970", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ce7b243-1481-4274-b0e0-8b3eedb7c3b5", "sighting_of_ref": "indicator--309a853e-37eb-4e05-886d-3ea4d2b75db9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d93dd0c4-d273-4dee-98e7-ea71711632d2", "sighting_of_ref": "indicator--b445ff63-d3f1-4c38-8fe9-bf49c486ed58", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06d70b19-3eb7-407e-9d66-3960a3b8a611", "sighting_of_ref": "indicator--7b4b2888-02e8-43b6-97d1-8c829cc27aa9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47c1e01a-758e-4a40-a79a-677377f6b1ba", "sighting_of_ref": "indicator--dc9cdbdd-0069-46d8-bf5f-2549bd0b7ff6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2d16073-7573-4f6d-8851-a27bc8684630", "sighting_of_ref": "indicator--187745ab-136f-4cf7-a2cf-05dd0431c0c9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de8f1dde-6116-41bd-90bd-6480ca22c3e5", "sighting_of_ref": "indicator--a9644d48-fdd0-4ea1-b426-c3642a335633", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc110e79-40af-48b0-8ddf-8b2bf9750279", "sighting_of_ref": "indicator--f0098b8f-2a3d-4788-ab1d-003fc9a207ac", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab303688-ed4a-409f-b183-23aaa40715ec", "sighting_of_ref": "indicator--7458dedb-e286-410a-9f4f-31ade071592f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f8e18ab-3d58-41c9-a9b1-9ec42987f77b", "sighting_of_ref": "indicator--5e8e30e0-d932-4e70-97b7-3a9edf6ee429", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--204fb301-71c5-451b-ad5e-6c6a0d682e73", "sighting_of_ref": "indicator--129278c2-ec3b-497d-b3cd-32c69eb58ff3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee83fbb3-9ab3-4442-a3a9-0a4c618d133b", "sighting_of_ref": "indicator--e12f676d-0afd-4b74-9810-b51d2e3953ef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bfe0158-b521-4f56-b23d-8e9bcc2820d2", "sighting_of_ref": "indicator--4246ee6d-a844-45a7-8731-583bce02ae84", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78f6eee7-66f3-4144-bca8-f7bb560c4397", "sighting_of_ref": "indicator--ca380c9c-7cdc-4b2b-bbdf-066cea8418f8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb19bb0b-20dc-4a46-890f-d04ffbd342be", "sighting_of_ref": "indicator--2a4d717e-4681-4fa6-b2ed-e4f0df110009", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cfbf8f6-2231-4903-9926-697d2eda4b2e", "sighting_of_ref": "indicator--1b2ba82b-1c28-447e-bb5c-c4a48b4be2f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d211f594-080f-48dd-9a8b-e5c4fee0ea67", "sighting_of_ref": "indicator--1e6c9654-25cf-422f-80ca-d240ef61d6c1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ba25ff2-9015-438c-9a5a-a38d7916ac2a", "sighting_of_ref": "indicator--17fcb63f-518f-45de-88b2-964db7998887", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46a88914-08cf-4474-9720-2627538bb4d0", "sighting_of_ref": "indicator--230a6820-b1f4-4b89-8af7-ca5c4991fa08", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e125036c-44a2-4d18-a7d2-e1d2c8765080", "sighting_of_ref": "indicator--8c3f537f-ba02-474d-8bab-ff1899753098", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea96ddb1-824d-4fea-9049-5725ae03c29f", "sighting_of_ref": "indicator--cf4119c1-05f6-41b8-be00-126e43d08b36", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce7c61fc-7bde-40a8-937f-4ab6f2bec386", "sighting_of_ref": "indicator--c7715bd0-7c65-49d4-8a9e-7b7766ec8a6e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88d693b4-6d9c-45d4-95c5-68398f876800", "sighting_of_ref": "indicator--4ecaf125-6cb4-4788-806b-1bbfa8414d44", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2db4fb2-688b-4f09-9eb1-ce70e2130252", "sighting_of_ref": "indicator--bb8cc45c-151b-4e05-9614-cb7102316c53", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed13eb7d-abd8-4ddc-b2b5-3831167919f4", "sighting_of_ref": "indicator--d7bc639d-0d1f-4a57-85bd-1295efedcc20", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a9d013f-fe73-4cb1-b83d-38953a26574f", "sighting_of_ref": "indicator--750c0c1b-3b24-4776-bf54-5a057e586827", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d221593f-577a-4f48-89d6-6ed070779ee2", "sighting_of_ref": "indicator--b7a5a16b-24e1-424d-a0f6-a2e37e3d7fcd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d406773-2986-49dc-9988-e5e502b3739f", "sighting_of_ref": "indicator--aec5221d-4cc7-4a4f-bc4b-905b5d0e2441", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6403cf40-e743-4041-b8e9-d8727aaf77fc", "sighting_of_ref": "indicator--be01cff9-2ba5-452f-81b9-f29a1fde38e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10da3708-3eb6-42d2-b231-a975b7b40072", "sighting_of_ref": "indicator--965f6fcd-61fe-432f-88e8-fe637a5c0a63", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e3fb844-b75c-42e4-a8fe-11af70ff526a", "sighting_of_ref": "indicator--4c937e1d-f631-4c92-a4eb-8b0232d602a0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a585257-1ce5-4850-91d3-f4fe3fccbad8", "sighting_of_ref": "indicator--110b120a-154b-4cc4-8d50-1af5489ca57e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57485e4d-ee70-4e21-801e-eb89edcc2e18", "sighting_of_ref": "indicator--c772fb91-1836-4eed-bab0-082b80b5bf46", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a96a7c22-e6eb-4ef0-a7c4-38abf75d025e", "sighting_of_ref": "indicator--6907af8e-62be-445e-ad20-ef75cab4d67d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80abd41b-5afe-4447-86f0-2fb737c215c8", "sighting_of_ref": "indicator--ac6e8f5c-b0e9-4f54-8c4e-fb0cb7166f1c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f513c65-fa7f-4c8d-af5d-5245833545a6", "sighting_of_ref": "indicator--e4bd4a37-73a6-4be2-9cf1-0380619fd412", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ca50a44-8d34-4d3b-b9a6-bdc504de9ba5", "sighting_of_ref": "indicator--2cfa829c-0f71-48ea-9920-30bb3aeb21c0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee28dea3-a595-4144-aa7a-ea2dcbeab833", "sighting_of_ref": "indicator--ee670a6c-a53f-4352-b499-ac228e3ced18", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcb33402-c621-4fe9-9d2c-b87c9ba32628", "sighting_of_ref": "indicator--5aacb300-626f-4969-a75b-b32c7fb99355", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c2c1c1b-032f-4668-9b07-d63d850ebdb7", "sighting_of_ref": "indicator--a403a7f2-980f-48ac-ad3d-101389d706f8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4999f2c4-07a7-4438-87fb-f63acdcc8915", "sighting_of_ref": "indicator--8350e189-edf3-4355-9e9d-315f8562c39c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4547a29-e28c-4496-90d0-71832a43802d", "sighting_of_ref": "indicator--519b1b90-d763-48ee-ad9b-338d99387818", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbc005fb-6a5a-4afd-b3ba-a6c55ac529d6", "sighting_of_ref": "indicator--a48b6b76-e082-4687-a03b-23dd1cec62b6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a4a4def-079a-43c0-b603-e430850bca16", "sighting_of_ref": "indicator--aac7ae9e-5788-4fe1-bab5-6bf3a4d79886", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98320504-0da4-49dd-823b-fa5d86ec0417", "sighting_of_ref": "indicator--3ab09ff9-4403-4f34-a3a7-b111535194af", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a2eb037-3461-42bf-aa1d-bcd0e5a86eb7", "sighting_of_ref": "indicator--5f3b6f64-8b3e-4b7c-9eb1-2ade5edd4dfb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ff250bb-3a34-4331-a613-e007ba90ae9f", "sighting_of_ref": "indicator--bca56cef-aca5-4a1e-a46d-a767e255d82a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55ca015b-4c99-40a7-84be-4b28663c7c59", "sighting_of_ref": "indicator--5d0450b9-867f-4e90-adc8-cfcc88c7bab2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57edf51d-8d70-4b23-8153-5513321d0ec5", "sighting_of_ref": "indicator--d6e582d9-f018-4b57-ab5c-342c290149f8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea50094b-97d3-4362-8d98-f338de4957de", "sighting_of_ref": "indicator--16d63beb-aab6-4fe6-b27a-2dacb21840b8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15a41459-91a0-409d-8c1f-9667b3e4245c", "sighting_of_ref": "indicator--e7524994-6eae-464b-8f6d-cbb9cc140004", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80f6ba70-5610-4bb9-80ac-a3c7876848f8", "sighting_of_ref": "indicator--52a68f1a-b2b5-4294-b02a-0f0a2e13a931", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2b0e96f-3e2d-471a-a4fb-44f1fcda0145", "sighting_of_ref": "indicator--3dd90351-4a56-457c-b34c-22b9f9214d88", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92d3d133-72e6-48b7-8162-56415a8ae6a0", "sighting_of_ref": "indicator--ab2ee8ce-9f57-41b7-8f02-f3a0a4b1c229", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3841318-170e-468d-86e4-2b235185a051", "sighting_of_ref": "indicator--57a532a8-d686-4bdf-a8fc-2740f174bb5a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41ca2440-9d2a-4fff-a3fc-0da58cad3b45", "sighting_of_ref": "indicator--07ada45c-f6ca-47fe-a756-eb2c74a74192", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a3b269d-2899-4bee-837b-0b77f6e3d554", "sighting_of_ref": "indicator--5daeae92-6474-46b4-a4a7-0934fd0ba557", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a604eda-d7fe-4ee4-9ba8-2e2849ed11d7", "sighting_of_ref": "indicator--8c29ec1d-4fee-4fc3-9778-a22ff89282db", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9675f97-8e5b-4c3c-8012-59ea27f8027b", "sighting_of_ref": "indicator--c5dcc9fb-8167-4849-a55c-255e91461a6d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb173eff-82a5-475c-8ffb-b2d4240da481", "sighting_of_ref": "indicator--6fc92423-974d-4bb6-9977-158ed56bd7e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4981b73-d34f-4c77-abcc-092acb8605b1", "sighting_of_ref": "indicator--1980cdb4-2912-46d5-a265-196198392a7b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5e8d414-4aaf-4c01-ac25-ba926831067f", "sighting_of_ref": "indicator--63e27b1c-a64c-4d53-b618-ac9dea1933f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70741a58-1991-43ae-8872-ebed68e35047", "sighting_of_ref": "indicator--37a2aa8d-140a-4aca-b28b-41cfa47b487f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0569b27-989b-4efc-97fc-b6faa5190eb5", "sighting_of_ref": "indicator--d889e05c-e25c-4901-8c11-0208ebd22b85", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db108db4-94f1-44c0-b087-7e63bf0c6f97", "sighting_of_ref": "indicator--2795f9a7-a163-4023-a4a7-a904bdad1f47", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bfc0716-70f6-4c75-ab91-6cb468674865", "sighting_of_ref": "indicator--b3078b4a-d067-450e-8d43-096135a5344c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13263764-fd18-41ae-9688-fc7533068938", "sighting_of_ref": "indicator--215a462c-45f3-48aa-976f-38ba952f6416", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef5b37b2-793c-474c-8a64-e45011be4093", "sighting_of_ref": "indicator--22bc53a7-b89a-4878-9b1a-f7d3a0906a3d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52fa11d7-02b8-4641-9eb3-d430e4746f57", "sighting_of_ref": "indicator--49e3c9f3-ea2d-4b83-8247-766cc3fd0f0c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd46631f-1ff1-447c-9619-8dff78e3ee0e", "sighting_of_ref": "indicator--261496b5-3568-46e5-94cf-9d17d797678f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--316d7c77-ad03-4b37-a509-a652b52d03bc", "sighting_of_ref": "indicator--261496b5-3568-46e5-94cf-9d17d797678f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9b87926-e9b9-4f0e-a9e2-1f08c7e6ba84", "sighting_of_ref": "indicator--e8369ea4-40ae-47b2-955a-e88a38523195", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--daddcc48-558f-49dd-bf94-8d645aaa9e1d", "sighting_of_ref": "indicator--e8369ea4-40ae-47b2-955a-e88a38523195", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73d35750-8535-4727-89de-6f4945170edf", "sighting_of_ref": "indicator--1168dc3d-7107-4b3f-a7a1-92ab29a3a3de", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df73d8be-8bd1-4ad6-a8c3-7a523ffa5780", "sighting_of_ref": "indicator--854bb284-9127-42d0-ae3b-3d232f74ff07", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9c2a273-0bf0-4d04-ae70-9a1c4376d82d", "sighting_of_ref": "indicator--854bb284-9127-42d0-ae3b-3d232f74ff07", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6e36414-37b3-47ff-969e-7788e9335ff0", "sighting_of_ref": "indicator--51b5a25f-7f32-4a7d-98f1-e04e4fd2ddf7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cc31051-7034-476c-a641-67fb88a218ef", "sighting_of_ref": "indicator--38f9546e-398c-44ab-bf57-ed07d4c26d51", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faf28bc8-7368-4ad7-b9eb-e9f9efa433cb", "sighting_of_ref": "indicator--38f9546e-398c-44ab-bf57-ed07d4c26d51", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--008514f3-24c3-4f6e-96bc-df2b08600e12", "sighting_of_ref": "indicator--832b726e-0ce1-4849-af8c-870699b96634", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1e0f0c2-150e-4eca-92ab-cabc3a7a6b75", "sighting_of_ref": "indicator--832b726e-0ce1-4849-af8c-870699b96634", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7ca4d91-a7a6-4d9d-82ca-b1e9b58a4306", "sighting_of_ref": "indicator--b27307ac-7503-4ab4-846c-17b690c642d9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4ce8698-1e90-41ce-9439-aba07bdd09d1", "sighting_of_ref": "indicator--ef9d719c-081f-46ee-9ccc-6904714fc9c0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c48180da-6ffd-444b-b791-05fcf065a11f", "sighting_of_ref": "indicator--ef9d719c-081f-46ee-9ccc-6904714fc9c0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33dcfa86-31e5-410d-809b-5f141f63d01b", "sighting_of_ref": "indicator--ef9d719c-081f-46ee-9ccc-6904714fc9c0", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61cb352d-048c-4ebf-950b-ba777a9911f2", "sighting_of_ref": "indicator--5b3a7afd-6236-4026-b531-035e69136faa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef3d00b7-bc33-4644-8579-c7401e18e7ea", "sighting_of_ref": "indicator--5b3a7afd-6236-4026-b531-035e69136faa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d97c5831-edc0-4206-918b-4e42c89f6715", "sighting_of_ref": "indicator--5b3a7afd-6236-4026-b531-035e69136faa", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d58446b-c355-4ab2-a3f8-71a1c8deb044", "sighting_of_ref": "indicator--6917d264-8e1a-4895-94c9-c709b9363d0f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8df9a637-48f0-4554-929d-fdebe7fbcd3c", "sighting_of_ref": "indicator--6917d264-8e1a-4895-94c9-c709b9363d0f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d9b90bc-f1a0-493f-8458-f2e4d5ff7324", "sighting_of_ref": "indicator--6917d264-8e1a-4895-94c9-c709b9363d0f", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2522ab64-3ed5-47a5-ad4d-291a00e13c88", "sighting_of_ref": "indicator--e67f26e1-92a7-4291-a7a7-4348087bea77", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6044c2e4-3c4e-410b-bfbd-5384f3d47fd9", "sighting_of_ref": "indicator--e67f26e1-92a7-4291-a7a7-4348087bea77", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11430ca3-fa82-45eb-9dd0-23d4e2d73657", "sighting_of_ref": "indicator--e67f26e1-92a7-4291-a7a7-4348087bea77", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8472fb1-6478-4aaa-bc80-42a70469aefb", "sighting_of_ref": "indicator--955a9919-107f-471b-a726-5712c229511b", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c79d958-dbe0-4635-bb18-6a9529653e51", "sighting_of_ref": "indicator--955a9919-107f-471b-a726-5712c229511b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ce31cfe-4784-401a-a0bd-65e1b28e26dd", "sighting_of_ref": "indicator--955a9919-107f-471b-a726-5712c229511b", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7974a31-eb02-4ed7-93a3-e432e6585417", "sighting_of_ref": "indicator--2f2fca4a-7afd-4890-a210-09c046cff642", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72808a27-baac-4198-b344-dbcf6384e138", "sighting_of_ref": "indicator--2f2fca4a-7afd-4890-a210-09c046cff642", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1f8a143-bb10-4123-af59-e2af52b3d24b", "sighting_of_ref": "indicator--115f68d8-f2e1-41a0-95c1-539e95e2c5b3", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51e3610b-741e-4de3-b7db-10138de9c4ff", "sighting_of_ref": "indicator--115f68d8-f2e1-41a0-95c1-539e95e2c5b3", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--035119da-20b3-4218-b3ea-6db8738ebd1d", "sighting_of_ref": "indicator--115f68d8-f2e1-41a0-95c1-539e95e2c5b3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17c3c960-e456-4be6-9456-6629d2b9540d", "sighting_of_ref": "indicator--115f68d8-f2e1-41a0-95c1-539e95e2c5b3", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0b90ce1-5ee0-4bf1-b1de-7ed5a66bac59", "sighting_of_ref": "indicator--73fc46d4-a460-474f-b6b0-0ccf7f76c82a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25eda881-516a-4b6c-8d29-dcd8671c497b", "sighting_of_ref": "indicator--73fc46d4-a460-474f-b6b0-0ccf7f76c82a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ed75046-7fd0-4ef5-b142-f9ed1d988c8d", "sighting_of_ref": "indicator--73fc46d4-a460-474f-b6b0-0ccf7f76c82a", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7596601-24d6-4d2f-8040-c62ef20df6f3", "sighting_of_ref": "indicator--cfaa61f4-0555-47f7-a2f7-9557c7c5379b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58649189-8c06-44df-a66f-c0ce5592b40f", "sighting_of_ref": "indicator--cfaa61f4-0555-47f7-a2f7-9557c7c5379b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16b06e28-5fc8-404a-80fc-80a149e2c915", "sighting_of_ref": "indicator--1f86b6b8-45cb-4e60-8e4b-f211bd92a9fe", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33010976-0603-49f0-9bc3-6ea54d62d922", "sighting_of_ref": "indicator--1f86b6b8-45cb-4e60-8e4b-f211bd92a9fe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22589003-127e-48af-9165-2f99906e082d", "sighting_of_ref": "indicator--1f86b6b8-45cb-4e60-8e4b-f211bd92a9fe", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5b1f71a-ad84-42dc-97ed-f4e18b89fad6", "sighting_of_ref": "indicator--2485190d-c610-4cb3-89de-9fd4b382c881", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb45a818-0a30-46b7-99b2-4356e87b3e6f", "sighting_of_ref": "indicator--eb6b40b4-dd6a-46b7-bf3e-f567f7b8a155", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8e35fdf-a4c8-4e80-ba16-143be635a7f2", "sighting_of_ref": "indicator--eb6b40b4-dd6a-46b7-bf3e-f567f7b8a155", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36754b19-61e1-48fd-a317-77a11a693590", "sighting_of_ref": "indicator--ab7c2365-2810-4aea-b5d5-e8a6e3ea6bff", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdeb8cb9-792d-4675-94f6-3de7b739d890", "sighting_of_ref": "indicator--ab7c2365-2810-4aea-b5d5-e8a6e3ea6bff", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8af88b5b-cebb-4a6f-8059-dc7273dfa3f0", "sighting_of_ref": "indicator--b73bc0b7-5fe8-446b-8c0b-6d858278ba50", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fbd2cef-fc12-4e06-b874-be6295ed7ec4", "sighting_of_ref": "indicator--52583963-ecdd-4a67-aa31-6f4d98733e79", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2e3abbe-e137-40bc-8690-c26c944b6cec", "sighting_of_ref": "indicator--d2b4a663-24c0-4e87-aad0-bf8033cb01b9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--891bd15b-cf80-4811-9428-9744559d30c1", "sighting_of_ref": "indicator--42110688-d9cf-4279-b531-9725af0424b2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--821f9bcc-46df-4ae1-8c76-f12c79f295e9", "sighting_of_ref": "indicator--d0f5082e-d9ba-46a9-a4a6-4457bbe72964", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54df9351-ee21-486c-8162-5c9327f6de4a", "sighting_of_ref": "indicator--511112de-2082-414e-9803-0928e7897b87", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1984d489-83ac-42f5-853d-a92081b00aec", "sighting_of_ref": "indicator--6e0679b8-7733-4e28-922b-39d887e961b9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6b1bbbd-6ba8-4db4-9ba4-02642c930ceb", "sighting_of_ref": "indicator--e3d7dd32-8e87-401f-82d6-9abae31f3472", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae5fca5d-d50a-4024-bf11-85dac24b8442", "sighting_of_ref": "indicator--e3d7dd32-8e87-401f-82d6-9abae31f3472", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0924f076-9641-4c7e-b49e-803854defd27", "sighting_of_ref": "indicator--9ecb8517-f303-4144-ae88-ab98671ea93b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0422658e-ae23-4a26-af62-82e13bb07c7a", "sighting_of_ref": "indicator--024636af-b5a4-456e-9732-64f4625d9f92", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c50563c-f493-4e15-af99-0cf10f62e7c6", "sighting_of_ref": "indicator--9539c7b7-5fbd-44e1-a6c6-b41902f045c9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4069d43d-fefa-4364-989b-eeeebb27d6f5", "sighting_of_ref": "indicator--fdd22dc5-bb6a-4f09-af11-72d6dc0d84a4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64b6dc43-06df-4e12-bf12-1a8ada2e8761", "sighting_of_ref": "indicator--0b07ef83-0ddc-41f9-93c3-56af4961e5e5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--968daac1-641a-4781-bdc3-e11eb00beb45", "sighting_of_ref": "indicator--b2394436-433b-47f5-b0c1-f935fedbfc2b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bb101f2-c693-48f5-b777-b58c07964d8a", "sighting_of_ref": "indicator--b2394436-433b-47f5-b0c1-f935fedbfc2b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b485376f-4577-4661-820a-2fd66535c226", "sighting_of_ref": "indicator--64187a45-48c5-4404-ba0a-528fb21d68ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53a5ac52-1517-456f-b567-bf3e0401dfb6", "sighting_of_ref": "indicator--6e698344-2d5c-4983-b535-87a711b0a15e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87ac12ac-1f3e-4b50-8b58-3426042f1eb0", "sighting_of_ref": "indicator--d632e111-2a57-49bd-af79-a659cd071ac6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--641ed3e3-5702-4ff8-adfc-d6a72c698403", "sighting_of_ref": "indicator--168e1981-4e58-4c65-b11b-3455f017ed77", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1637ae7-615b-4ad3-9e8b-1eb16966e3a4", "sighting_of_ref": "indicator--5f5d7e0f-43da-4d7a-b4b5-fc0e8163620c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3cafdc2-bb18-4f6a-a2aa-56b6b7baf745", "sighting_of_ref": "indicator--5f5d7e0f-43da-4d7a-b4b5-fc0e8163620c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ba3d645-6746-4f1c-a5af-c6bb05d3c98c", "sighting_of_ref": "indicator--efa8ca53-074d-4fb1-b28a-75d9578e6753", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a84c05b2-ce47-4a40-a131-a818290843d9", "sighting_of_ref": "indicator--0c9922fe-c257-4d7e-a2b6-25ca27177a3c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d53cb95d-2584-4782-a5af-54e8bc113527", "sighting_of_ref": "indicator--1a69aa33-e56d-480c-93a8-0be489dda4a5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa35ea74-9047-4ba0-8879-40e8fdfe96a4", "sighting_of_ref": "indicator--1a69aa33-e56d-480c-93a8-0be489dda4a5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2eeb6de-de24-406c-ae58-871bd4bad94e", "sighting_of_ref": "indicator--610903d4-dc53-40aa-8ccf-0bb2f2abd313", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01e8188a-b105-44a8-aa59-646cfe0a737d", "sighting_of_ref": "indicator--07b6878f-faf5-490e-945d-fcc2679211c3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cd8c293-205c-45a6-abbe-48ccf5554f17", "sighting_of_ref": "indicator--475a8261-25ec-4173-a867-c6dec141069f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7430ab12-54d7-4d9c-a52e-736e82ac3ffc", "sighting_of_ref": "indicator--325a6ea6-c00d-417b-b761-7163dcedd9e4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66a33295-03a2-4048-bf64-7789b9155f62", "sighting_of_ref": "indicator--41c3ce68-dece-45ad-9e74-0d58d92a19d4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8238b15d-a4ea-4728-863b-1476d4adc1de", "sighting_of_ref": "indicator--c7f91507-b793-4685-a5aa-caefaf724925", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b54b29b-abd7-4e7e-84d0-b91855f9cfe7", "sighting_of_ref": "indicator--cc3fbe18-f0b8-4d71-998d-a82354d33698", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dda78ce-3cfb-4f37-a5a4-0d75e89c2ce5", "sighting_of_ref": "indicator--29f1e8ed-50fc-417a-95b1-77d5e8297da6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2200a3f4-0e0d-4c97-b9bd-47b6320d0ead", "sighting_of_ref": "indicator--ef5e45f6-06c4-4742-9497-2c2630711781", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78a71799-591c-4f60-91ed-cfd455351d83", "sighting_of_ref": "indicator--6e287c95-10b0-475c-aabc-1b7a79780ea6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48d4f8c3-e76c-47b4-b506-5eca476a3dd8", "sighting_of_ref": "indicator--6e287c95-10b0-475c-aabc-1b7a79780ea6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46a9a449-3978-4016-99c6-d1e7daa52f0f", "sighting_of_ref": "indicator--4dcc7426-1cdd-45e1-ae49-a71429564e73", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fc3a8c0-102b-4455-be29-b3e04778f494", "sighting_of_ref": "indicator--c30fd006-2890-4e84-864c-55ec83f9255e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a1ea2d1-cf24-4cb0-b463-ba92a5fcd4fe", "sighting_of_ref": "indicator--ab4bf623-9e87-4b3d-8aee-ce8596878e3e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b419033-d758-4ffe-b0a3-ab889529d1da", "sighting_of_ref": "indicator--b128b43c-9126-4fa5-80e8-336f4d73c246", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--229cd628-3a0d-4678-bf1a-277779dd1099", "sighting_of_ref": "indicator--b128b43c-9126-4fa5-80e8-336f4d73c246", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cfa08fc-078a-4507-9e3d-e6a337c952f5", "sighting_of_ref": "indicator--b91937fd-be2a-428d-912f-597d0f05696c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9013bd9f-ac0b-4a02-81f0-708930145809", "sighting_of_ref": "indicator--11ade6ae-5f4a-4be5-956e-a14176187f51", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67eda838-412a-4a6b-b01e-7350b0dddc26", "sighting_of_ref": "indicator--11ade6ae-5f4a-4be5-956e-a14176187f51", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6f1dd4d-6377-440d-adeb-50296ee8b645", "sighting_of_ref": "indicator--6523ed1a-4812-4997-8d68-7e6958478d38", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bba487d-a889-4ad3-8727-0c923221ab69", "sighting_of_ref": "indicator--493f15f7-4a96-48b9-a18b-f4c266a3b779", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--807cfe21-6a30-49b4-a838-8de219328a27", "sighting_of_ref": "indicator--6c9362c6-4749-4b08-bfe0-ba90e95254a6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19b87c5c-c3c2-4c60-ab71-bdbe3aa7ae48", "sighting_of_ref": "indicator--6c9362c6-4749-4b08-bfe0-ba90e95254a6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f5ce4ee-b18e-457a-a1fe-b31b55181796", "sighting_of_ref": "indicator--441315b8-451a-4d85-83d9-fa0fa232006c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68fc8c41-2ce3-4e9a-8c40-36c1443698f2", "sighting_of_ref": "indicator--441315b8-451a-4d85-83d9-fa0fa232006c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1422e0e-02e3-4c6d-bc4a-de3848a04713", "sighting_of_ref": "indicator--871baa55-4aa7-4f02-92db-a86efd8e3adb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af61559d-34e5-4389-a393-232024da749d", "sighting_of_ref": "indicator--67d8f70e-cd13-46fb-8f89-b22a48aceed3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--723c1e36-8548-44b8-b116-106a2e0aa9c3", "sighting_of_ref": "indicator--03971f97-d820-470f-a47d-d4752ab85e57", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb518768-6283-429d-84f3-ec840bc5f177", "sighting_of_ref": "indicator--39959551-0649-44a1-99f2-c762bc268bf4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f750700d-fb1a-446a-a009-80687f74adec", "sighting_of_ref": "indicator--fd4f9af4-2ed0-4bff-b12a-bd5a619eaeea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4b693aa-b008-4f47-9662-c30ab11091da", "sighting_of_ref": "indicator--1286f655-0d37-4503-9137-55e1d4ab13ac", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd6c995e-43ab-4d06-bd31-31c0b922fbef", "sighting_of_ref": "indicator--63dfa406-bd9e-4575-8ba5-06db00a64ab2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1021cd5-c587-4eb1-aa1f-edfbea288f37", "sighting_of_ref": "indicator--efec2ba5-dc0b-40df-ac4b-3289b68a8902", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--344a7abd-1af4-47af-b592-716c6b496091", "sighting_of_ref": "indicator--e272d9c5-8a38-4be8-adf4-9729c26d3630", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c724b481-c374-4735-b3d1-e349c1930acc", "sighting_of_ref": "indicator--91e52fb0-6d2b-4b23-8f93-bde3962f1f99", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e98f356a-279c-48a8-8ee1-842539e68318", "sighting_of_ref": "indicator--b7949591-a61f-4c0e-b2f7-68da765c8b6f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8697c20d-c159-4be2-8563-55a65e832b64", "sighting_of_ref": "indicator--1f07eea0-15cb-4817-a4aa-1cbc6af76b52", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bd52b44-cbe6-4611-90b3-d6d28c8eb216", "sighting_of_ref": "indicator--1f78e067-cfec-4f5f-99e2-51595a92c52f", "where_sighted_refs": ["location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70834841-b541-4ead-9b97-9ffd2a107142", "sighting_of_ref": "indicator--2643f23c-66d4-495a-bc2c-ec1e8e81e179", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fb79f90-1460-4e18-a9f6-47fddb30b5ee", "sighting_of_ref": "indicator--ef01e6f9-1ead-487f-9ada-c8233b4880ae", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--439c3094-01f4-42a8-9358-a6e8adcfce42", "sighting_of_ref": "indicator--040c22a6-07f9-4d54-9b0b-1730d0c25d74", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4412c6a-c869-4a2f-a913-4e86cf680c93", "sighting_of_ref": "indicator--010025b1-e1aa-4ea0-9221-5b2fb9a04f73", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e635154-ca10-446c-a6a3-20055a6a13d6", "sighting_of_ref": "indicator--3f2d1a8f-c48c-4b20-9cda-9ca0f13ccf9d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12b16fa4-4224-4c74-89bc-1b2ebab373b1", "sighting_of_ref": "indicator--3f2d1a8f-c48c-4b20-9cda-9ca0f13ccf9d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b031fb2c-ff86-41c8-a956-6a3cba04e72b", "sighting_of_ref": "indicator--90a492a3-3c69-40ba-ac01-8089119fbca0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55719df7-9ec9-4cb7-a214-967ebe399866", "sighting_of_ref": "indicator--eec3d084-daa1-4041-aae8-0a3c40e9003f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13040150-fc01-435e-8dac-63e8c7ef38fc", "sighting_of_ref": "indicator--27e53609-5c44-43f8-86ee-1d942dd76f72", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47125848-1be9-4218-b0ca-8bc0bb141289", "sighting_of_ref": "indicator--9bb86b41-d4f0-49e8-8b36-daf4aeba40b0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2518eefa-09ef-465c-9dea-35a9738621d1", "sighting_of_ref": "indicator--c2e6f412-85b4-4150-8b54-0f6fe93b9466", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17a98677-663b-4baf-a519-178ff9d1fc30", "sighting_of_ref": "indicator--8fc364ff-8822-4c23-9f62-1a4940238e5c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baff89fd-e770-42c1-abfc-a2fd2a9e9d36", "sighting_of_ref": "indicator--ddc1054f-cdb3-4cce-9e79-18704a7dce8d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61ce4d4a-5ffd-4bf1-80e5-11c25fb1d2b3", "sighting_of_ref": "indicator--2ac98cca-6123-4a87-b397-1ce02cdab28f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7c048ae-3334-4043-8e90-f5a0a7365462", "sighting_of_ref": "indicator--3980ad6b-8061-4572-824c-43073080139f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6622dcba-ca30-4d83-9284-699c82a6c75e", "sighting_of_ref": "indicator--3980ad6b-8061-4572-824c-43073080139f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d7c1ad1-dd16-439d-8721-2a4542c02959", "sighting_of_ref": "indicator--c2361a5a-9363-4ed0-a103-f3eac3495ccd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5100d70c-2543-4819-993d-9cf39a1bb3de", "sighting_of_ref": "indicator--523ea7cf-d168-40c4-ab4b-754dd91d1f09", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17b2724c-3d6c-4c5d-9daa-74977b946542", "sighting_of_ref": "indicator--f3f1e60b-3cc3-41a9-8723-f39ef5e1e501", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e16dd4d-a71f-48ec-a3cc-2782f8d57845", "sighting_of_ref": "indicator--c6b70a9d-7db8-4689-b27d-186a18cf338f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3476f394-a905-4955-a9e4-5d76cbb6ba7b", "sighting_of_ref": "indicator--826f23a2-1279-4a56-93ff-c4ec7a1780b8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e1593dd-aa92-412e-9474-e836d8578070", "sighting_of_ref": "indicator--9684c357-eaf8-44bb-92a4-095b321213f2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9aee1173-8209-44ee-89a7-e14954c9c605", "sighting_of_ref": "indicator--73f9af31-1c74-4679-9ea7-49077cd4a3cd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b067df94-9aab-482b-9010-b4d280fa6030", "sighting_of_ref": "indicator--99ec1dd1-6545-4019-b1f5-2c6e9bcebf9b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f96ad31-ed7e-428a-b73a-9b04a7c2bcd0", "sighting_of_ref": "indicator--fd12167b-128d-47d2-83f3-5c7eb78c56e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c3a2951-af80-40f3-8f9a-6bb0a8bf8f38", "sighting_of_ref": "indicator--0f4e01bd-e7ff-4012-b960-ccc2ae7ce6fd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72448727-d694-48c6-adc2-fc13f8978c74", "sighting_of_ref": "indicator--b89a1c2b-92eb-4648-8f48-d4d459d61296", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59e295c2-c529-4bba-974f-fddda577b1fd", "sighting_of_ref": "indicator--fd7fa1e1-6236-4e52-9db3-d006614d8f09", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35637a20-1e13-450f-bcf6-d05bd2f2640a", "sighting_of_ref": "indicator--995afa43-43f2-42c4-bff1-df13bbf40f29", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c600a00e-3dfb-4d82-8645-5b4b8f0b5f31", "sighting_of_ref": "indicator--1dafb13d-2363-474f-9c73-e428871da9d9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbdc1f6d-1152-4185-a5e3-48b0f8bc926e", "sighting_of_ref": "indicator--b853ce6d-5d8b-4663-bd37-3816052c448a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dd247c7-05ed-48c0-b810-99993e46f5e1", "sighting_of_ref": "indicator--f28339ff-82a5-4520-af98-e06bb88fe5f7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3441284-fc85-45c9-9b10-491b7151a718", "sighting_of_ref": "indicator--a0fe1d91-6856-4d78-9452-3c4044af4ff2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6342ab31-57a2-413f-996a-14ab9599f105", "sighting_of_ref": "indicator--e2557604-45db-4476-89cd-82a8edc8757d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9184a87-5205-4794-aa36-d392d3de0f0e", "sighting_of_ref": "indicator--718ddcf6-d868-4fef-92b8-61eff37a0c4c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--357efcec-f29c-4648-8f06-12ad040e9ba0", "sighting_of_ref": "indicator--429ae785-70a0-4db4-b8ae-de9715e5c45c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14a42856-c5cd-4762-8322-ec003ca50273", "sighting_of_ref": "indicator--311a7b66-bbac-4a86-8d53-282aec6a1c2d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bd2ef99-1bcf-477d-9402-7c795c622068", "sighting_of_ref": "indicator--b977f626-9d84-464b-b3ca-c73d00c018eb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28e426cf-278f-4ca5-bb50-e8df53a67442", "sighting_of_ref": "indicator--390c48aa-a593-49e5-92a4-1cb4cb7dfa47", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2aea0756-6f59-4528-9fd1-e90fafa3b1d8", "sighting_of_ref": "indicator--8b57d7ee-9f4d-4be9-aadb-99eb44cb8ba4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8708c292-17a3-42ca-bdfd-2de8c6d3ceaf", "sighting_of_ref": "indicator--be3419bd-7c8d-42fd-ba68-25db0b1a4f3e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1de7915b-4b87-4f6d-b20a-f56965995267", "sighting_of_ref": "indicator--6a3d8139-012b-4c69-b2ec-e6bd057dbe1e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82faec57-7bcf-427d-b894-f980c2d08d30", "sighting_of_ref": "indicator--e0ec7fa7-3199-48f8-bc21-6b6cf30f2894", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d343fa3e-9401-4d39-97f3-b79ff390f0f2", "sighting_of_ref": "indicator--ab82ed73-56b3-4e27-924f-0cda33557453", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99f5d174-a06c-463e-8a4c-08b348084860", "sighting_of_ref": "indicator--1aa47031-df67-4635-8051-8eaa90f72fb5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff9210b2-de9b-4cc5-a1dc-c1ef911cf753", "sighting_of_ref": "indicator--1c75d91d-41d0-4ebe-8c48-ec945fefb82b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec53885a-91fc-4664-8c46-32acb4d9e368", "sighting_of_ref": "indicator--b406e5e0-39c7-4b50-82d3-c25770c71ad1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e93a735-3095-4dbe-88c1-c7dcd8ed86db", "sighting_of_ref": "indicator--be9837b3-f1d6-49ed-9256-69ae89e60001", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1ba3047-8a66-457b-b735-beab93a0b189", "sighting_of_ref": "indicator--ae3fe816-04af-4d05-babf-9fe2edad2b17", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--501e0df8-0f03-4115-a9ee-004edbcb9291", "sighting_of_ref": "indicator--df216acc-8e2c-4227-ac3e-2efb6547b5aa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a59a8b61-7126-48d5-93ff-e367fecdd011", "sighting_of_ref": "indicator--b9615d46-7e9f-4340-a488-534c7f7a2729", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1caa464d-2559-4566-84a3-924e5cbb3915", "sighting_of_ref": "indicator--7128efba-5cf9-4ffd-a701-4e7ff511841b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e40fc52f-3b7f-4147-a82d-07b60ded9807", "sighting_of_ref": "indicator--6c53e43a-609e-4558-bcdc-2301e01c83d3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d26c411-e1b4-4a0b-b884-17266272f8c4", "sighting_of_ref": "indicator--41613623-a69e-4a38-aa76-1e3dfe282204", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00b34c95-df53-49f9-9190-3d50d6215912", "sighting_of_ref": "indicator--f74c353a-c5e8-4bb6-87fa-0aeb44f9dab4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6b72f43-e54b-4c05-8d3d-da8a45246a43", "sighting_of_ref": "indicator--38084297-e431-4e40-8a9e-be38e3d72f21", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a196abe-3377-4d42-89c3-dbfaabf7abdc", "sighting_of_ref": "indicator--c625ecce-25b4-49a3-a252-083a5ca81a58", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c98ad9e3-bd62-4bb4-8a4d-dca02efa7156", "sighting_of_ref": "indicator--4fe409ab-3cc0-471f-a3c2-3a4a8dcb17ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67d91372-3304-4f0f-a11a-8cea6039c4b1", "sighting_of_ref": "indicator--eff7248b-e2c2-4810-afe2-b2c83d5e2ac8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48117ca2-feb6-4293-bd49-1549dc08f19f", "sighting_of_ref": "indicator--61a4d1d4-98f8-4652-b21d-486586c29471", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--881300ac-8a11-4b28-9069-2b4299b97ffb", "sighting_of_ref": "indicator--caf033c0-907d-4b89-8a85-fcf38893b66d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b17177aa-0038-427e-90d2-49cb1c06878a", "sighting_of_ref": "indicator--1e910178-5616-4ca5-946e-cab32cabbd0d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f21bdbe-d8c6-4c04-a160-bd68aeb6da83", "sighting_of_ref": "indicator--ba081c7f-23cf-4cca-8eed-6961c8043cb8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01f550d6-e270-46fa-9ba2-e2bac10a5191", "sighting_of_ref": "indicator--93554704-835c-46b5-9bfd-9d84f546db88", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3d2140f-e5dd-4bad-bbe6-cb1ceec8453e", "sighting_of_ref": "indicator--a8e799e3-fc89-4b03-b48d-48eefe5a45c9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1cbc9cb-7615-4f49-ac97-a7d053392362", "sighting_of_ref": "indicator--2014f852-9a37-4bef-a37c-b7b631309b84", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29396c02-4025-4c11-b11e-e7050842174e", "sighting_of_ref": "indicator--32b7f7dc-3cb7-4b51-9e1f-512acd8a4ccc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a549b25a-a565-4873-8c01-9cfac0bcf25a", "sighting_of_ref": "indicator--8cb9f81c-90cb-4f9e-bed7-cf2c7ff18f93", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06eebd49-01da-42fd-98cf-0eeb220c16e2", "sighting_of_ref": "indicator--d9b48d63-cbbc-40ba-9d47-3a144f785d5e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02c8b18e-9e14-44fa-ae84-417bb8ddb368", "sighting_of_ref": "indicator--457aefd4-7021-4bcf-bfc8-f15a0aab57ee", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--338475fd-b758-4800-8bb3-d24cff921fe3", "sighting_of_ref": "indicator--b46e01c3-3ea9-464f-875f-d4a7f1a29a53", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--311dd809-313d-4242-8808-d8a7d9d34cbc", "sighting_of_ref": "indicator--2f8dc68e-be46-4335-95a8-c52881001c6d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d810500-f729-4e89-b388-781e01f74be8", "sighting_of_ref": "indicator--dd51f7e1-792d-4877-b564-f7182df5fbf5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efd3fd5f-18af-4e90-9d90-e3e4a3e77bad", "sighting_of_ref": "indicator--0f17a614-a35f-4083-92b3-1b509cd76306", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1095850-21bc-4a87-9aa5-0bfbc084595e", "sighting_of_ref": "indicator--0f7b0074-c08a-4176-a319-848009fff0e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1545848-b127-4c06-8a52-a886720bb2c6", "sighting_of_ref": "indicator--212a6de6-4daf-459c-8991-f0d77fb38aab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9caa47ca-d96f-4d7e-a96e-636cb3343380", "sighting_of_ref": "indicator--ec9e30f1-ac07-45cb-abb3-c9b8071c2ae8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7527ed7e-b8c8-4d9a-97d1-d9d28f7e0944", "sighting_of_ref": "indicator--166cb469-7442-4e07-b055-fb68c5dc990a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61df20a7-59e8-42c5-8cf1-db8178903089", "sighting_of_ref": "indicator--03f18592-f747-4686-96a3-d8b0c70fed77", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63bd919b-221d-4aa1-b1f2-61d05f8acdba", "sighting_of_ref": "indicator--273920cb-4810-4e60-81c1-233e03ceed17", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8144cff-ee86-4425-8eef-e25217d29891", "sighting_of_ref": "indicator--4e2abe8e-db1d-4897-9a82-7db68170d1b1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a581477-6805-470f-b15d-05d1a0a7d561", "sighting_of_ref": "indicator--f28b150d-f69e-4b2c-a88b-e375989c3f4d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b249e6b-a37f-4bb3-9f0b-f0229da4e194", "sighting_of_ref": "indicator--ccb4e9be-4e2e-4a19-b553-b0cf07bfbb40", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53931f6b-e2c4-494a-bc12-0c1633f3fa14", "sighting_of_ref": "indicator--e8822b9d-3be0-4976-b386-9c5c3650c70b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31e59207-509a-46bc-b3ce-bc91ca125efa", "sighting_of_ref": "indicator--93090e79-79e8-489f-b6c4-e01c9b1db2ea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8139a13c-fbd6-4633-9e3b-da578401d3f9", "sighting_of_ref": "indicator--c7980591-6c6b-46c9-bcd1-b5ae503beb5c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d7e4da6-4cde-4fa7-b035-0647561c376b", "sighting_of_ref": "indicator--96152245-1853-45e8-af2a-e42c239a5083", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fecf4b0a-40ed-485d-be43-b72c2e564465", "sighting_of_ref": "indicator--0ea5fdb2-eb47-48a4-ae58-19c34ad50ba8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad84f0bc-562d-4ef9-a048-60252e68ab6f", "sighting_of_ref": "indicator--6880ddd3-b0e5-439a-8c57-dbc4289b5560", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf7404bd-06a2-4b4a-8433-d174ace9d571", "sighting_of_ref": "indicator--a0a43a84-1912-4718-84f3-871181eaaa86", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58410fe3-2631-414a-b99a-e08da71c9b5a", "sighting_of_ref": "indicator--7661bcd0-075a-4c0f-b9b0-14ac612b10e4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ea59aee-1350-4f22-855b-1768d3c2f05d", "sighting_of_ref": "indicator--ae08f0f3-8db1-4883-a011-2917fdb14fce", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--166336ae-d71a-48af-97a9-c4fe47a301df", "sighting_of_ref": "indicator--66e4abb5-a2c8-45ad-a19c-876eacbda657", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34aa58f3-8624-4ab8-9760-976e1e1d5d1c", "sighting_of_ref": "indicator--185faddf-f7f1-4b4a-808f-33aa2205f80f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89c4a20d-c6ab-48e8-b295-00dc10083e63", "sighting_of_ref": "indicator--6b3afb84-892f-4fea-8dda-15348fb3e880", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0a3e63d-3b2c-435c-b3c5-dc3b45b918ed", "sighting_of_ref": "indicator--87931118-fa00-4a0e-86a2-6e1c0cb08399", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c54ab16-bebd-4e0d-b69f-57c6075769b0", "sighting_of_ref": "indicator--95dfbd34-c0b8-4ee6-8f07-bc6201cd9c40", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a84da85a-9862-4f81-8e4b-c0f8cf2a0d4a", "sighting_of_ref": "indicator--5618080c-e8e4-4f99-a146-f2104965926a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--244b69ae-cab0-46c8-9c46-de38ac8b0497", "sighting_of_ref": "indicator--2ccf7010-9bb4-45d7-95e1-ef0b2f083a1b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa95f32f-9ea4-417b-b86f-33dca51a7e84", "sighting_of_ref": "indicator--f5c0a61d-02bc-483e-9f9a-df2ad92d5915", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77a9eefb-ce1b-48b4-be84-6a1d2ee3a580", "sighting_of_ref": "indicator--c9671471-4076-4b4a-99f1-faf39f46678b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--770a203a-197f-4583-95bf-285bbc1f3dc6", "sighting_of_ref": "indicator--31a25246-2e41-4704-8db7-7bd028cd9d10", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2078c34-12ec-4007-96e6-632bdfa4eeee", "sighting_of_ref": "indicator--e759f4f1-ce8f-400e-b791-568a8257a482", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d41dd0d3-28a9-4370-86da-af937259f2b9", "sighting_of_ref": "indicator--b808d461-1602-4d86-be05-c234a2ca12fa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--163c33e2-2c57-4aa0-8220-0efb2d3921ae", "sighting_of_ref": "indicator--a837a8c5-69f5-4fc3-bf05-1db12797845d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--368341a1-d181-4311-849f-c55c1f17737f", "sighting_of_ref": "indicator--548e2a31-5cef-487c-8243-43afc1402565", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--447fe3ae-71ab-4bc6-ac92-7eddbcddad84", "sighting_of_ref": "indicator--2bd4d114-4ed2-4d1b-aabc-d959be6a61c7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edc95da0-6607-430b-8e99-19787fbe367a", "sighting_of_ref": "indicator--7cb468f7-3b27-4145-afb8-9227b10bd0c8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4cc9e0f-ea1a-4d5b-8e4d-5dc344ade3bc", "sighting_of_ref": "indicator--fa1efa7c-8245-400e-ba42-80c5f5bbc8ca", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e79c8e5e-0fec-4586-94e7-c2f92607f5df", "sighting_of_ref": "indicator--0d088bda-e79a-4afc-8a70-b3c7a394b0ea", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdc94331-5da5-4b26-a293-74b64db6d41b", "sighting_of_ref": "indicator--be52edc7-2b23-4732-895e-2e2b9d9d1eaf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51583f32-dfd1-4032-87d8-863d756a4146", "sighting_of_ref": "indicator--d47bfbf1-0e05-4af4-aa47-b763aaea0eaa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e934458a-2821-46dd-801c-88fecbf14316", "sighting_of_ref": "indicator--2c9e6dcd-7766-459e-862d-9777bce873c5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31cbc892-0cb7-425e-bac1-9042b3fa65f3", "sighting_of_ref": "indicator--eebbee02-37e0-4109-8d60-9da5c47ce44c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f56b7470-8816-4146-b475-3ec331be0c84", "sighting_of_ref": "indicator--1d73f1b0-47fd-433a-962c-f7dad9e633d6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f9ac0aa-0c9e-462c-9172-8dc5f9d9c319", "sighting_of_ref": "indicator--26abb4cf-d329-4db5-9712-5c64f39a621a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e54ad4bb-e05e-4575-a7ef-d692ca894cd0", "sighting_of_ref": "indicator--2688ed12-d7bc-4fe2-85c2-b9e687daf665", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--980f0412-6229-4e42-8008-9e0f009ecfb4", "sighting_of_ref": "indicator--d2250717-f23b-4310-bd8b-a676e47c1a92", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a18cb712-5bfd-4267-8b12-41f17e53345c", "sighting_of_ref": "indicator--eda45e03-6c7c-4368-acc0-f4f6ab817bac", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--059b8388-aaf4-4ca6-96fb-802028eb8b8b", "sighting_of_ref": "indicator--c00a0da4-31ea-4a0f-a579-08466184fd5c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3900b1f9-57b7-4452-8ad6-37b76e3964de", "sighting_of_ref": "indicator--538e15cc-d62d-480c-8d66-521761591686", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7557619d-cd07-4b70-98df-cebc65ab3e35", "sighting_of_ref": "indicator--1fb2d248-a768-4a3a-8709-822aeb8abff6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80439c17-6344-409f-90d8-ac33bed78feb", "sighting_of_ref": "indicator--958194a9-6f5c-4f66-82db-97a8c5e1ca36", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5743f45-e55d-4d45-b5de-3901b6cfc2af", "sighting_of_ref": "indicator--c8fdefb2-06a9-41d9-aba8-cd39eb3997c8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be04ca20-c6f9-482d-823b-ac7c53124ce2", "sighting_of_ref": "indicator--eff8ae47-db21-4e1c-ae7d-1b451f38b6d7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75a0c114-c5f1-44b5-a3f3-f273e404409b", "sighting_of_ref": "indicator--98de5fa5-ecaf-4bc0-9b5d-f2c09aed28ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c601192-f4a6-41b0-840e-a68960d32798", "sighting_of_ref": "indicator--98de5fa5-ecaf-4bc0-9b5d-f2c09aed28ed", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b82c69d-4757-4f0e-ba13-d0fa7f23c288", "sighting_of_ref": "indicator--7574b540-2598-42a5-a1e6-88ae6a77373f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f99f1ce-1940-4382-9a5a-0ff355e0d355", "sighting_of_ref": "indicator--34214133-7748-4f20-8c61-ae2a340d64cd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d416800f-7cbc-4531-9a74-0e61cf804d33", "sighting_of_ref": "indicator--34214133-7748-4f20-8c61-ae2a340d64cd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--caa6bb63-af9e-4dfe-8ae7-eaefa68a249c", "sighting_of_ref": "indicator--211b85ac-5ef3-4563-9be7-5be7bb8b61e5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--306da619-a5e0-4cc1-9ac1-65d899cb4a22", "sighting_of_ref": "indicator--5c63cba0-7300-4775-b77e-ec99d998659d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd2b138a-9743-46a7-99bf-fdcbf48dd57b", "sighting_of_ref": "indicator--f91539d2-dfba-402b-8e92-a431782fc4ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--280aa0d3-1770-4020-b2da-ac2b239e9ee9", "sighting_of_ref": "indicator--508015e9-ae63-45b8-8015-5014df50e161", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f33644c-b19f-4839-8785-644fbc4bf848", "sighting_of_ref": "indicator--508015e9-ae63-45b8-8015-5014df50e161", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--683831ef-5e22-4c38-ad3a-92c6448306a8", "sighting_of_ref": "indicator--b348b0d4-0f9f-4aca-bc45-506ac3b88199", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22c54dee-3801-4531-8367-63ab55d5926e", "sighting_of_ref": "indicator--b348b0d4-0f9f-4aca-bc45-506ac3b88199", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e66e6a7-dc4f-479c-8daf-9626b8e04939", "sighting_of_ref": "indicator--f9ec41a4-0e4d-4193-8ea4-febc7a182a66", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fdff833-16e7-4cc1-8e87-3e7683ecc90f", "sighting_of_ref": "indicator--d3ce543b-d83c-4741-ac7a-b20a6a49f56d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a8a83d7-40ce-4dca-ad13-303eed6c5e00", "sighting_of_ref": "indicator--a9782b09-dc3e-4413-822a-80dd59da330f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e86f994-97cb-41b4-96ff-634d19f3477d", "sighting_of_ref": "indicator--a4db94f3-7952-498a-a1be-e7ceb322c04e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--826716ad-a248-4911-b912-22f536085f6a", "sighting_of_ref": "indicator--9ca95498-fec0-4338-aaba-e4286449641b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c214385-030e-434b-9328-6440030278ab", "sighting_of_ref": "indicator--3a84596f-1a81-40a1-90a0-cde75596d7c0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9846c9b-ff83-46b9-b3c6-fbeb0dc3faa6", "sighting_of_ref": "indicator--3a84596f-1a81-40a1-90a0-cde75596d7c0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4878e4e-229c-40e4-ac32-78d49ee11345", "sighting_of_ref": "indicator--9e7c5853-5e02-43b4-9e56-8b5b19424765", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0888735c-e54d-4633-b35c-6bb740a0276f", "sighting_of_ref": "indicator--a21188a4-eca2-4b60-997f-1a2b54651402", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66148866-47e3-4878-be2d-8962ef43d9b8", "sighting_of_ref": "indicator--7944a0d8-3e13-4544-a354-c1c5fd31dfa7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d347c38b-34e9-44e8-9fd9-0e7059f3b1e2", "sighting_of_ref": "indicator--7944a0d8-3e13-4544-a354-c1c5fd31dfa7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c754b21d-3dd9-4fc6-9a94-64cd22667fdd", "sighting_of_ref": "indicator--e5659b45-0d35-48f4-9b82-0a3eadc16502", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55d997f6-3784-405d-8dfa-a453e6848365", "sighting_of_ref": "indicator--713972e7-35f8-4af1-9588-fc9ecb0ed713", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6824ce8-12c6-492e-a463-56711e87bb79", "sighting_of_ref": "indicator--01911dd4-7de1-459a-91f0-4befbaa54993", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4097adef-3ce3-446d-acd0-08bc618494b7", "sighting_of_ref": "indicator--01911dd4-7de1-459a-91f0-4befbaa54993", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb8bb242-7e40-4092-801c-97a2c6cd03e3", "sighting_of_ref": "indicator--492c4b11-31f6-4649-8038-852e51b9d63d", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e390dda6-8512-4262-8ed0-f69e41f39b29", "sighting_of_ref": "indicator--a7c0241a-271c-4c8e-987f-3fa232fe2ac4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1926e52d-9f06-4d25-bb6e-b69d73c6cfd6", "sighting_of_ref": "indicator--a7c0241a-271c-4c8e-987f-3fa232fe2ac4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54453784-c136-4bbd-8863-3cc5bc523c5a", "sighting_of_ref": "indicator--fe6c9134-2f7b-46a3-8914-ea4d176a957f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a2fb204-dea8-49b8-826b-e228148602c3", "sighting_of_ref": "indicator--fe6c9134-2f7b-46a3-8914-ea4d176a957f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--066dade3-5485-4e5b-9269-2d1e4be1d23b", "sighting_of_ref": "indicator--48b1b395-9343-459d-b8be-502a48abfc2e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c708a9a7-7747-4a11-bb8f-0af8142794d4", "sighting_of_ref": "indicator--65f4adb5-6d9e-4839-bbf9-d314a7a199e4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b719847-aa68-4f00-a19b-7bf6cf0b82c6", "sighting_of_ref": "indicator--488adfa2-0cfa-4a84-870e-950e20ed876c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8a8b742-ec4f-462b-9c23-e1d7b8bdb4ab", "sighting_of_ref": "indicator--8087ab56-44d6-4977-804b-faf8ce50246d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c497ccf3-9c6f-4685-a954-7783119a660a", "sighting_of_ref": "indicator--c6500fa1-ef29-424d-863d-be197f8dfda4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f171da6-1505-45d1-85c2-5c4a8366df28", "sighting_of_ref": "indicator--c6500fa1-ef29-424d-863d-be197f8dfda4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3764721-bda1-4e86-9acc-80937a7ddf12", "sighting_of_ref": "indicator--7bb17bc1-0dd6-4a0c-8c65-59cfac196b27", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea1a40dd-89e5-425b-8a8b-464d40b77baf", "sighting_of_ref": "indicator--7bb17bc1-0dd6-4a0c-8c65-59cfac196b27", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35471cad-e842-4558-aef7-60847098f050", "sighting_of_ref": "indicator--41721708-9f80-432e-88eb-b5fa35d0ab9b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57f39f53-6110-4eb9-a48f-9515fc962f9b", "sighting_of_ref": "indicator--c658b616-2e85-4b7d-96e1-f2bb096c8998", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7da0cde9-3a66-40dd-bad1-6800d9a8adf1", "sighting_of_ref": "indicator--de1dba14-1df8-4471-a6cc-3abf11880869", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eba3a557-4f79-4b9b-b0eb-bce11120c1b9", "sighting_of_ref": "indicator--de1dba14-1df8-4471-a6cc-3abf11880869", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc2bd516-72fc-4481-a71e-941248845d12", "sighting_of_ref": "indicator--9eccbfdd-0809-4a28-aea6-e617c22e99d6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1170449b-d549-46bf-ade1-54bc84b94233", "sighting_of_ref": "indicator--9eccbfdd-0809-4a28-aea6-e617c22e99d6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5178c03e-fc76-49d2-bf48-0fb503f7a701", "sighting_of_ref": "indicator--7ac2f901-dc51-4096-b926-148bed8b7692", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c30dd1ec-3edc-4ebb-bad8-1e8f55f6b6e6", "sighting_of_ref": "indicator--7ac2f901-dc51-4096-b926-148bed8b7692", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faae5431-296d-4141-8321-efc3664f19c5", "sighting_of_ref": "indicator--7c0dd96d-42c3-47a7-9151-f3a70ba23d2a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a450bb9a-0a78-4228-9a0c-bcc2e13bad05", "sighting_of_ref": "indicator--46f8b183-78a5-470a-9a97-9ae4cb4cdd65", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bed43391-a164-4004-a50c-30f62bc79239", "sighting_of_ref": "indicator--afef1985-b335-45a4-8c40-3c5666bbb201", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67dd102f-a8d8-4ce4-b5d9-280bbeb0ff93", "sighting_of_ref": "indicator--eef45ddd-8a5b-4364-aedf-d34f84a70a86", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fe32de0-f528-4759-81aa-08fbdc0fb0a2", "sighting_of_ref": "indicator--ddf48e71-5f0a-4fdc-814b-b111d2edd544", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc684092-b294-4b04-a33b-6e28172cee2a", "sighting_of_ref": "indicator--623e8245-1e07-4c35-8af7-fc191c2515f8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b3a2711-7bac-442f-9489-ee80ffa28b84", "sighting_of_ref": "indicator--ed88834d-fff0-413a-af6b-7a1ae181355a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6655e66-9893-4fa6-a4ac-bcf4641cea34", "sighting_of_ref": "indicator--d7ca89b3-38e0-45f1-8095-869fa4b40da8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1705aaa8-a13e-4ff7-a0ed-584683a92e4d", "sighting_of_ref": "indicator--6f08f9ac-0b3e-43c6-bbf5-755bd6c40694", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73e8802e-0c9a-4c4a-8db5-25dd362e81e8", "sighting_of_ref": "indicator--1668774b-2327-47ec-b6a2-b7f69ca8a115", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7129233-73e8-45c8-8b34-a090c3fe0d27", "sighting_of_ref": "indicator--c3f8d64f-3532-41a4-befa-e51c599a0188", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59816447-654d-47c5-b352-04763deb9292", "sighting_of_ref": "indicator--15aa788d-abf1-4402-b4d9-997ea5da23e8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04ab8403-c3f6-4e34-adde-66f1ab3f0004", "sighting_of_ref": "indicator--312109ac-bb8f-462f-b28d-f2ed45da81db", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c9cc887-5383-4e81-8c60-5aab3f01f6d6", "sighting_of_ref": "indicator--693c03db-6d3c-47d6-896a-4dcb6c991ac6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d073d1c6-9ecb-48b0-a33e-f3dabd3af866", "sighting_of_ref": "indicator--efa727c3-585a-49ee-ae3c-d9862c705efe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75045449-2bb0-4aee-abf3-fc25d7e1652b", "sighting_of_ref": "indicator--7d185f92-a1f0-46db-90b8-a045e1e05348", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52b68738-92dd-4fe4-9311-779ccb588bd8", "sighting_of_ref": "indicator--a44fbc9f-67cc-4df3-afbd-6b8cfa45873e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0f518e0-8bb0-4cb4-98d6-8bf9c92b2458", "sighting_of_ref": "indicator--a44fbc9f-67cc-4df3-afbd-6b8cfa45873e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e61060f-3feb-460f-a91a-9de80cd5f485", "sighting_of_ref": "indicator--d8b10abf-c5c4-480b-912e-ccf10056526d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ada7744-e7a8-4d20-8bef-857202d710e5", "sighting_of_ref": "indicator--d8b10abf-c5c4-480b-912e-ccf10056526d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb7b909f-ffcc-4963-9266-ab4fe9669b2f", "sighting_of_ref": "indicator--aa7c6bc0-6dad-4d22-86b8-f4b5d8a2dc9e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea0ea3b8-6473-4694-a4c5-a0e4209bc223", "sighting_of_ref": "indicator--aa7c6bc0-6dad-4d22-86b8-f4b5d8a2dc9e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19a4cdc3-5249-4116-bea9-030d98a1354d", "sighting_of_ref": "indicator--3d0155fb-6c04-4ade-afb5-a4422be3c3e6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcfd8315-1423-48b7-93ac-aeaed66ce4ce", "sighting_of_ref": "indicator--3d0155fb-6c04-4ade-afb5-a4422be3c3e6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e73ee7f-06ea-4707-815a-61cc79945344", "sighting_of_ref": "indicator--497e9606-40f8-41b8-8e42-2cf738116ec4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fd41a80-260f-4f1e-a9ae-493345b1275e", "sighting_of_ref": "indicator--a0f36f00-53d6-4799-b9a4-89d87fda25bf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2226a8b-3227-4ed8-9338-5f5d420194e3", "sighting_of_ref": "indicator--80659b64-4438-4831-ab2d-44d09c1f967b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6813b3e-732b-42f3-8384-67a8008266d2", "sighting_of_ref": "indicator--8669a19b-6dc0-4365-ad7e-372c4904ea7a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d5aec7e-72b0-424c-87ac-423fa911cf03", "sighting_of_ref": "indicator--e6952122-3e26-4890-92b1-7b4eb419ed13", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c746040-865b-4786-b3e3-5a7224c1b267", "sighting_of_ref": "indicator--68756e5a-72fb-4c03-ba18-88e97cd045e0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--429ccb62-be5d-4822-8573-505d5553cc11", "sighting_of_ref": "indicator--129b760f-d214-40b3-9ce0-3a95be8d4e98", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34fd7d3a-b49e-49a6-a799-ae02676bcd11", "sighting_of_ref": "indicator--7fff8796-ff2d-4b6c-8d1a-febcae44ae50", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8f8ccd2-cfee-4482-81c9-2dfb68f680cf", "sighting_of_ref": "indicator--0faf3d0a-8dab-4ad4-88b9-8eebd1f7fa25", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ac62d8b-da2d-445d-ba0a-56c10609c39e", "sighting_of_ref": "indicator--a20dd0d9-bd49-4acc-87fc-f05ad012e4a0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0d892dd-e0c4-46a4-8922-761271ef9250", "sighting_of_ref": "indicator--e68d466c-d0e0-4af9-96b2-26feab58b335", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e37ed1e-050e-4384-81a8-a2beec7e4b03", "sighting_of_ref": "indicator--6f716065-2ce0-4e79-a57c-201af36b6658", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8c8fe43-84c7-4a08-b261-1cccf646e6a2", "sighting_of_ref": "indicator--33e56b98-aa12-4ca0-a5e0-acd7de18de6f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67d3412a-44c5-4314-b2ed-b4456a6bf454", "sighting_of_ref": "indicator--33e56b98-aa12-4ca0-a5e0-acd7de18de6f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a6906f8-7244-4768-bda1-3fbe14fd61ec", "sighting_of_ref": "indicator--ab73d0b8-e0c7-4e76-9462-b11dad3b6b87", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30b52dd3-18fd-4236-861f-a23be31e4efe", "sighting_of_ref": "indicator--ab73d0b8-e0c7-4e76-9462-b11dad3b6b87", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d47f86b6-e0df-4145-ad50-ae252a91c11c", "sighting_of_ref": "indicator--032c6366-166f-4b32-a421-5dabdad9a6ab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09c3f393-6f77-4117-a29e-9a03d6a6cf00", "sighting_of_ref": "indicator--032c6366-166f-4b32-a421-5dabdad9a6ab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e0ec7a2-46a3-472c-826b-f5717358cea7", "sighting_of_ref": "indicator--d06d2ff8-d7cb-4c78-965b-ff48f9184faa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17710822-2994-4bbc-8112-4974b4967a8e", "sighting_of_ref": "indicator--d06d2ff8-d7cb-4c78-965b-ff48f9184faa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4dac07c-0616-43a4-a060-c229031c3ae6", "sighting_of_ref": "indicator--2fc65d49-4a74-4ec0-9c50-c5db7a60f78a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53495c18-1aff-4eca-ae57-c1805fa4c212", "sighting_of_ref": "indicator--2fc65d49-4a74-4ec0-9c50-c5db7a60f78a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c8aac46-7ba8-4773-a1cf-83ccea1e965f", "sighting_of_ref": "indicator--9eed6f52-a824-489e-9996-54038eba0d5c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--411e8d01-5fc7-488d-9438-df8c5eb0e5b9", "sighting_of_ref": "indicator--9eed6f52-a824-489e-9996-54038eba0d5c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10bd0799-515d-414e-a8c3-73feccd87362", "sighting_of_ref": "indicator--b86b2929-33f1-4425-ac4d-f585aa61b40d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c2e2b4c-8f1a-4e0e-8e32-a92ea6e58241", "sighting_of_ref": "indicator--9d2be9b4-f09e-4839-a1a4-67cc741e8b86", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3469583e-4b44-402b-8c99-5b599470719f", "sighting_of_ref": "indicator--9d2be9b4-f09e-4839-a1a4-67cc741e8b86", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f4f9919-a36b-44f9-bd4e-dddf5d9717d3", "sighting_of_ref": "indicator--369ddbb6-59a3-4821-a9ed-30fd6f1957ed", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--837ea042-afbb-4a8f-b35e-79134cc892e4", "sighting_of_ref": "indicator--25f709b6-ad6d-41af-91ac-bdc4aec1801e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5f53bb3-30f9-4c4a-b0c1-dfc068a6a3bb", "sighting_of_ref": "indicator--ee4ea44f-aff7-4165-87f7-0ff6f43405ca", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be868f07-3e32-4547-8bdc-b81ae446f0ad", "sighting_of_ref": "indicator--ee4ea44f-aff7-4165-87f7-0ff6f43405ca", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bcbb902-bada-4654-9ef0-3cbb6581a650", "sighting_of_ref": "indicator--11c39ee5-8f4b-46be-8709-3a3faaac9fb9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb501659-6b8c-448d-bc09-5c2afc85d6ab", "sighting_of_ref": "indicator--f29a8d1d-c63a-4902-9f78-97e8ef0fb119", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0144f950-6e0b-4dc2-b29c-21e344f45e9b", "sighting_of_ref": "indicator--909774d8-24a5-4217-8243-d04ef961b4f9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--452f537d-eda4-4cad-8d40-29767f078d9d", "sighting_of_ref": "indicator--909774d8-24a5-4217-8243-d04ef961b4f9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb1f107d-ed94-4b3e-b419-2c00620be2a7", "sighting_of_ref": "indicator--5c19035e-2405-4e80-9cfb-4030d015360d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dda74fc-e7c0-4e1e-aac8-a1cc29b0e542", "sighting_of_ref": "indicator--c9c90130-cc1a-4ef1-99c5-329e472d77ce", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60ddbba8-8358-4575-bbc5-12d72e377429", "sighting_of_ref": "indicator--5b4e308c-7b70-4dc1-9939-881ca78e1b1e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4de2c793-e6cc-4b8a-ac10-6793d9104dd6", "sighting_of_ref": "indicator--4f152ced-955f-4b98-aa6c-9c0050a4817a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a81f1a80-9350-4b54-802c-1facfe41e215", "sighting_of_ref": "indicator--bce0561d-c095-4f25-9513-b8672a034d0f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--282be4d5-8db2-4ea8-9e10-849c0139de80", "sighting_of_ref": "indicator--10047fad-9c4c-4a4c-b0d2-c41fc8be6190", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcbae1dc-c0d0-489f-a3b2-810a51b40b17", "sighting_of_ref": "indicator--10047fad-9c4c-4a4c-b0d2-c41fc8be6190", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe148157-3bb2-406b-8db4-ca2202a56620", "sighting_of_ref": "indicator--ada523f2-6b95-43d2-9a39-380a44b50bd4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1aafd07e-2d5d-4e09-bc64-d83d54d7caee", "sighting_of_ref": "indicator--1343ad5a-9b95-4f7d-9eb3-515516e89d13", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e42a153d-96b1-4c99-ae62-4cf9d27912c0", "sighting_of_ref": "indicator--98557e2a-3e78-47ca-8dd5-bd2210df9b15", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d73c6076-f3f9-4ffb-9f71-331dcb7572d9", "sighting_of_ref": "indicator--98557e2a-3e78-47ca-8dd5-bd2210df9b15", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0610d24-3b76-4024-9e56-1be4b4f3315e", "sighting_of_ref": "indicator--a17878cc-cdc9-459f-8deb-635bd3323e02", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8651fbae-9f4e-419f-ae6c-2950d8519ae8", "sighting_of_ref": "indicator--096d8485-d258-4ddf-b752-6222317845af", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d9a2e21-6571-4aa8-a392-acb4a0a14166", "sighting_of_ref": "indicator--096d8485-d258-4ddf-b752-6222317845af", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7c69c23-b280-4a99-be25-47064795288d", "sighting_of_ref": "indicator--c940eeb8-d9a6-4000-8115-325bfa6a76f0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2951062-617b-488e-be08-8c699ef55c3f", "sighting_of_ref": "indicator--ad35e643-6ce7-40a3-9d94-b17cb95c6f74", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--276a8bec-9fd6-4027-ad50-7b5e930a7664", "sighting_of_ref": "indicator--bb4b1aeb-4135-46cf-9771-02ba95bcc4e0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--511d17a8-939e-4087-a784-1bf4c894b0cb", "sighting_of_ref": "indicator--3844aeff-50bf-405e-b56d-19e3b1bb0913", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e387c54-abeb-476a-9f89-83455e17c864", "sighting_of_ref": "indicator--3844aeff-50bf-405e-b56d-19e3b1bb0913", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--deb71d5d-4afa-465e-aecc-ddbd56306e2c", "sighting_of_ref": "indicator--b55dd791-038e-406d-a286-ac14ecc3a0bd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--033b4841-da10-45bb-83ab-036a332a307e", "sighting_of_ref": "indicator--b55dd791-038e-406d-a286-ac14ecc3a0bd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9bc7afa-fc53-40a3-b4dc-dff0fbfb29b1", "sighting_of_ref": "indicator--54a0c5ef-5af1-44e9-a9e2-fe9f9fc2ac32", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c487dcf6-2b21-4743-98f6-a7c5719f2ed3", "sighting_of_ref": "indicator--0a14d11f-be0d-4f99-bcd6-8f9421394cdf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--701229c6-4b08-4162-8d19-bd7585f99a52", "sighting_of_ref": "indicator--79efb76d-1342-4aee-822a-8a6466263a9e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8253df6e-b0e4-4e82-be34-7e4993032824", "sighting_of_ref": "indicator--120ca318-f9fb-45fd-b7bf-e65d07d8bf56", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95680434-e14b-4cd3-908b-176af280d1f8", "sighting_of_ref": "indicator--120ca318-f9fb-45fd-b7bf-e65d07d8bf56", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbc0951f-08cc-4b45-9040-e22f70e3bf73", "sighting_of_ref": "indicator--a54ced32-c7fc-4762-8114-803ccb4c070a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29cc2918-810a-4df5-963f-f63e20649b18", "sighting_of_ref": "indicator--1fea23ef-6f88-43c6-ab29-cc491a8d1186", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96229b6c-03df-46c1-9c8e-3ebd7cf6776e", "sighting_of_ref": "indicator--db91c008-1a8c-408f-b49d-c4df9876d027", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7ad3d57-d7b5-4856-b680-e2ea7059257e", "sighting_of_ref": "indicator--0d23ce76-4ad2-4947-a30c-5c5f09ffb383", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8020cab0-83c2-4d1a-bbf3-419d99eaad03", "sighting_of_ref": "indicator--0d23ce76-4ad2-4947-a30c-5c5f09ffb383", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--151ffb26-baec-4949-ba0b-3de47020021d", "sighting_of_ref": "indicator--f35121b4-db3e-467d-aa60-d893f51a479b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24a5cfaf-26dc-4ddc-8ca2-2b13e2432a91", "sighting_of_ref": "indicator--f35121b4-db3e-467d-aa60-d893f51a479b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82ded9f5-3a25-4a67-a219-29e176f85ce3", "sighting_of_ref": "indicator--2528c0b4-498d-47f5-bcc9-80956b7b65e4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b63da5a3-16a0-4f07-abd7-03c84f13c397", "sighting_of_ref": "indicator--2528c0b4-498d-47f5-bcc9-80956b7b65e4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eb6b683-be59-4c27-b139-a7ae97ff8985", "sighting_of_ref": "indicator--4751be2f-a30a-4ce8-a3e5-4764bc591621", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9dac22e-e7fa-4a35-a104-42f6003cdb87", "sighting_of_ref": "indicator--4751be2f-a30a-4ce8-a3e5-4764bc591621", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ab29a72-adfe-4706-86eb-957213b314a2", "sighting_of_ref": "indicator--e427ed63-cc11-463f-b105-122f29b7edf7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3318dd93-674e-43ce-ba15-cf96ef2e7706", "sighting_of_ref": "indicator--d5aa780e-8dbd-4e12-83ce-137a39688572", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd18f1b5-a6ed-4635-9b27-0e30c10d69b8", "sighting_of_ref": "indicator--65628644-52e7-4f09-b46c-5f36f1e1c9fd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec996998-5af6-4e97-ab98-f1e0235f12f0", "sighting_of_ref": "indicator--89bea894-4f35-4e9c-810d-8f89bf94ed96", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b71bfa94-5265-48c5-aa5c-45b9dc54a0a9", "sighting_of_ref": "indicator--89bea894-4f35-4e9c-810d-8f89bf94ed96", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62773f3f-3bde-4283-925b-e9d6ced962ae", "sighting_of_ref": "indicator--73d81f2d-51de-497a-8af8-19c9164c3b06", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b21d6c50-71da-4838-a965-f8d5b968ae68", "sighting_of_ref": "indicator--f40cd485-16d8-4f09-8ba3-4a3e7b03413f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd60136f-3a7a-4e6a-a2d8-7807336254a9", "sighting_of_ref": "indicator--ab79b450-577f-4a3d-9542-95c5483981fc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b13fee7c-6271-4a40-87fa-bcc4bc83b19f", "sighting_of_ref": "indicator--364dcfa0-b037-412b-99db-8d135def099d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--609a82a2-92c6-449b-a139-52d8d742fd0c", "sighting_of_ref": "indicator--e8c07fee-0897-4aa9-bada-b8d425e5a231", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51eb07a1-bc12-4446-bab1-a638aa107053", "sighting_of_ref": "indicator--2a7f7464-802a-422c-bbc8-699d98bece7e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57ebbb16-c52a-445a-94eb-94f79154eb58", "sighting_of_ref": "indicator--2a7f7464-802a-422c-bbc8-699d98bece7e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27df27f7-cbcc-4a2c-a44e-0497655e5baa", "sighting_of_ref": "indicator--ad55f85b-2b0b-49eb-a8bd-8d10801bf67c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--109c4895-9289-490c-a5ab-bd633c2cc327", "sighting_of_ref": "indicator--1560cdd4-f739-4fee-9e8e-1b1dfecbea84", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--737a0a4d-a676-4787-b55f-c207ab084256", "sighting_of_ref": "indicator--a16a80a8-6310-44f2-8c93-3edd9d7dae31", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4713f4ff-03ff-4ab6-be78-14867a5edd3e", "sighting_of_ref": "indicator--77b992d9-1a03-4e57-9cdc-6691d10789bb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f1f987c-3fc5-440a-82ee-9d89052500ea", "sighting_of_ref": "indicator--5bccca01-ff0c-4e2b-b127-aae93c63cfb3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50488c20-6dda-4b4f-a61e-3e5a27563d14", "sighting_of_ref": "indicator--d9a9c82b-8f50-4461-a0c9-bcc5cf784f64", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aebdf492-4b31-424c-b46a-6deb80715ab5", "sighting_of_ref": "indicator--10a7e4f3-09f0-4d66-b84a-85900653eb8b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a59460b4-19e0-498b-a6fd-638584358403", "sighting_of_ref": "indicator--9df0759a-d038-4ca3-b597-83f3f16ff5cd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--798a0d49-b857-4063-afc2-3adeba0ac53d", "sighting_of_ref": "indicator--09dd04bb-3956-4f35-a348-c77c24d27d94", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81c0c560-4b47-4628-87a9-0c9325f5b88f", "sighting_of_ref": "indicator--09dd04bb-3956-4f35-a348-c77c24d27d94", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4022e62e-ac9f-4f9b-82c6-86129ff99a6c", "sighting_of_ref": "indicator--7e76cb0a-a4af-4d30-aced-2d74d5880682", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abfd16c5-f775-4f18-afd0-bfe839eecb5d", "sighting_of_ref": "indicator--d573550d-3fc0-48ed-82b2-bfb532872eb3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--228dfb0b-e590-4a6e-bc86-64a7d9a96aba", "sighting_of_ref": "indicator--4999120d-0e79-4e94-8fd1-0a760d099457", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--027dbbe0-2162-4117-bce4-8483f224e8e0", "sighting_of_ref": "indicator--f7024b1d-457a-48ac-8f06-58fccdef06a1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3790728a-ca90-4020-a970-491ff31c72a5", "sighting_of_ref": "indicator--f65d1449-bfd1-43cc-8588-bb7c9cecfd0c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df5907b5-1ea6-4f17-8c03-f559bba3d71a", "sighting_of_ref": "indicator--f65d1449-bfd1-43cc-8588-bb7c9cecfd0c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--227245be-ff1d-4d50-bb30-4e24a5862630", "sighting_of_ref": "indicator--204c683d-ff10-4124-b4f2-ccb0c52cfc70", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b73b207-0508-4cda-acaa-e59fc086ac49", "sighting_of_ref": "indicator--c17e69ce-8cf1-45d5-ade9-0f1f62703dc7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7da42b4-eff7-456c-bc03-83dc254d455d", "sighting_of_ref": "indicator--67b7bd92-f0c2-4b78-b3e2-248401e01792", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4956b733-74ae-440b-a151-09a84aa2415a", "sighting_of_ref": "indicator--413fb586-a80e-4672-a683-205c15418c08", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b6efa93-9cd1-4915-aec7-906426ee2cd7", "sighting_of_ref": "indicator--cd768e1d-fbf6-4e60-a55d-911a2f861aa9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0addab72-107c-4a15-a5ce-05d2e3f2afee", "sighting_of_ref": "indicator--0e36690f-4e6e-41f9-902d-f25261c6b8f2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66fd7009-f319-4ff5-ac11-ee4a2d37e7f3", "sighting_of_ref": "indicator--e0fdad6c-400a-48dc-86ac-93329df282e2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--440d9b09-56f9-4afe-a578-64e4bfba30db", "sighting_of_ref": "indicator--d76e853b-53aa-4839-8ad8-e65802140b9c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7461621-c390-481a-9739-e4f8d2b58911", "sighting_of_ref": "indicator--d76e853b-53aa-4839-8ad8-e65802140b9c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4b7d5ee-5b56-4c06-875f-349676237d6c", "sighting_of_ref": "indicator--aa91db99-1c80-4c84-9415-92f1c96e418d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42499095-7cd8-430f-bc33-509cfd179c4a", "sighting_of_ref": "indicator--aa91db99-1c80-4c84-9415-92f1c96e418d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06e1c48a-e1cd-4b3a-ade9-46f8a1c139e0", "sighting_of_ref": "indicator--5de84057-9c19-4417-9dd1-c866370127ee", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8422dc60-2f24-46b7-a67f-ae2bdd8ce5cc", "sighting_of_ref": "indicator--748b9543-7dcd-402a-8d4b-4b81681dd2d8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3890462-d752-4ad3-af6b-5beb59aa081a", "sighting_of_ref": "indicator--748b9543-7dcd-402a-8d4b-4b81681dd2d8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57927d9c-9439-4715-80b9-a6738f9c7089", "sighting_of_ref": "indicator--85388a5f-271d-4d7a-b066-91169c27b481", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77a183f9-8fc8-4333-95c8-33da602d91b8", "sighting_of_ref": "indicator--d7a32992-5bee-4d61-9460-dfedb9f66559", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84972987-2b95-40a6-81d2-88cbdb731625", "sighting_of_ref": "indicator--d7a32992-5bee-4d61-9460-dfedb9f66559", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1defe48-55ea-488b-bbbd-bab2b357543d", "sighting_of_ref": "indicator--708057a1-858c-42da-900d-521b33e21cb8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c461caa-2865-458c-b91f-3be87353f794", "sighting_of_ref": "indicator--0648759e-0463-4a11-ac8e-3db297b72dd5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--569be850-9011-41ef-89db-1bc7a3bd7662", "sighting_of_ref": "indicator--0648759e-0463-4a11-ac8e-3db297b72dd5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f18ea675-06fe-46b1-b014-6c71819653bd", "sighting_of_ref": "indicator--835d013a-e746-4b1d-8fed-1115342a6d39", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f732c000-e50a-41e2-9112-d20f89bb9b81", "sighting_of_ref": "indicator--d0e3db28-534a-4f71-ae4a-dd76f851fff4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--807c4e0e-c9c2-457b-b393-f7d72dfe948d", "sighting_of_ref": "indicator--6c0572b1-144a-429f-829a-86b57a06e0b2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e6ab5ae-378c-47c9-893e-8d10a2e5b8b6", "sighting_of_ref": "indicator--6c0572b1-144a-429f-829a-86b57a06e0b2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b115297-25eb-4a54-8a27-72bb38cfa623", "sighting_of_ref": "indicator--27910fcb-269f-46d1-9888-5c63f64ae33d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2b1b086-a27b-4977-9cc4-4a4167f9720d", "sighting_of_ref": "indicator--27910fcb-269f-46d1-9888-5c63f64ae33d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d23a066-1ae9-4848-8249-6098af06506e", "sighting_of_ref": "indicator--cd2f2439-475b-4a13-b063-2a8e5b0fc435", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f88e5c52-a2da-4a47-9c17-b22ed17dd9f7", "sighting_of_ref": "indicator--3eb23b3b-c865-4e47-a2e0-1f5f9f69eebc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--162d472b-abd1-4e51-8fca-a5896c6438ab", "sighting_of_ref": "indicator--56923e1c-d05d-4e25-b62a-dc2eb793eb98", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65d4a04c-418b-4778-ba87-48ddbad021aa", "sighting_of_ref": "indicator--a7008e17-0ae4-4b4f-a48f-67bbd9f434c7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e563dea1-b661-435b-9211-6718f07975d3", "sighting_of_ref": "indicator--7f2d4551-60fd-4530-b7d4-4d7a2d2b3482", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eed38754-4b74-41a2-a54a-f76cce47d59e", "sighting_of_ref": "indicator--18acffd5-dd56-41a3-b086-b4955f439128", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68ebf4e4-2c7a-4472-b01a-ae255f6c74c5", "sighting_of_ref": "indicator--5e00180d-8135-4255-8c8d-6a6dcf2e0ded", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7396f6f8-e6a2-4da0-9646-9c8a307a9945", "sighting_of_ref": "indicator--d24ffbc5-5342-417e-b2d0-80be243a54c3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9f135e0-720f-4768-801b-2dddd7cbe386", "sighting_of_ref": "indicator--e915e8ce-4d9a-47e8-af4e-dc2b51b7029a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c41b0c52-a378-4f4b-a653-85bbd677417d", "sighting_of_ref": "indicator--775496b7-6b99-45c8-be3d-86ee86e5cae4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b83ded67-d250-463c-8d76-77f92fff06f8", "sighting_of_ref": "indicator--775496b7-6b99-45c8-be3d-86ee86e5cae4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9777e476-e3ce-46b5-8ee2-2f179a244ea3", "sighting_of_ref": "indicator--8365ca80-b6bc-49f2-b973-32b4855f94e3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fdf324f-9db1-474d-8ca3-11840ce1a890", "sighting_of_ref": "indicator--aa8a0c50-4a8e-4895-a78f-bbde4d20876c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51fc87bf-4ad9-4dd6-8f04-f8d87c432cfd", "sighting_of_ref": "indicator--6fd4ce61-54b9-474f-acf0-8978bf357b61", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e284e4ce-e749-424f-9bce-2f66d34c0572", "sighting_of_ref": "indicator--7c372a96-4971-478f-9fde-b9f8a3998b36", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82687c9d-a3a5-47f7-b129-f9fcfed65587", "sighting_of_ref": "indicator--de9f6472-08c4-49a7-865d-ea53dfb25aef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b767d513-180f-4547-8415-e37875a3da8a", "sighting_of_ref": "indicator--f352b54b-63f5-4c0f-abb4-c98ddd3b805c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68c1dfc6-6fe8-4286-b870-b8317b85a0bc", "sighting_of_ref": "indicator--4bcff545-1652-446f-a03e-56bc7807daa2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccac8470-94a7-42a0-bad0-a641a51c45df", "sighting_of_ref": "indicator--2be7ecc9-b4e0-4278-aa95-4501d3fea101", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faee947b-32c9-4d9f-bc95-39d9ff4a566c", "sighting_of_ref": "indicator--00d78d48-d356-497b-8e5a-c4e93e96d4a6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88e5704c-46db-464c-a455-c1861f2b7829", "sighting_of_ref": "indicator--ec03da57-f322-4b4f-b004-1e3bdd7f12e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36bdb92e-4f9b-4efe-8c3d-b37e45bb0344", "sighting_of_ref": "indicator--674b3cee-d953-4bdc-8a5b-d07ba7c59f9b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b50b8835-6df2-4bfe-a110-871579394ee9", "sighting_of_ref": "indicator--9cb92686-610c-4795-9b89-6f55b69f6e19", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0a9600e-f30f-4eca-a07d-af1220e01d71", "sighting_of_ref": "indicator--8198a439-e4b8-415c-bf28-6727d4f30fab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c31725c-a358-4c49-bc98-825aceb87f7d", "sighting_of_ref": "indicator--2b5298bf-c28d-4111-b587-007efed5bc63", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--338ab097-495a-4342-857a-ca8c6f226b99", "sighting_of_ref": "indicator--0fa048b3-b32e-47e6-ba82-4974d94b2c4f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--933f68a2-376a-4dcc-9050-0af9b03c8b04", "sighting_of_ref": "indicator--fc58ace9-284c-4556-a25b-0e914b9859bc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f5ca150-6728-4244-92f3-e8da7aff80b5", "sighting_of_ref": "indicator--81d9358e-0e88-429f-9583-54b0b1f722de", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac02c74b-38be-4a4f-a8b0-df0302564f09", "sighting_of_ref": "indicator--8b9ca491-013e-43bd-a917-58cd0be846e9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81d96221-6ed1-4acd-bd8a-077f47ba2080", "sighting_of_ref": "indicator--8b9ca491-013e-43bd-a917-58cd0be846e9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71cdd3e7-c271-4e3b-a280-7a200a44a1ea", "sighting_of_ref": "indicator--32c3f0ad-b295-4a8d-a518-a92f23dacc2f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c197c1e4-1da2-4e6d-af67-1bc5add97c17", "sighting_of_ref": "indicator--8ab85d32-f054-48af-9b32-44ee819b68ed", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fef0197e-2dec-4cca-8334-d45b89d40f54", "sighting_of_ref": "indicator--e4d1c2fa-39d3-4edd-bf34-b45960e544cb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6438987e-6e3e-4d13-a44b-34293591b5fc", "sighting_of_ref": "indicator--030bc1c4-8ba2-430b-8a74-d168d1cddf8c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2a330d3-34e3-4279-9c67-3754f20cb5de", "sighting_of_ref": "indicator--7b9deef8-eac0-48f0-880d-039c4bc336d9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec54d6ce-3b6e-4905-9f22-4f62e7299197", "sighting_of_ref": "indicator--106cb46b-5a47-4e3a-9e75-6e46ce70db07", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0c2ec94-66ce-4257-8fb2-b2d360f2cdf7", "sighting_of_ref": "indicator--3e9889f1-f33b-4942-9421-5e6eefea9070", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ba0f911-d068-4a6c-8b58-5dbcffbe4b77", "sighting_of_ref": "indicator--8e1937d5-45af-46e3-89f1-f9466b5b8410", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f179cebe-d454-4ef1-86b2-afacbaf35073", "sighting_of_ref": "indicator--dd92c206-0498-4afd-89ae-aa420a104dcf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0acf8910-61bd-4099-8a18-8649d2ad647a", "sighting_of_ref": "indicator--c2a3bb4e-b192-4e6f-845f-5920ef1b908a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc7e7003-821e-4dc3-975e-87cfde468121", "sighting_of_ref": "indicator--40744f19-313d-4e5d-aa3a-9ffaeea73cb6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fc49a13-8f7b-42f4-9658-133b28897313", "sighting_of_ref": "indicator--64eba0f5-33ce-4e67-b8af-82935f63a550", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2464f704-36da-4946-9cf4-3c84e46f5fe3", "sighting_of_ref": "indicator--7678cb57-c14e-4c9c-850a-5c2fc564e87f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4b3cbd7-31c4-4f83-98e6-37a52ce5ce23", "sighting_of_ref": "indicator--cc1c1a5c-dc5f-4f4c-b3b1-15ed3f5641f1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af5475f8-fe3e-49d9-b0f9-19a1ddc1d0c8", "sighting_of_ref": "indicator--af005ff0-c02c-451c-8dd9-a90923e9e351", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2ba7116-ff7e-439d-91ff-ed74bb485688", "sighting_of_ref": "indicator--ee2f0516-4375-47c7-b5c0-8fd1074fa215", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4d283cc-ee7e-49cd-80cf-904720e5057d", "sighting_of_ref": "indicator--ee2f0516-4375-47c7-b5c0-8fd1074fa215", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e5632c5-9d66-41c3-8359-1296906fd8bf", "sighting_of_ref": "indicator--d3e02d36-4747-4489-a720-6fb8e5c03c30", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b32fb5ae-82be-4dd1-ac9d-c1963ba30a4a", "sighting_of_ref": "indicator--72312f41-f581-4645-aa58-00023a4ea61d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8592d977-cfc7-4b08-bf3f-b8b162789820", "sighting_of_ref": "indicator--8c3bad3f-4c48-4ad7-9b4a-296ad5cb81b0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--def7c4ae-1103-4152-b46e-086319d7e661", "sighting_of_ref": "indicator--b6489acc-5511-49fb-8489-f99500ead43e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5036783e-bce1-42d4-bb7d-737f83f09e1b", "sighting_of_ref": "indicator--6b4b28d5-a2b7-4d7a-81ea-964b92bdd2ec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47dccf7d-27f5-42c5-99d1-89a76a1d9004", "sighting_of_ref": "indicator--db21e3f5-18f3-4a99-a9a0-bed54948ceb7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1d80e49-121d-4986-9ca3-631564d97ecd", "sighting_of_ref": "indicator--48efbb10-3803-4189-b430-905646c74cb2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--219262bd-cc24-423f-a265-dba7077317d0", "sighting_of_ref": "indicator--29371b84-7a85-4f97-a9ec-cf60fb69e106", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a25adeeb-b4a5-4d0e-92d1-71ab0950f6db", "sighting_of_ref": "indicator--d86a76df-a7ab-4e4b-8bf8-55492b3556b2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f2022e6-93dc-4ad5-9a4c-0309a89c0fce", "sighting_of_ref": "indicator--599811fc-dbd5-472a-8305-42fb2fcb3cfb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53da2b0f-5615-4993-bb79-a08e2ec23ab0", "sighting_of_ref": "indicator--3c9f6ae5-3394-4359-9005-45f5f9d9f4ce", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b8c0f2d-91dd-411e-ad6d-e7f822cbf6fc", "sighting_of_ref": "indicator--3c9f6ae5-3394-4359-9005-45f5f9d9f4ce", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99517b24-0808-4bd0-996b-f67600c6b6d2", "sighting_of_ref": "indicator--eb164365-6e9b-4957-a91c-88f091e0c4ec", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--540ba5f4-bf9c-41ae-9fc1-6e04b562a573", "sighting_of_ref": "indicator--eb164365-6e9b-4957-a91c-88f091e0c4ec", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00b89d25-db4b-4193-9169-d1cae7111086", "sighting_of_ref": "indicator--ad8a208b-569b-4ccc-88fc-34e6f58b901a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffcaa0a6-46d5-4a58-9a7a-b36a739d8b75", "sighting_of_ref": "indicator--ad8a208b-569b-4ccc-88fc-34e6f58b901a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98c74df0-81f8-4390-b322-a08b69ab50f8", "sighting_of_ref": "indicator--310c076f-27ac-4ac4-afda-5e94d5440dcc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d846fa92-52c3-4ce3-ad2d-6d445bdfe5e2", "sighting_of_ref": "indicator--310c076f-27ac-4ac4-afda-5e94d5440dcc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23808c19-5e59-4627-89d7-bf78ae912f0e", "sighting_of_ref": "indicator--84584ea5-55a6-4d86-b066-c8f80cb3511c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bdc21bd-0cf2-4b4b-911c-9dfd8888ce73", "sighting_of_ref": "indicator--84584ea5-55a6-4d86-b066-c8f80cb3511c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06449c3c-f750-403a-9f87-aeb5d76d6f34", "sighting_of_ref": "indicator--50b53c73-b006-4687-9b61-a2df0e423f73", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c879baf3-174f-4b66-9941-7336f300240f", "sighting_of_ref": "indicator--50b53c73-b006-4687-9b61-a2df0e423f73", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcf0299c-b08a-4dfa-9587-fb49209a564f", "sighting_of_ref": "indicator--a5bb151f-048d-4f40-bc78-3b4aaeb16f88", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db15f3bd-49b1-47fa-aa31-216333f552dc", "sighting_of_ref": "indicator--c1373f02-6bcd-45e9-a02b-6a208e78a1b6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75959473-8257-45f9-ac50-8bd731973de1", "sighting_of_ref": "indicator--9b06d262-5ecf-4725-925b-960cd31c5447", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--775e3260-71f8-4d4a-a71a-af414b5ddbfd", "sighting_of_ref": "indicator--9b06d262-5ecf-4725-925b-960cd31c5447", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48ee0704-877a-430d-b04b-a4a425aab7d3", "sighting_of_ref": "indicator--f8a8fd7f-09cf-4f62-87df-a6272f945ac7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2978e2b-e83b-4c96-a505-bda7ae6e32aa", "sighting_of_ref": "indicator--a874eec5-4d04-4934-a15f-81e9537ba819", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9508b04d-3668-4208-9364-9cbd56ea52c5", "sighting_of_ref": "indicator--621ceea9-b274-4a06-8fdc-0df98cb43c58", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c717f6d6-4996-4aa8-b104-9ddac72b816b", "sighting_of_ref": "indicator--59a45c9f-ed51-4b51-9228-7b0f42999a1d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8e0da42-647f-4028-b8cc-f927f75817c5", "sighting_of_ref": "indicator--1492f105-795b-4023-9331-07e421e0b526", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d077754c-d2d8-4ea6-8691-218e9786f1be", "sighting_of_ref": "indicator--39691d53-c713-46a9-8344-5ec3c2894d62", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58f30d00-0da9-4cee-9398-302a518d6dda", "sighting_of_ref": "indicator--ebc91ecf-6ccd-4840-a6ec-270ae60a8186", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8369d6d5-1127-448c-84d1-13b46b2897c2", "sighting_of_ref": "indicator--2cbe5c8a-762e-49e0-a27a-7b773f38f0cf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9aa73d90-1584-4179-bc05-10f642cc8618", "sighting_of_ref": "indicator--ba964e65-c295-4665-b619-01a819293fb7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40f282a9-df38-43e1-926d-607716344646", "sighting_of_ref": "indicator--70b235ab-957c-4718-af71-d27752fbc8ac", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4abe6c0-b77c-465b-94ec-490dde66a5ca", "sighting_of_ref": "indicator--9d390110-4e57-497d-b2c1-bbdec8909d17", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1424c4c0-06d8-42ba-8054-197469cb7843", "sighting_of_ref": "indicator--bc311373-2de7-4614-8191-76f5a2422415", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2561976b-d2cf-4167-a658-449d3da3cace", "sighting_of_ref": "indicator--e3523b5c-5aa3-4e43-bd6b-a4e549356686", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb2fff59-57eb-4989-8d99-1e9fdc31c24c", "sighting_of_ref": "indicator--ba189423-2b16-4a13-9713-63651a22a1af", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1c0bce3-8bad-4f94-8134-c31a8bc27d4e", "sighting_of_ref": "indicator--6e8311cd-beaf-4728-937c-a590f53cf08a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cf269e5-ebd3-4a59-bc63-87d9048ec613", "sighting_of_ref": "indicator--731b7d85-40be-4024-9b95-75454c2e2fa4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddb14c2a-e795-408b-b252-324c86d23d1c", "sighting_of_ref": "indicator--52a2a866-5b94-4bb5-bf3d-0870c37fcd75", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b942af17-2619-4661-bad8-d7127fa4b22d", "sighting_of_ref": "indicator--14e15b06-018f-4cd0-8c40-0cf60644bed0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13d56d02-f67e-4a25-a109-ceb195d9af01", "sighting_of_ref": "indicator--af2c23ae-08d6-498d-81a6-13e7df34a621", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--249972cf-31a6-49d3-a937-83ad5a3c99cc", "sighting_of_ref": "indicator--d7bf70b9-c1a8-4a48-999d-24397a26957a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92827897-0855-42a0-9324-112552395952", "sighting_of_ref": "indicator--a8b5a1ba-3654-464f-90ea-eb215904adc5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b1e7547-eb52-4752-a361-af507a2dc17b", "sighting_of_ref": "indicator--aa828dbe-71ff-4d2d-9a3a-8c1cf76f6d87", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bf9a66b-dbb5-41ea-b58f-b738f1081c96", "sighting_of_ref": "indicator--93012a9c-182d-4ab1-92eb-2342805ce814", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fd8df04-7171-480a-ad7a-b5814d65161b", "sighting_of_ref": "indicator--8e455ddd-ae55-4767-bbba-e111ee0b2ec2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84cb3594-ac43-49b8-9a81-4359b5fb4615", "sighting_of_ref": "indicator--ec22e423-b49a-4ec2-9c81-d1bd925e9a9e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54ee34dd-a726-46c8-ad42-610030d2dd5d", "sighting_of_ref": "indicator--ec22e423-b49a-4ec2-9c81-d1bd925e9a9e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bec883b-95e6-48c1-8f03-a72fc61b9ab0", "sighting_of_ref": "indicator--999d8cd4-cf91-420a-a5e0-e00d5e5cc421", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2fd249f-e371-48f3-bad0-cf977df42e6b", "sighting_of_ref": "indicator--ba9bc100-4033-443a-8ac9-4ea07b264cfc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad6c8347-e6cf-4f2b-9ad4-86dd6e80b36b", "sighting_of_ref": "indicator--0d558c52-17e0-4b7f-a284-67f70c39e310", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a6195fb-aae4-4821-8b7c-9c8326ca6d4a", "sighting_of_ref": "indicator--d8865813-fc0d-4ee7-9f3b-fe598846b6b1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--418c964d-8902-4b55-8a3f-78e1e7f47a24", "sighting_of_ref": "indicator--21a32e4f-0a3a-4f7f-bb2b-960ab1b399c1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ffe17cc-530b-4ce5-b164-f623780dd068", "sighting_of_ref": "indicator--5fcda7ff-f8cb-4126-94f1-b49a4f4f08e1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--737f5d3e-e94a-4863-8617-67f5871a76ac", "sighting_of_ref": "indicator--a9a7b4eb-9f77-4025-9e27-32d0275865e2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b4cecab-c63d-4668-9ba5-51f294ebbeb2", "sighting_of_ref": "indicator--54c06215-3188-4c30-8a03-d30c1395659d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f09b6c7-8c68-4bd4-83bb-fd53507e6ffe", "sighting_of_ref": "indicator--234e5648-6c2d-475b-aa2c-87080ff4a118", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fc8a760-3af9-41cd-9d4e-b6011ba4f153", "sighting_of_ref": "indicator--234e5648-6c2d-475b-aa2c-87080ff4a118", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30490b49-a12b-4896-be0d-42a6720d167e", "sighting_of_ref": "indicator--68045269-6d9d-4ea3-8da0-42004cc9a314", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--721dd967-8bb1-4c77-9bd1-067fb5e9a818", "sighting_of_ref": "indicator--6ee248ef-2a05-4170-8ab3-3961f988e3eb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22164f63-1b82-457c-acdc-e5586c843bca", "sighting_of_ref": "indicator--7943804d-c9ff-4253-9a11-dd52daa805e8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1b97577-f5b6-4941-b7a3-8c8113e8def4", "sighting_of_ref": "indicator--81a787f5-1d9e-45ab-9885-beab58e26909", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--613cadee-21e9-4957-9a5e-87937267119a", "sighting_of_ref": "indicator--81a787f5-1d9e-45ab-9885-beab58e26909", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03a376b3-b9bf-40b3-a689-98969f5553df", "sighting_of_ref": "indicator--abf6ea43-a24b-4b72-8cbb-bd3216b1e02e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c2ffde6-147b-4f5e-9bf7-5b4bff8c4665", "sighting_of_ref": "indicator--abf6ea43-a24b-4b72-8cbb-bd3216b1e02e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--179b125f-5a30-45e7-912e-86d8b0b43837", "sighting_of_ref": "indicator--f5f9cb38-5470-4efb-bfca-9a2afbe5c4e5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--147549a4-1bc5-4d61-b0ac-bbe8c22ace2c", "sighting_of_ref": "indicator--1ebd6e30-5125-4f26-83c4-332a6556e931", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1460edf8-95cc-4717-b381-1a32023dbb27", "sighting_of_ref": "indicator--0ea2c891-23f4-4a9e-af11-9f6d17736b6b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5a6ba43-fb69-4f42-9b3b-321273721348", "sighting_of_ref": "indicator--c927792b-7125-4557-95f7-d57e5f63e355", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7254cb4c-ffd3-4b7f-af6e-cc025023397b", "sighting_of_ref": "indicator--6020bba9-64a5-4ace-8106-7209f3502032", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8111bb1a-26e0-4b66-a99f-becae8ffa5c8", "sighting_of_ref": "indicator--dcfb0dc6-65d5-4b06-86bc-145fe85eaabc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c92fd18-82e1-45ed-b4d3-16b2176daf7c", "sighting_of_ref": "indicator--4cc979b6-5b95-4ed4-92f3-8eaea9229ba6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9187384-8ba9-48d1-ac13-deeb843402a7", "sighting_of_ref": "indicator--25d2b707-1b5f-4ecd-976d-7628020ccb3d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1316513-2be1-43ef-8639-1279f7d8ade2", "sighting_of_ref": "indicator--81f550f6-a247-4090-8f69-3098f4aa96c1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3044e17-3729-4bb3-8318-6e34289c2725", "sighting_of_ref": "indicator--0c822030-0fdc-4d06-96be-cdb0222fe59a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5046ffd5-7e96-4039-8e02-62058b742dcd", "sighting_of_ref": "indicator--a49395e1-6195-4c82-96a3-250a1e0e2631", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96ac8ea2-9b08-480f-9865-833b30a43169", "sighting_of_ref": "indicator--558426cf-455d-47c7-99cc-5f58aee7c365", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52039678-28c8-499f-9d16-244dbbcb93ee", "sighting_of_ref": "indicator--7057ac72-4bc1-470d-9e58-c5a101578196", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9879660b-164e-4c44-bd14-1e6be62c6861", "sighting_of_ref": "indicator--bfd0d169-cd0e-4815-9d78-d3a56cfb995e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59dde387-2b75-4c7d-ae11-0b77f2b23f8d", "sighting_of_ref": "indicator--02702f85-4643-4d6f-851e-336f7e73f877", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d2a9447-a9f3-4832-a134-a81792e9dcca", "sighting_of_ref": "indicator--02702f85-4643-4d6f-851e-336f7e73f877", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61a5e108-52e5-48bb-b9c7-9d5931f6d278", "sighting_of_ref": "indicator--937091f4-5c89-4424-943a-abe1aeb04c85", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1014d496-55b9-4505-be27-899ffb1e7f5e", "sighting_of_ref": "indicator--585dcb15-0eeb-4a2e-9be8-6b3cd58b5940", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddb6d43e-e9ca-48b9-afa0-32a03915f2be", "sighting_of_ref": "indicator--f1ab058e-ba4e-4d67-9167-5a955219334d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8119f1bf-1961-4998-83a3-ad81bb1f4180", "sighting_of_ref": "indicator--6c813105-3dec-45ed-a4ab-c1f406effba8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5276c69-2172-4aa8-98c0-cc95dca3dc70", "sighting_of_ref": "indicator--bed0db7f-275f-4671-b7e9-fab077d91c2a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--281be4ce-37e3-4a60-af06-80ea003f70f3", "sighting_of_ref": "indicator--52a18e07-eccd-49f6-92de-14498041b735", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3a262aa-0ea4-4445-ba3c-d3aa8048d204", "sighting_of_ref": "indicator--52a18e07-eccd-49f6-92de-14498041b735", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa074456-78df-4510-bebe-8c22b4c4c7a7", "sighting_of_ref": "indicator--d5549f4c-95e0-4f17-aee5-af2536c58736", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbbde721-f00b-4dfe-9cf2-ba10166fd885", "sighting_of_ref": "indicator--3e217b40-a417-4ef2-9252-f0f4069e2840", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88a15a84-f5e7-4b4c-a270-b967a906ef72", "sighting_of_ref": "indicator--939605d0-4807-4780-86b3-b0625f16361a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9016765-b806-44c8-a032-2ca7906ef6e3", "sighting_of_ref": "indicator--7236b0c2-34bb-4c38-9e53-d237aebb65da", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da246ec9-9c16-42af-9582-bf56d446c41a", "sighting_of_ref": "indicator--606dd799-74e8-4f7d-93b2-99210a0cc5d6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bd38675-7e1e-4ded-8639-fb16936a1973", "sighting_of_ref": "indicator--606dd799-74e8-4f7d-93b2-99210a0cc5d6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3b477c3-94fd-4cf7-b15c-26c3d48b681d", "sighting_of_ref": "indicator--a01eb523-8540-4138-954a-0d86e2b07f1c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e6737ac-02ad-4f88-bffc-0647977b5acf", "sighting_of_ref": "indicator--f2eee915-4155-4482-a5cd-5a2f16a88dee", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ee8d4fc-59bf-4810-8c44-6668511d7cea", "sighting_of_ref": "indicator--5d3110bb-ae10-4f27-97a6-74088b7d867c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a2fa266-95e2-40d8-a7d1-bea57384853a", "sighting_of_ref": "indicator--1737d583-e853-40fe-b698-41d2eb9f2bb9", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dbe3c2e-eebf-4218-8c1b-ebce6c72f059", "sighting_of_ref": "indicator--59bf8dce-ab60-424b-8e16-b89fb3310f2d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de3893c0-034f-462c-9744-e689871a7362", "sighting_of_ref": "indicator--196ec169-3a73-48cb-8cfc-4a192a8e1c63", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6746035b-d925-43dd-b283-d8a3b56d9c78", "sighting_of_ref": "indicator--251f2c22-e743-4c0c-8746-7047c04d70a1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b9eb1e6-c754-4d63-a3f5-ab2503d46ecd", "sighting_of_ref": "indicator--1e1bdd7c-0b09-498a-aa30-4fc6eb684f6d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c76ad2af-8812-44cc-9820-afd2d41fa25a", "sighting_of_ref": "indicator--feacdc26-698e-410d-b321-92c11c63097f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24b87e8d-8802-450b-8efa-9dc36bc209fa", "sighting_of_ref": "indicator--9dc8b69c-09b3-42b8-ba9d-13537de1e2ab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9af1708d-d8db-4377-9cea-f4bd9a22a02c", "sighting_of_ref": "indicator--57645bb4-0110-44fe-8dd4-c631cda0d336", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5b708e2-c52d-44d4-88d0-fd7cb251d301", "sighting_of_ref": "indicator--57645bb4-0110-44fe-8dd4-c631cda0d336", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b254a3f7-615d-4b3b-abf3-7e790391155e", "sighting_of_ref": "indicator--b549875b-6303-4b13-8216-1784730b5711", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d688652-5d64-4071-8eba-9152d8321fb4", "sighting_of_ref": "indicator--4521a3b2-d1f6-4f2a-995e-47264487db13", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db9c7c9d-6bea-485c-aab5-4dfd6f921998", "sighting_of_ref": "indicator--f418fe3b-b142-4200-82f4-766478774514", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28d56bde-9075-46ca-a84f-1a5db7d42e86", "sighting_of_ref": "indicator--0b40139f-adaf-42b2-b057-dec87841a1f5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8de27845-25cb-4f76-af3e-0c3952e26159", "sighting_of_ref": "indicator--fffcfac2-d9c4-4494-b959-729097e24eb1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1395f45b-a3da-46be-9569-7bffb73bb45f", "sighting_of_ref": "indicator--0fffb658-e0b7-408c-9837-cd413a5a5ec2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f8ea05c-2ee4-4c3c-ba69-3e7f1560c619", "sighting_of_ref": "indicator--a4b24f87-60fd-4e03-a5aa-00452663706a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7aa67941-783e-49bf-8e24-3d7cd563d149", "sighting_of_ref": "indicator--4194fafa-8b97-4d25-b07d-99c83900d97c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f434e60-4d66-4ad1-86e2-1e995d5abe2f", "sighting_of_ref": "indicator--9483ac9e-0ae9-413b-8c5a-d0427f9256a0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c087aea-6dfa-4bbd-ac6d-2f56d42c8a21", "sighting_of_ref": "indicator--8a2b72bc-f072-4075-9ef7-96aaedfd49c8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5311200b-9572-47d6-988d-2706e9cbdb54", "sighting_of_ref": "indicator--16b6c5db-60f1-494a-920b-23aa51df8ea7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b55d395-366c-4256-8b2e-764d4fa21e7e", "sighting_of_ref": "indicator--39f207b3-1c76-49d5-9376-738258a8314e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--374a0e41-ae4b-4d47-b201-d545c1f05505", "sighting_of_ref": "indicator--90115047-78cb-4d3d-80c5-5e2171e2f22b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7845fc83-4760-453a-86bb-1f545ff7b54b", "sighting_of_ref": "indicator--00fe2cf7-74b0-4136-b4f2-e811f1dca9f1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de9c18bc-8e25-41df-8aa9-a998c49c2628", "sighting_of_ref": "indicator--d4ccface-a221-43e2-a180-4b3282ef9005", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--041b88cf-78ee-4cba-974e-5ec297b5c1ca", "sighting_of_ref": "indicator--73e7ee08-b6a2-4965-8e49-457f82c61d1f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--326f0df0-1d81-45c4-99d3-48ede8481244", "sighting_of_ref": "indicator--54f118a9-2a0c-41e2-a8d9-6d75a7fde412", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2322848-7a78-4ca9-8f35-f91340051cc6", "sighting_of_ref": "indicator--54f118a9-2a0c-41e2-a8d9-6d75a7fde412", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df937fd8-f0e3-4c9a-a466-de3982e3f166", "sighting_of_ref": "indicator--aee483cc-bd44-454d-8183-cf9600f83030", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c659ca9-92dc-45f6-aac4-34cf67854626", "sighting_of_ref": "indicator--40ae37c5-b259-4308-98df-dcb811e2e178", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59046674-e692-47f9-8292-5366462539a4", "sighting_of_ref": "indicator--8528dec5-990c-4805-8842-c0806c0921b5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f852e80-b71b-414e-ac25-7acdae439059", "sighting_of_ref": "indicator--05879306-59d0-4f7c-81b7-20b6958129a6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db2077f4-2186-4d31-a5fe-db67fce5e89d", "sighting_of_ref": "indicator--969c8239-ea53-4282-ae3e-aa5ead5c7f87", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee93140b-17f9-41ad-a178-13c00944e805", "sighting_of_ref": "indicator--c34fac04-13f3-4d34-8871-6aff2ad2828a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--883eabcf-7ff4-43b0-bc1b-03f5a3614510", "sighting_of_ref": "indicator--c34fac04-13f3-4d34-8871-6aff2ad2828a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14e17816-4063-41bf-ad31-72c386dbc599", "sighting_of_ref": "indicator--f33637bd-8f44-46f2-a68f-777bdbd3851b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7ebb360-703f-4a49-9d6f-e7869fb3bb85", "sighting_of_ref": "indicator--70bf27a4-887d-4ffa-9734-321c019b21de", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8fe5fba-3a08-4353-9f2e-8fb6a95c7e2b", "sighting_of_ref": "indicator--42bc23cd-0711-42ef-a167-1865efc2543b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6846f02a-9abf-4ade-9fbd-d84dec802f90", "sighting_of_ref": "indicator--c461147d-31f3-49f9-a081-488cc852af87", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7002111a-c63a-44da-b394-19dee1a6c459", "sighting_of_ref": "indicator--3f073013-8ed6-47b0-9239-17405ec50fef", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20ad32f5-0b29-48cc-9fdf-6b76a2e88ddb", "sighting_of_ref": "indicator--13f81898-1c3e-4d8c-928f-f499aef2f413", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae0ec221-a85d-41da-80c4-a4e9ecc2a36d", "sighting_of_ref": "indicator--4108e661-0bc8-450c-88c5-48543fc55861", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85796c44-58bc-4386-9065-9eee39b86f16", "sighting_of_ref": "indicator--3320fd6a-1a09-4567-b603-f073f94a22ab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4237c9b-118a-4efd-a5dd-315515ea2aae", "sighting_of_ref": "indicator--9a9ad2f2-1394-4e4d-9d7e-c19a2927c97f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fad89807-017d-454e-88d0-86ef1b539b35", "sighting_of_ref": "indicator--9a9ad2f2-1394-4e4d-9d7e-c19a2927c97f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--392fce1d-964c-4818-9118-a23f5b1e0d0d", "sighting_of_ref": "indicator--ec2db797-fe64-43c7-ab35-a85849f5e0bf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1135639d-d5b4-4f07-adad-1cc1063d06c2", "sighting_of_ref": "indicator--9b15b7f1-cca4-4868-b096-9d5ba8080842", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b76a7bed-e4d8-46e0-ae83-ac51b9f64b15", "sighting_of_ref": "indicator--d61b04ff-8ddd-4581-908d-cb61b0fec692", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c57d88e-bb25-4118-a577-7e9311ff3af0", "sighting_of_ref": "indicator--a504b585-5bd0-4ff2-b3f6-39caa50ca26b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a812e4f4-f953-47eb-938b-a71faea3540d", "sighting_of_ref": "indicator--a504b585-5bd0-4ff2-b3f6-39caa50ca26b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5e9a1e4-bcd9-45da-ba0a-15c5048bab46", "sighting_of_ref": "indicator--6963657f-80ea-4326-9516-d844413725a1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70722886-13fc-4dc0-ab5b-a1a7cdc950fd", "sighting_of_ref": "indicator--eb2be7f2-b7ab-40a4-9b75-e8fad37d2b6e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45ac8e96-64fc-4f60-811a-012664e989fd", "sighting_of_ref": "indicator--111b050b-5c16-4309-acab-92c78960a29c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--156c2291-7011-450b-ba38-bc70aeef313d", "sighting_of_ref": "indicator--8e38ea70-e8d8-4a2e-aae0-32133b4a16e8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--278f50e6-b089-4607-9c4e-6975f2943ac7", "sighting_of_ref": "indicator--243c1ea8-8189-48a7-a370-ffcde97356a9", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7888ef35-d27a-4590-b52b-5c422aa86761", "sighting_of_ref": "indicator--837d2497-e07e-4f7d-98bb-e40dfde3e294", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67d423cb-0cdf-46d3-95e7-df1aedbb1f67", "sighting_of_ref": "indicator--4c8eff29-4b90-448b-bffe-9844b100709d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07a64946-9d9f-488a-84cd-70755d499f8f", "sighting_of_ref": "indicator--f1bfc056-f81d-45f0-8d2d-d360ca89fed1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be6cb6ef-671d-4db8-8af0-c478c1c57597", "sighting_of_ref": "indicator--4bb608d3-e7d1-496b-bec3-d94f1bc3b040", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b44153d-bd7a-49de-b0c4-43d7c6418c14", "sighting_of_ref": "indicator--8118be38-c884-470e-bf15-19afa4d225e0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--380d9ac9-f719-48ee-98a6-bb2eecfae1c9", "sighting_of_ref": "indicator--6baf9f18-dc68-4275-ad9b-940a738a591c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcf037c5-0b17-4cc6-bf11-228206474d0a", "sighting_of_ref": "indicator--2b4b99bb-6bfb-496a-8f07-588718209a70", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8f330ad-ed55-4473-bd35-356819018c4d", "sighting_of_ref": "indicator--5008cc45-25db-4f16-a583-8c4c8d4e677e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--730b5035-1be4-49d3-af36-31aa92d2b4ae", "sighting_of_ref": "indicator--4f247642-fe00-4cc4-a85e-0a97a1d79157", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5eaf88e3-e832-4bf1-beb9-98bf462143c8", "sighting_of_ref": "indicator--e575a89e-37c6-4412-a516-fe792096bd9a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6770e0bd-a2ee-46e3-99b8-e27af6287dae", "sighting_of_ref": "indicator--4fab854e-2be7-4eb4-8da9-72173ca82939", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22a8639e-d44a-4d9f-9187-772928347a87", "sighting_of_ref": "indicator--0341ba13-2848-4a95-9ede-4efd83e0cdba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d81de869-87e6-49a0-b05a-d7301d444797", "sighting_of_ref": "indicator--d3ad1019-aaff-4a72-be0b-9e14a422b9bc", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00127a3c-6546-4bcd-8fd7-43319ff5a97c", "sighting_of_ref": "indicator--9dfcae6d-3333-4efe-a967-027cbf202550", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--423877f6-d4b3-444f-96bb-c43f6ef1a3f8", "sighting_of_ref": "indicator--359af985-288e-4833-8618-ffb2b1715966", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ec35bf0-63c4-4840-ae67-5ce722dca631", "sighting_of_ref": "indicator--0715eedb-8ee4-4731-b34f-5b8534a2f0c4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a59def7-321b-42ab-9f52-058b7d1a22d7", "sighting_of_ref": "indicator--aa6d6824-3936-4d84-a124-7bfca01c5b8d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99158fa5-1578-47a5-b694-9cbec293efb0", "sighting_of_ref": "indicator--ef8f7ad9-f8ef-4f7d-8554-93037c4ee546", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20d8daf0-640d-4dbc-af41-ff085d9455dd", "sighting_of_ref": "indicator--482d48d8-7cbc-4131-95bc-06e66fd5b67f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e3bd342-b414-472c-8685-b0acb1a6cc08", "sighting_of_ref": "indicator--fd10ad99-1811-44a2-8590-5a2ec0e84417", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38c7c846-5a88-4fd4-bb57-7a433eefe669", "sighting_of_ref": "indicator--42e32628-0f23-4be9-bf61-58b3fd2a04fd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b64942bc-4b67-47ab-b1c2-87d25627c38b", "sighting_of_ref": "indicator--05e8d771-3116-42d5-87bc-16565c7b23a5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72f98bc2-74ef-4d36-8635-31abecebb1e2", "sighting_of_ref": "indicator--716a7906-bdee-4031-b97e-f118917ecba6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--796bf5aa-ce90-4000-84b9-3f33688e0b45", "sighting_of_ref": "indicator--d0813d55-95b2-4d79-bb91-7353d31a4d71", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8162112-1fcc-481f-b10b-e6e590e47cfc", "sighting_of_ref": "indicator--3b8c2e86-7484-42ea-bb01-bdea2b3b4ad7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3326b025-86ae-4718-a21f-9e39044efe3c", "sighting_of_ref": "indicator--40ddcf19-b920-440f-94bc-558476ac885c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd120076-13a5-4101-811c-99954328018b", "sighting_of_ref": "indicator--7624ce1e-4989-40b9-9711-559a8aa201bb", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66da6a7f-334b-434f-9a00-a51c09196d90", "sighting_of_ref": "indicator--6dda4623-2e60-4b06-9405-e198d545c2ee", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41a3a39b-cfa6-4cc1-8717-2898c0379b26", "sighting_of_ref": "indicator--bc6afe95-84c9-4152-a5f7-b9cbbdc10db3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eae05d1e-dc07-44f8-8491-037a387dfab2", "sighting_of_ref": "indicator--f3229b49-01e9-4e8c-8f99-a8fda1c99956", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--742d44cb-0144-4fc7-a50b-674001be904b", "sighting_of_ref": "indicator--60d38dcf-c489-4704-88f1-4cdc15e3cf4c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d38ac048-fa7e-4c2e-b624-d9bb5a392d4c", "sighting_of_ref": "indicator--6d9fa70a-53d6-4b65-bb80-7a95000528be", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ffc46f1-b242-4e5d-a759-9bc6cb1d1b0c", "sighting_of_ref": "indicator--eb2f59ce-a021-4288-b442-4a48f9f1ab17", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cb1f922-8816-49a1-b635-5ca3c7284065", "sighting_of_ref": "indicator--928ebfa5-7209-424c-9972-d2adeb9e9071", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dff01e0-a9af-4749-b761-7e805f7832a1", "sighting_of_ref": "indicator--72fe89c5-f7b1-4190-a560-22d0719487b4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8efd71d2-26d2-4c6a-8eae-752442e2bd27", "sighting_of_ref": "indicator--d5823882-3b71-4d12-94d1-ac665fb0e846", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bd7b534-793b-4d81-b586-1fd0e3b33b89", "sighting_of_ref": "indicator--c5af4c50-54ea-425b-8a77-c6019e062e4d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdec09c4-434f-4199-8b89-380d574a64cc", "sighting_of_ref": "indicator--5c8307fd-8c93-41a8-b1f4-89f6422b9aed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6848eed1-a04f-496b-92e7-022760841f14", "sighting_of_ref": "indicator--692b9b58-5ef5-420c-9748-0e333e773d79", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--599619ba-fefc-4af2-baee-939f28f7e44d", "sighting_of_ref": "indicator--1a4614ca-c7a7-41ef-b44e-2dd672624a72", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02148d2d-230c-4495-932b-b3df02fbc6af", "sighting_of_ref": "indicator--d4bd76eb-f5bc-4c45-a99a-b71205f1dd26", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b52e6775-9bbb-4fbb-a26e-5e79193fb30e", "sighting_of_ref": "indicator--692c94c2-eb30-4db5-a3cb-5a1d0abd222b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8f6141a-9e77-4fcb-88ba-f7c52e3f6237", "sighting_of_ref": "indicator--8e9db363-d65e-476b-9cdc-c8c58bfac589", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b76efa77-2101-4f95-b0d2-b20d09b60acf", "sighting_of_ref": "indicator--2e91d828-f87c-40ff-bcfa-47caef47e210", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7408f44e-c7ed-4f63-ad09-817ba045c89f", "sighting_of_ref": "indicator--bcce86ac-a2e5-41a5-972a-8be9ce4e6e3c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0d2f50b-369e-43f2-9d9e-64b76a61d0f7", "sighting_of_ref": "indicator--ef691512-e285-4421-818d-b5c9e4e73320", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28bf48a0-b1cf-4e9b-96ef-700ae48027ab", "sighting_of_ref": "indicator--185957a3-46e1-4ddb-9247-deb459b1b47b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19b364b7-3cd5-4e08-8e77-cfbc78bf9894", "sighting_of_ref": "indicator--12d3a199-0f56-403c-a362-70dc1be178d2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71fea862-c766-407e-8789-476f1df6500c", "sighting_of_ref": "indicator--de220c3c-9d51-4696-a503-f84bc009c1e5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcd6f122-4153-4e41-b6ec-7d2a7fb26536", "sighting_of_ref": "indicator--653d68f2-1764-4707-8064-aaa09d510c3f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81d7c74c-5dbf-4cf8-a54d-90c5dfc12fdd", "sighting_of_ref": "indicator--2abbc855-d498-4e0b-895d-b56bad78c05c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e36ad254-6f69-486d-bcc3-dbbda681008a", "sighting_of_ref": "indicator--08665a8a-2554-403c-9ace-d3afefb8b894", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70d6c52c-aee1-494b-8e5f-452747cda49d", "sighting_of_ref": "indicator--86b73b18-0a43-4cb2-bef6-f6bdb5c4c203", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06987ee2-c3f1-4c4b-a058-a5cbbe36d6df", "sighting_of_ref": "indicator--1f813f9d-5b3f-4571-ab5b-6f2a93a47453", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22ba9eab-cb0b-4be0-bc10-94a9f0d11b60", "sighting_of_ref": "indicator--4ed51995-1bb1-4b9b-b830-b8a699ec14c6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--710bdd79-5c28-4dd2-a6cf-846d9bb0a7e4", "sighting_of_ref": "indicator--4ed51995-1bb1-4b9b-b830-b8a699ec14c6", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad23efd7-65f8-48ab-a57c-4bc9fc98ef3e", "sighting_of_ref": "indicator--c80f3b18-3ae6-411c-8b60-bc053848a41f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78de3a84-c418-4b6c-a029-c727143662b6", "sighting_of_ref": "indicator--c80f3b18-3ae6-411c-8b60-bc053848a41f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ea93f91-7277-41c8-8f83-2de7bb7894cd", "sighting_of_ref": "indicator--1ebe8eba-a71d-4d4f-9d23-6a313263b4ab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cc1bb0e-d2e0-4523-8a2f-e99dc41ec1b1", "sighting_of_ref": "indicator--fcf5799b-d43a-4018-9eb9-f4f6d68ed9cd", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cd98a1a-a8d4-4384-9b5a-088808b376e6", "sighting_of_ref": "indicator--ef0ae29e-424f-4e89-8523-33b930de931c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e47b58b6-ae0d-402b-acb2-aa481fd8da38", "sighting_of_ref": "indicator--d34339a3-9635-43c5-b7d6-c890538071ff", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38329b85-732e-4732-b291-f0bb46ba59f5", "sighting_of_ref": "indicator--6eefa21e-432f-42ca-aa7e-1e89a34bd23b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87d3166e-1d01-4273-9fc8-346f61546808", "sighting_of_ref": "indicator--72a3730c-127d-4242-903f-8ade2dda58d3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12640f73-416c-42c9-81ee-0f625b223205", "sighting_of_ref": "indicator--2978ab39-5d0e-4725-85f0-5a4afb77b8db", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb31720d-2d3a-4252-a574-be3c90202a5c", "sighting_of_ref": "indicator--b19b609e-5788-48c3-a302-1602c9a92107", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53a48ba5-af11-41c3-9deb-36f2253656dc", "sighting_of_ref": "indicator--f879a3f7-ec34-4aba-a54a-df6e3e679d96", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9550212-21d5-4895-b9ae-26e64dfd6dde", "sighting_of_ref": "indicator--1becb5dc-93d6-4cbe-b2a3-6e1449708728", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1891a69-eea8-48a6-928c-17c78b125b3e", "sighting_of_ref": "indicator--8b3d3f75-bcc8-4c47-b95c-41889cbccaa6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9abd776-2a37-4d97-8334-e1c1baf98b8d", "sighting_of_ref": "indicator--28a525aa-2b5b-4d12-8ab3-5e261e482eba", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3820dfee-18d3-444a-9cc7-ffd46254f5e9", "sighting_of_ref": "indicator--d807bdc1-dc8e-4dcd-9daa-3ae4d4ee3604", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e031b196-2859-4364-b8ec-7415c82756cf", "sighting_of_ref": "indicator--e2642e73-be03-4aeb-8cb4-105cb3c379d2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1eb7dd4b-a4b9-476e-933e-4b761315caa6", "sighting_of_ref": "indicator--6c02b4ab-c0cd-4b9e-bda6-6068a8454665", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55220e8b-4735-4949-9f5b-80b63d599b35", "sighting_of_ref": "indicator--17109e06-28d4-4f25-a89e-cb2934539ea1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f4ec509-177c-413b-92e6-27c48c393191", "sighting_of_ref": "indicator--df68ee0c-f49c-4abe-a2f5-611ef49c0dc6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d45ffd24-3077-4adc-ba80-bb54c3bb8802", "sighting_of_ref": "indicator--ce98261f-75fe-484c-8fe2-23c6a4fe1caf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbbc045c-d802-4cc6-a144-eecd14c1a886", "sighting_of_ref": "indicator--ce98261f-75fe-484c-8fe2-23c6a4fe1caf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff3eb1ee-c2e6-4fc1-9013-f02394caa0bf", "sighting_of_ref": "indicator--f1717cfd-5a53-4542-8c8d-6c82c803be8e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb39819d-cc20-4762-bf37-7e94c5415f58", "sighting_of_ref": "indicator--765711f1-c27f-4f94-9742-d6d2eaeebec8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bce78c89-9e76-40d9-8353-8112e05f6612", "sighting_of_ref": "indicator--e1bbf92e-edee-429e-8b53-e8431635162a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--948091de-3eec-4e92-877a-6a861bb9aa15", "sighting_of_ref": "indicator--cdf6ed10-8473-4aa3-83a6-a24897787d3a", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a82724fb-9524-4293-b863-06ef2ecd8f55", "sighting_of_ref": "indicator--bd0bbbf4-7a46-4edc-be17-3182ff15faa8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8122db1f-6ee0-4acf-909b-6b74f4b26ea5", "sighting_of_ref": "indicator--262a1325-1b42-424a-9eac-1b411e396059", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0bee702-12fa-4137-96da-240287e1d238", "sighting_of_ref": "indicator--1dabbef4-09b1-41f2-b672-1dd4e5726835", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39d3215d-3170-4a47-89e2-cfd3aa9f7516", "sighting_of_ref": "indicator--ab8f5f00-2adb-4f51-b0b3-7209f2b88af3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--895ec2cf-573c-4d8a-a3a3-0b372041834a", "sighting_of_ref": "indicator--0528d56b-e69a-41ee-a8e6-0ee53ff6f691", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--726f16d9-0735-4d68-9fb7-3dcc2f981324", "sighting_of_ref": "indicator--7aed8c41-1964-456d-b3cc-141b4a3a24d3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0b782c3-0433-475d-8197-06882c0035e3", "sighting_of_ref": "indicator--cf6afca5-81af-45cf-841b-5589553d2f24", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6614b8a4-ae01-4e62-8d01-3ada36c82e48", "sighting_of_ref": "indicator--d8cd373a-0451-44a8-aecc-a116b5391cd4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaf38f95-3107-42ad-8955-56e2d1c7a280", "sighting_of_ref": "indicator--3df7a840-aa6f-412e-b43e-85e300093102", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f387bcb1-d1fa-400e-b2fd-2ed22d7be6be", "sighting_of_ref": "indicator--f362ff1a-ac0a-48a4-90a0-276c9e4b10d4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38e9a9b4-9a7c-47da-b2a5-68925ebb1152", "sighting_of_ref": "indicator--8c66bdc2-edd9-48bc-b3a9-cdc33af7580f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54ce9932-efc5-49e3-8283-41f6492d4274", "sighting_of_ref": "indicator--34c108fd-0976-407f-94c3-747b5bc13fbd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c747965c-2d89-414f-bafa-d1023e6abc9b", "sighting_of_ref": "indicator--229b7065-b8b9-4d2f-b05b-6bc23418c6ad", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f4b7c23-fb85-4127-be8b-dab8e74ca139", "sighting_of_ref": "indicator--e8191a32-e1f2-4173-ac18-57af4fd1db93", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--893eca7a-23ee-4b4e-82dc-200382446696", "sighting_of_ref": "indicator--c8b13e89-6422-4a77-bbb0-01abd0a037a5", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c48808b9-f326-42b4-8be1-552926dc0c1d", "sighting_of_ref": "indicator--2b20a503-5230-46f4-94d1-a40baad51ef3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b98eef20-f1fd-4e47-98bc-b1f4def99bde", "sighting_of_ref": "indicator--dd5ab642-2dae-42e9-b156-ccff3bf32d9f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58635882-db7a-4a9c-ae07-ebab35fbd421", "sighting_of_ref": "indicator--34adbdc6-7406-43da-b427-2ef1bf888a6f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ce81b8d-dd58-408a-b802-b224ecbfd909", "sighting_of_ref": "indicator--99a6b01d-512f-4fbb-8dca-400127cd21c1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0185453f-8cd5-4a1e-8cb9-46bca4fbb212", "sighting_of_ref": "indicator--28488f33-d25d-4396-947c-c20a0dfbede7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--069da474-3391-4e0a-b2d5-d71e82ef0bf5", "sighting_of_ref": "indicator--a5d953c8-38a1-4292-af90-cdc385cc6ef0", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acb10ae4-0273-4f90-b645-84b00fe82e61", "sighting_of_ref": "indicator--edd2041d-c1fa-4e69-8a30-f819c0552e74", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1c0e04a-bedd-40aa-905c-b56c5c952f79", "sighting_of_ref": "indicator--0c8d0357-2738-4fa2-8c1f-d4ee68f57beb", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ae8073a-7d88-4ae4-9aea-94e22451e568", "sighting_of_ref": "indicator--29352c0f-0e63-452a-9627-20513ebc663f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86d4fed4-1a18-4a0a-9413-66225372755e", "sighting_of_ref": "indicator--39e9689b-546e-4b24-b270-933e8a6fd342", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a825954-37b8-4e7c-904b-9f1b8920f48f", "sighting_of_ref": "indicator--ce2ea57a-0f39-4042-b253-14eca7351b85", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b119a066-2e6a-413e-9fae-1658740beefe", "sighting_of_ref": "indicator--4751020c-4963-4f29-8215-3e8eba632836", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79b436aa-06d0-4d48-a4f5-0816e11e866f", "sighting_of_ref": "indicator--71c9bd5c-27a1-4920-af7d-dd9ea9f34b53", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a08a0fa-62c2-4110-801c-0ebf2e1dff9e", "sighting_of_ref": "indicator--0bae0385-770a-425c-bfe0-f92db9cfafed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cd5f60d-c09b-444a-9622-fdbe93f272b4", "sighting_of_ref": "indicator--0bae0385-770a-425c-bfe0-f92db9cfafed", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb077f93-82b5-4157-acb0-e4eaa171b725", "sighting_of_ref": "indicator--45bc4ffa-7671-4f4a-95fd-56b2298dd865", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--768126ef-6c6c-4d3a-859b-6619ff40cd0b", "sighting_of_ref": "indicator--91f517fb-1a7a-44e8-bde2-7cfb8e109fc8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc14bfa4-b4bb-45f1-a877-24df1394a4fb", "sighting_of_ref": "indicator--91f517fb-1a7a-44e8-bde2-7cfb8e109fc8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--867749a7-afe7-406d-971c-639510f57522", "sighting_of_ref": "indicator--6ec6638c-08bd-494c-8204-0cfb081dc6c2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e033e809-22f2-43de-87e4-7f42423366dd", "sighting_of_ref": "indicator--b720eab6-82df-4a03-810c-c66427a5483a", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09a5980d-320b-481d-89f7-4c8a336ef1b3", "sighting_of_ref": "indicator--45e3f493-f780-4198-b990-ca57ebffcf09", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2cb7627-acb5-4d0f-a742-db10516eb7ee", "sighting_of_ref": "indicator--50220007-4b88-45cf-b94e-6694178b6a46", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e41a106d-ea43-43b8-93b0-972f8cf7e452", "sighting_of_ref": "indicator--46ed5752-f271-4cd4-8fce-14f0ad238bb8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28cdd65d-2f9c-43fa-8554-fa87e64beeae", "sighting_of_ref": "indicator--8d64a1bf-e853-45ee-b5a0-9096d4f675bf", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81dfe7cc-8938-47a4-9e4a-e83b71379144", "sighting_of_ref": "indicator--a9b4d1a6-ed63-494f-a41c-520edce285ac", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6eadf1b-4c44-4bec-8d06-37d0d1bc8734", "sighting_of_ref": "indicator--00769f1b-7aed-420a-b88f-752406003a99", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4ce771d-a25e-4368-88f8-f7bc1002ef35", "sighting_of_ref": "indicator--8ef524bd-ee28-436a-9346-629f38ae939e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b0b4dd9-4408-471a-9f4d-b1e7229284ed", "sighting_of_ref": "indicator--a927890c-c432-4aaf-a3ea-ab893bec1a97", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc2b0508-75e9-4a76-97c5-94a8e51a7630", "sighting_of_ref": "indicator--8f3d56c0-9d8a-4742-a09e-0369d322ffe0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb30a9b7-7996-4f2c-a6ef-bcd972de09a2", "sighting_of_ref": "indicator--b5e26cd3-f6df-4c43-90c3-097add22d57e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7662fe3c-4cda-400f-b211-89fc12e2bfe1", "sighting_of_ref": "indicator--8b330bc0-c1af-411b-b982-af5fb8a67069", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb42dbd3-3376-4014-a374-82090a07c866", "sighting_of_ref": "indicator--97fde660-c015-40a0-9e30-cb91b0445202", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04154122-7394-4940-924e-b3e7523b0d3d", "sighting_of_ref": "indicator--213d8774-eeca-4ecc-9e22-6e19c0874e67", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--feb513cc-d70b-4438-978d-dae415beaeb9", "sighting_of_ref": "indicator--e24b6eab-af68-4bc4-a004-53fb8e6051af", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9812a35-a851-419a-9b61-3057074feec4", "sighting_of_ref": "indicator--e05a9847-6858-4740-a8c2-c4e945fe2de2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e8934b6-1034-41f8-a510-804fa22ac0d4", "sighting_of_ref": "indicator--ead0f5a2-b00f-4e03-bece-16381b9c3b46", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1180abc4-8e7c-4ca8-935d-307bf3752ad7", "sighting_of_ref": "indicator--ad7754b4-9165-49b4-b80c-2dcbbd5d727e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ecb69c2-349c-492c-8230-5043c6ade1ef", "sighting_of_ref": "indicator--c18c88f8-bd85-4545-b35a-bd6eda62649d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10864183-01f0-4d3b-b358-64b316f72606", "sighting_of_ref": "indicator--1c2d4b25-66aa-49c0-9173-67914262277c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11b81abe-5d37-49d7-8ef5-c38350948bfa", "sighting_of_ref": "indicator--9cae819d-e547-4ce9-bfba-0103842431e0", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9aab19da-65a5-4b4a-b4a4-7fa601b2283e", "sighting_of_ref": "indicator--e18c40ee-af26-471a-8882-b8db9beb60c4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a0eca21-7923-45df-ae2c-9d9613f1e68d", "sighting_of_ref": "indicator--915908e0-98e8-4772-9913-f50e02a2bb9c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16257e7a-20da-4d0b-b05a-5dc1d862a063", "sighting_of_ref": "indicator--748f9176-4ee4-4325-a464-cfe760ff84e2", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bed92a30-7769-4c39-813c-0cd60a65a8be", "sighting_of_ref": "indicator--7b17fc1b-2838-4808-9e6b-9d761d62a686", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a06d1bc0-3c03-4649-9eef-417f86aa4ab7", "sighting_of_ref": "indicator--55a39050-f6a3-459d-bf15-9b1ea498679e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09f89687-9854-4298-9476-1908f2b53a2b", "sighting_of_ref": "indicator--276594bf-c1a8-489c-aa47-ce701756e5c2", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31c7a3bc-f130-4654-84a6-c927e31f9396", "sighting_of_ref": "indicator--a909105d-adde-4ce4-9524-c0222b1f714e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f3faf24-5efe-4d6e-a2e9-caf04f9ccc56", "sighting_of_ref": "indicator--308ee0a2-e8d4-45e9-9030-053213e343ab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8e72281-e152-41fc-85b4-0426eee85a66", "sighting_of_ref": "indicator--308ee0a2-e8d4-45e9-9030-053213e343ab", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--013897e6-5d26-44ab-af76-1e48c35a45e5", "sighting_of_ref": "indicator--bf86399f-14c0-4e03-9261-1853af183d0c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--454b6f29-a1b3-4680-8ace-f9e2b88114a5", "sighting_of_ref": "indicator--3c4c46d0-641c-4a92-ac74-3d8357e42b36", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e921a494-7dc4-42d5-a618-b039cd4563fa", "sighting_of_ref": "indicator--460ea616-1bc6-445b-9704-52bdedb856d7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc73270d-4d0f-42d4-9038-7aa35835982f", "sighting_of_ref": "indicator--7db4a18b-8e85-4ee5-a3c6-eda74b27ae48", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--161b4027-582f-4448-be8f-67d9d284cc52", "sighting_of_ref": "indicator--bd5129b5-ccc9-4a06-b04c-b3814793c136", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04d0d848-7d95-4beb-96a3-47c02abdff4e", "sighting_of_ref": "indicator--65bc4967-8db5-4b8a-80b1-9226643fb89c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7018e517-0956-4144-81c8-3485af4a2462", "sighting_of_ref": "indicator--21f1ce07-edf5-4c67-9c0a-4b9910f09ece", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fa037ac-e53d-4320-8fb9-318876d3b48e", "sighting_of_ref": "indicator--b1d5fb72-d777-4fc5-84c6-75f01e18b0d7", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a57ba16f-8507-4730-957c-622051cacf54", "sighting_of_ref": "indicator--b1d5fb72-d777-4fc5-84c6-75f01e18b0d7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6eacc13-0d05-4126-bdd0-0e55b3d13654", "sighting_of_ref": "indicator--b1d5fb72-d777-4fc5-84c6-75f01e18b0d7", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9922b8a0-b24a-4505-bb98-b82441b90d56", "sighting_of_ref": "indicator--30a928c5-e85f-491b-8fb0-05591329dbe3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eca7ecd1-9be3-4ddb-8286-4ebce7871aaf", "sighting_of_ref": "indicator--30a928c5-e85f-491b-8fb0-05591329dbe3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7785ef29-00cf-4916-adc9-bef0d99679d9", "sighting_of_ref": "indicator--30a928c5-e85f-491b-8fb0-05591329dbe3", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f80481b3-da0a-4948-a633-3a81ffe0abcf", "sighting_of_ref": "indicator--e70a56da-13fe-43aa-8563-5f2fbface5b1", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ba88250-6251-423e-b204-7da696f38520", "sighting_of_ref": "indicator--e70a56da-13fe-43aa-8563-5f2fbface5b1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18a16d3b-8016-40a8-9462-6519911d9c57", "sighting_of_ref": "indicator--e70a56da-13fe-43aa-8563-5f2fbface5b1", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80741da1-122a-4ccc-9537-b1db2b8d6d72", "sighting_of_ref": "indicator--667ca686-3a50-4082-be05-a8b14243a3fa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c0b3a3e-a2c5-4459-bc6a-9b8bb9b97809", "sighting_of_ref": "indicator--667ca686-3a50-4082-be05-a8b14243a3fa", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca8ca158-d228-4c8e-ad3c-fae80871df1d", "sighting_of_ref": "indicator--667ca686-3a50-4082-be05-a8b14243a3fa", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--595528d6-6934-487f-88f6-c5134c583cc3", "sighting_of_ref": "indicator--028f7395-e169-4496-8a25-96adecfbcee4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddcbf470-26b6-4453-b4b7-78779664a0a7", "sighting_of_ref": "indicator--028f7395-e169-4496-8a25-96adecfbcee4", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ed75138-89df-4607-bb13-72875205fae3", "sighting_of_ref": "indicator--028f7395-e169-4496-8a25-96adecfbcee4", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eb03515-c75d-4ab4-9053-100cbc01025a", "sighting_of_ref": "indicator--e5502ee5-a4da-40e1-9f65-7d4010622c5e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aaaa9a21-ca95-4fe0-9c6f-1079c6520b15", "sighting_of_ref": "indicator--e5502ee5-a4da-40e1-9f65-7d4010622c5e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e4c2181-e9a9-4870-bb99-efd06050fda6", "sighting_of_ref": "indicator--e5502ee5-a4da-40e1-9f65-7d4010622c5e", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d75836a-c47b-445c-ab41-54acf5f2b13a", "sighting_of_ref": "indicator--49bec679-8bcf-487c-b958-e15f95a08c39", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce51bc6d-6ec5-4054-a04f-f73596229a9d", "sighting_of_ref": "indicator--886c25c5-0aee-4468-818a-be30eab85a60", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5ce18c9-5db0-4e4a-ae72-42e16e59a2b2", "sighting_of_ref": "indicator--22728968-c471-496e-87f2-8ee75c4b2bfa", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90cc25a9-940a-44a8-b971-bb0a0bfa96c2", "sighting_of_ref": "indicator--50f69f32-4bf7-4cad-9fe1-395e72a16a42", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f704b4fa-e4f2-448c-bb39-753fa9c4d3f4", "sighting_of_ref": "indicator--f9d218b4-dd89-48c5-bac0-01f6ec1fb542", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7f83784-c8d2-436a-a80d-4cf5f652c652", "sighting_of_ref": "indicator--bad835e7-2cec-46e1-9899-c8aa3ae002b7", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bef961df-ae4d-4615-895b-20a15f146d5f", "sighting_of_ref": "indicator--2992182b-862e-4078-8ac9-7c0a7908a62d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5dfe47a-ef36-46e7-8069-ee08696a23d7", "sighting_of_ref": "indicator--2992182b-862e-4078-8ac9-7c0a7908a62d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--605528ed-9726-4b93-9968-03ee858ee2db", "sighting_of_ref": "indicator--b2fce54c-5f2c-47ad-ac6e-098474ff9f2b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86e71f31-c47f-4d1f-a738-1f8a3c071e11", "sighting_of_ref": "indicator--b2fce54c-5f2c-47ad-ac6e-098474ff9f2b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba8c1311-db17-4e44-ac1c-a0e52d29e155", "sighting_of_ref": "indicator--754ab9da-aa85-40e5-a327-8bf79b658ad8", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37deabff-74c1-4f9b-87f4-6d2b3f4ec662", "sighting_of_ref": "indicator--754ab9da-aa85-40e5-a327-8bf79b658ad8", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cebfc7e6-9ff6-461a-8fb2-81c1e4e2cfa1", "sighting_of_ref": "indicator--0697ef8f-21a0-47a0-9a22-5e771c77fc51", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb15212c-1806-444f-9bff-0221160e3215", "sighting_of_ref": "indicator--0697ef8f-21a0-47a0-9a22-5e771c77fc51", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef5b9841-ad81-4ab1-a49d-2495422a6a43", "sighting_of_ref": "indicator--8598f3c7-af61-42ab-86d4-e788507717ed", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48f4e816-7a80-4719-8e19-fbd2b81cee7d", "sighting_of_ref": "indicator--8598f3c7-af61-42ab-86d4-e788507717ed", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--062aa47b-d7d6-4ee2-8392-a95fc9e8bf7c", "sighting_of_ref": "indicator--e334eb21-40c0-464a-9e50-5bcbd17f12df", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d31c00ba-e2eb-48b5-8b51-a12dff50788d", "sighting_of_ref": "indicator--3edca18c-d60b-49df-8573-03eabcfa1e1d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecc5cda4-7e85-4705-9893-7a16d034ba4e", "sighting_of_ref": "indicator--3edca18c-d60b-49df-8573-03eabcfa1e1d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--283f8a5e-1bd7-4c44-9dbe-f695c162d8f5", "sighting_of_ref": "indicator--02e4e720-2ab8-49e6-8d3c-eb77c839f219", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8faeb7c6-ffe5-4e2a-b4d8-f2aa8135bcd3", "sighting_of_ref": "indicator--a5ccf15a-12a5-4896-bf07-392bd64f7edd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e521297-803d-4a1e-9bbb-6814862b873d", "sighting_of_ref": "indicator--c17e9046-d8bf-4d58-b18b-121d1b95db6b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3773f51-9713-46e3-8dff-cde3d945853e", "sighting_of_ref": "indicator--c17e9046-d8bf-4d58-b18b-121d1b95db6b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--134d910e-f6ea-4022-b50b-330222bb6918", "sighting_of_ref": "indicator--9854cb48-a3b9-49a2-83cf-78e364e8e86d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--679ebbbb-0446-46f6-b79e-1338cb51a95f", "sighting_of_ref": "indicator--f8f1a748-b82e-4a2f-bc58-f3e1a41a5c0c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86e5867e-1ba9-4945-a07b-10185a0eded4", "sighting_of_ref": "indicator--abaca373-4914-473f-9637-14955547fd44", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f340a1f-8fc1-4673-bca8-0d63cce3bf44", "sighting_of_ref": "indicator--88ecd922-6eda-4a70-8061-16bd3458332a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d3cdd65-2b82-428e-a6d7-22ba6512bd7f", "sighting_of_ref": "indicator--8cb94087-8e7f-4edf-9db6-67d4733c2d18", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--405495d8-7f8f-497b-ad39-39aebe2151c5", "sighting_of_ref": "indicator--c523c076-b774-45fb-8f69-82ef6461359a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffb6f7ad-afa4-481b-9fbe-76e785200f54", "sighting_of_ref": "indicator--1872fdb5-7166-4771-b8e6-e8695293f17f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7feb56de-775f-4a15-9c27-b728dcf29c33", "sighting_of_ref": "indicator--05a7e604-c01c-477d-a2c5-ba97aaf6d24d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--535ce5b2-1fef-43a0-aae9-2f7bbd26399f", "sighting_of_ref": "indicator--6a332df2-b95e-411d-ad1d-849866439a82", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb7193ef-d26f-4d52-a70e-79474ab34ad9", "sighting_of_ref": "indicator--e2e8194a-e331-4736-b3b7-c14938b77012", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fdc100d-31cc-4b0d-be6e-43a3e8a92cf1", "sighting_of_ref": "indicator--e2e8194a-e331-4736-b3b7-c14938b77012", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ee8ef17-b3dd-40c7-8e2a-d4bbc133cd2a", "sighting_of_ref": "indicator--928049ac-ff3b-4bca-aec7-9dc1ff830381", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b686f7d1-2d9c-4880-8d41-eed86119d491", "sighting_of_ref": "indicator--928049ac-ff3b-4bca-aec7-9dc1ff830381", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e65df588-7beb-4a6d-9eb4-592cc147264b", "sighting_of_ref": "indicator--461d3963-d24a-4a2e-a39a-038decf56229", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fb58b67-5a6a-4ab0-823e-55a960f99e49", "sighting_of_ref": "indicator--0de38ac2-57e8-4226-8a3c-0ef801c7bef5", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac697107-569b-4685-a2fd-443e5492e8d4", "sighting_of_ref": "indicator--845c0e2b-0e49-4ed5-8900-ba64450b7b6b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b88082c0-4d19-4586-a7f1-3fdd5157c370", "sighting_of_ref": "indicator--845c0e2b-0e49-4ed5-8900-ba64450b7b6b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c9aff39-663a-429c-b97f-8bf564653c4e", "sighting_of_ref": "indicator--99a8c6a8-971b-4b4f-9c9a-a5ed7ee8d208", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1e71070-a6df-4142-b923-bd70964b1d3a", "sighting_of_ref": "indicator--b703c3ee-5514-49e6-be77-fe6f9b0738f4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af2835f9-59ce-4214-8ae3-830b70a5a0b5", "sighting_of_ref": "indicator--2edbbcae-978c-468c-ab3a-d15d75e27fcf", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c19f7bc0-9c09-4278-b1d5-5a23fa408182", "sighting_of_ref": "indicator--79c917ec-2769-4857-ad98-a1c4eb51e38c", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--336210e7-1368-4587-8856-2e1fffe03e5d", "sighting_of_ref": "indicator--55ff7a72-24a5-4e74-af92-af7849ba0249", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--260364aa-ecb6-45c8-bc81-7bd51c983b8b", "sighting_of_ref": "indicator--55ff7a72-24a5-4e74-af92-af7849ba0249", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43e62638-24ad-4914-995c-5bbc01dc8362", "sighting_of_ref": "indicator--8b876586-7cd1-4a4a-8813-985632aa7955", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89b1dcfe-666b-4538-882f-0da397bf787c", "sighting_of_ref": "indicator--f44cc952-2b15-45e3-9ca2-a1d0c804dec5", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc5b62fd-8dcb-43fa-90b6-2a03eee68f6f", "sighting_of_ref": "indicator--23fee816-2fde-4dff-918e-1ed4d0b68b78", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bec4713-fb34-4410-a30d-2ce0e4bb9bc8", "sighting_of_ref": "indicator--23fee816-2fde-4dff-918e-1ed4d0b68b78", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--001c12fa-a731-411c-a220-d6073fd72084", "sighting_of_ref": "indicator--6fc2af08-8d25-4171-8d36-4f1c121a8d80", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81332fc3-cf56-4b02-a667-2427e85e15be", "sighting_of_ref": "indicator--5c8315e2-26f3-458e-964e-458377c4936e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b02665ba-ace4-48f8-aff5-e084391241f3", "sighting_of_ref": "indicator--61e22ddd-b74f-488a-837e-5d360db1d397", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03a790ff-d29c-4ae9-b8e8-d72e91e81f9e", "sighting_of_ref": "indicator--2d20a781-480a-4fb2-9a8f-948d4546625b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce1961a5-30b6-41eb-bd65-ddf028fc5847", "sighting_of_ref": "indicator--2d20a781-480a-4fb2-9a8f-948d4546625b", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1135825a-0034-4ad2-8969-549fbac20727", "sighting_of_ref": "indicator--ed220236-33f3-4e58-9d32-adf69a313493", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ec7d43d-e159-4545-9130-3028aba0c6b9", "sighting_of_ref": "indicator--eac34034-750a-429b-a70b-03893c95e1f6", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a06146c-6048-4a2c-a7a1-e648d738735f", "sighting_of_ref": "indicator--bd50d749-4953-474d-800d-e736058da06b", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f89c9408-4898-40b4-9275-0b50cf3f5294", "sighting_of_ref": "indicator--09cdafa6-9065-4a30-bfd8-dadb40f818ad", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90efa304-9066-4d09-aabe-d585f6a8c165", "sighting_of_ref": "indicator--09cdafa6-9065-4a30-bfd8-dadb40f818ad", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd925464-6443-4975-9743-6ddbeca7b25c", "sighting_of_ref": "indicator--3f78b5da-fbd0-4f84-8e34-69d9848a952f", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cca23067-5eed-4b43-be75-f7646abdbf82", "sighting_of_ref": "indicator--264e2d3f-b87f-4427-b662-9fbc48957959", "where_sighted_refs": ["location--d2dd1298-fd76-4201-a824-6cca2f847e1d"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0c2344f-3074-4f03-a767-76d1b62ef5c7", "sighting_of_ref": "indicator--3daa1c8c-444c-4849-bea5-c871e756b128", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6705fab0-13ed-4287-815f-bb5bb7b3aae8", "sighting_of_ref": "indicator--3daa1c8c-444c-4849-bea5-c871e756b128", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad641c2d-5b98-40e0-b87e-76a0322e41dc", "sighting_of_ref": "indicator--c12ea4ce-146f-4c60-8ba0-f5449230affc", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf7c42df-9254-458a-a490-6ca6afd5e5d8", "sighting_of_ref": "indicator--96020dfb-e11c-4337-a1a0-23cc2bb67c82", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d416c7d2-7649-45a6-8424-410ff815fac7", "sighting_of_ref": "indicator--e1fb678f-d2d9-429e-a3e5-8ac570018e2e", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--851d7b02-31d1-4366-b5bf-92215b266bb6", "sighting_of_ref": "indicator--b48d379b-f653-4843-9f85-b556ac790c48", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b6ea9b7-2131-4e7f-a39b-fb777883de2c", "sighting_of_ref": "indicator--226b0875-56f0-4adc-bd4a-f0bc91e17801", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cecda5f-d355-429b-b332-67a38cea9401", "sighting_of_ref": "indicator--3305abad-95fc-4cf5-bf08-9b1dd15d621c", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f829ea2-d2e0-4e4b-8fa2-eaee43e188e3", "sighting_of_ref": "indicator--f074e681-3265-4641-b959-5ee2f48b4da4", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac2dfc75-3b60-4c31-9983-3fec217c7bc1", "sighting_of_ref": "indicator--d3735959-da01-44b1-93a4-5a5d6a351fa3", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8073dc40-cb77-432c-97c1-89e49d8b8164", "sighting_of_ref": "indicator--d3735959-da01-44b1-93a4-5a5d6a351fa3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52bb0cf7-0f08-416f-a032-1c02619eb8f3", "sighting_of_ref": "indicator--1eaa80c9-f7f6-442d-99b8-80e13105e99d", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a530a639-0cc2-4751-b3c3-caa07413b839", "sighting_of_ref": "indicator--1eaa80c9-f7f6-442d-99b8-80e13105e99d", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe6f5cc2-9d18-4588-b7ac-9cc5c18e82b6", "sighting_of_ref": "indicator--ab240039-e3e2-4ddc-a092-1fd04395f717", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b08fbeae-c412-4ef3-82fa-21d72b4e6e3f", "sighting_of_ref": "indicator--c650a10f-d376-4845-a554-dfe4f5160456", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ea3d8e1-9fb6-41e0-86f0-a71960297399", "sighting_of_ref": "indicator--05b8634d-183e-4948-bec9-e931e5dfa316", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ae43746-e0a9-4c92-98b9-fdac862ba834", "sighting_of_ref": "indicator--b684d4bb-bf03-4dd5-831a-415240e12d65", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e00f71d-ff52-4c38-8a32-5e68f40503c4", "sighting_of_ref": "indicator--078f3ba6-23cc-4e19-9184-9f1e075474fe", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28b29c0c-7673-4c78-b337-cf4145e1a03b", "sighting_of_ref": "indicator--63c34fb8-7273-4ced-81ff-cfba754952ef", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acaad24e-ca54-47b1-b0a0-97bc7e8d5f1f", "sighting_of_ref": "indicator--0adf5bab-d33a-47bc-86aa-63dcbcc80976", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff4dd5d4-29bf-4c24-afec-7178abe24d61", "sighting_of_ref": "indicator--0db3a9c9-e589-4643-a63c-d70ce9fb5b49", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--135ddfba-e9f7-4eb7-8671-55d71558dc41", "sighting_of_ref": "indicator--ccf4d386-dbd5-4205-8625-a43f545fa50f", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa9a7c1e-0132-4e44-98f2-cbb57400bbd5", "sighting_of_ref": "indicator--7192faf2-91e1-42c1-a120-dafdae646d66", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a60493a0-4a89-49cf-abbd-f0cf749f7334", "sighting_of_ref": "indicator--7192faf2-91e1-42c1-a120-dafdae646d66", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2d24dd1-c4bf-4eca-b943-cb993e37abde", "sighting_of_ref": "indicator--e9b830e3-b12d-4136-bfd4-c37b731c7f4e", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51a9a13d-0245-442b-9184-9a721cf4a1ca", "sighting_of_ref": "indicator--c947be2d-569c-4578-9c42-b08b2d4a8b0f", "where_sighted_refs": ["location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--678c8e28-1e39-4bb7-9e83-40c523611885", "sighting_of_ref": "indicator--abffb656-08c3-4cc1-a68a-3b99b8a72926", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--416d4573-7616-4041-9ed7-db45502f135b", "sighting_of_ref": "indicator--abffb656-08c3-4cc1-a68a-3b99b8a72926", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53e06105-c001-4379-9008-7ee356b9ab56", "sighting_of_ref": "indicator--d607783d-8eea-47d7-88cd-681d994dc274", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e0002e8-b1f4-4c49-9d71-1ce32572fbe8", "sighting_of_ref": "indicator--d607783d-8eea-47d7-88cd-681d994dc274", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05692f55-0f67-4976-8734-c6fc583b90bb", "sighting_of_ref": "indicator--08c9b215-3a8e-403c-bd23-0cf5e34dbf06", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bab696fd-3d63-4561-8907-efda90fbf981", "sighting_of_ref": "indicator--08c9b215-3a8e-403c-bd23-0cf5e34dbf06", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75c8998e-6fe1-4922-991f-286ae187b3d5", "sighting_of_ref": "indicator--a3bad049-fffe-499c-875b-0835cf424aa1", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fb2abe7-c2f8-4ba2-b673-9ed57be46d6a", "sighting_of_ref": "indicator--1d0869a2-2cdd-486f-8b1a-e01044eeadab", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2fa3af7-275c-41af-a4d5-0ec57c5e0f41", "sighting_of_ref": "indicator--2e7a9849-cdca-491c-afea-bb7c68caed10", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0a968e3-53b8-47bb-8f90-ae238953e03c", "sighting_of_ref": "indicator--c693638c-52ed-4139-962c-225ccf032a97", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c29ffc96-79e8-4859-8a9d-69b265da2202", "sighting_of_ref": "indicator--871f7f9f-2222-4130-927d-64b75a3569cd", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fb679dc-e6eb-4d07-8576-fdd5e7f73b88", "sighting_of_ref": "indicator--f8e8be93-16ed-477d-bb0e-fdf014060dc5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--435e6e56-f3a3-48f1-bba4-7167b1a21008", "sighting_of_ref": "indicator--1bb4d753-4443-4642-8800-2cb7f737e0b3", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6080372d-49f5-444f-b54c-e9c6810d23ff", "sighting_of_ref": "indicator--0511424e-ad9a-45f7-9ca5-5e511672f070", "where_sighted_refs": ["location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d225372c-0fd6-41ca-a9db-bab35d71b20d", "sighting_of_ref": "indicator--c0407562-e6e8-4bed-8d7b-867c43b9e711", "where_sighted_refs": ["location--b0a7046e-9b88-4166-a5db-af87255aef39"], "first_seen": "2026-05-14T00:00:00.000Z", "last_seen": "2026-05-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "report", "spec_version": "2.1", "id": "report--3ae164af-6370-47f7-be16-df34cb58c13e", "name": "Threat Report for 2026-05-14", "description": "Daily threat intelligence report — honeypot bruteforce, web exploit, and anonymous proxy detections.", "published": "2026-05-15T11:00:01.680Z", "report_types": ["threat-report"], "object_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "location--e019b1f9-42ad-4e62-a1dd-83378ca3a0eb", "location--d2dd1298-fd76-4201-a824-6cca2f847e1d", "location--9a25b7e3-8fcc-45c3-ac1b-dc1292ae8cc7", "location--b0a7046e-9b88-4166-a5db-af87255aef39", "location--7c8dc96d-b943-4a10-b995-6acb39ff4d1f", "infrastructure--a68ade1d-4fc9-4f6e-9c95-7e007321a362", "infrastructure--de27a6dc-10b6-49c6-884b-b196a4ac489a", "relationship--82d09174-6769-46ac-aa94-07ae3a64b365", "infrastructure--e5f25f56-5504-44f2-adea-aaee542dbcb5", "relationship--2eca798f-9a58-4b52-b405-a55bd2ff0ff8", "infrastructure--4c20bac0-5cb9-4b40-a3ed-273814613093", "infrastructure--fa25dcfe-5666-4856-a1a7-9d9283764e9d", "relationship--83406b83-376b-426f-9935-a3e4fd404f9b", "infrastructure--8a5fb27f-e9f6-49b7-abda-863605730ec1", "relationship--788de50b-61d6-4ec6-a1c5-1b0c7e3a7e07", "infrastructure--97dc842e-f94e-44dd-af04-6d2c407dea8d", "relationship--57379da9-3719-4620-a070-2195bea5f174", "vulnerability--18b00767-6fe4-4c52-aff9-317d315ef022", "vulnerability--2fb7ed1f-1a69-43c5-ab5f-193d13a7f598", "vulnerability--46662d17-7108-4a7d-8b83-36f90f7e9762", "vulnerability--3384f172-ff60-42fc-bb04-7abc79e498e6", "vulnerability--eb1503a6-965f-4d2c-bd28-e1f287172aa7", "indicator--c22fb853-0cfb-425b-85cc-f4ffc77e64d0", "indicator--c978ed12-4e30-49f8-ad3c-4d5dfca1e247", "indicator--bbee149a-bb0b-4361-841d-2cd137108567", "indicator--34641c56-a3c3-4fd7-9add-9fe4820535c7", "indicator--e706e0ca-4c3e-4c8d-9817-fc2eb57de47e", "indicator--e3138d53-972a-4392-b282-d21eff017409", "indicator--c913543d-ba22-4990-a506-51848ead7072", "indicator--2e4fa3af-2852-4950-8eab-ea26829f99b0", "indicator--dda416e9-49e9-46e2-9d63-95ffea7f7946", "indicator--da5585dd-2e9a-411c-8dc6-f6c90ba8c2ae", "indicator--8467a388-dc1e-4394-8612-80f165d960f1", "indicator--afaf9049-2d16-42af-a6de-8eeb58172e36", "indicator--b6026d77-5349-4c62-acee-ded32243e475", "indicator--6a73a57c-2892-4400-a180-a0c971706a50", "indicator--b97ab9d2-dda5-4408-98c8-c52b34710445", "indicator--8d3a0474-c379-454f-b38a-a7946d59b9b5", "indicator--d0a93bcd-89e7-4473-9dda-ba9f9887eb36", "indicator--6e5c2bde-42dd-4146-ad39-a7a5c79fdb9e", "indicator--fb0d693d-2270-40e2-8f4c-dada92861e00", "indicator--0374a3a9-3aee-4818-a419-c280f85a581e", "indicator--ba3590ca-0508-4471-bc48-bc5d1675c1cf", "indicator--10f600b8-0286-40e3-a9fd-f961b6e72f9c", "indicator--71327451-c03c-4287-ab5f-f56f7b580e9d", "indicator--6af4f832-ae4a-44f5-918e-d2bc1ec4f9dd", "indicator--fbcee029-94b8-4eae-8e84-4d57efc23747", "indicator--19b60e35-863b-4a6e-8130-adc1778aae57", "indicator--b0ca2cc3-0b99-448b-bb4b-8ea5badc327c", "indicator--538b8011-7574-49b7-8a90-0bfcc56128fb", "indicator--44df3dcb-b5d6-4952-b306-58fa522f6113", "indicator--48d76e7a-0c4d-44f7-af36-d5891d30ab12", "indicator--d7c725c4-ce77-4a13-9002-0f2e889aad3d", "indicator--56e95025-fb0d-4d07-82a1-b7b9e0809af8", "indicator--e21bf05c-9e0d-4754-9395-11db12bcb17b", "indicator--eafa3f06-d923-4d9a-8648-ce2066ba8797", "indicator--0658264a-d8e3-4b8f-827b-12342905e283", "indicator--5ce7422b-b577-4dd6-967e-90dc9d01b39e", "indicator--dae13c76-0dec-40b2-a9a9-03eeeb549d7d", "indicator--f783dfa1-1453-44be-b7c4-c8ef157e8f24", "indicator--44f647a6-55fe-49c6-b1a0-4efa4e43dc5f", "indicator--b889f681-6ebc-4f25-b677-18b1a3b2a18b", "indicator--5c5adfc5-463f-47ce-91e0-db0b10d57a58", "indicator--e098f764-243c-40ba-aa93-7d55e1846f1b", "indicator--e54b5e1f-2bfc-45fa-8832-7973a328e9c4", "indicator--63bdacec-fef8-4268-856e-99d24bfb64df", "indicator--0eb5d63e-6c81-4ceb-add1-cc54f556d6a0", "indicator--c3f2dfcc-2ec9-4f4e-ab0a-b8b9e392b9d3", "indicator--3b70212f-1108-425d-be2e-8268da74644e", "indicator--889d639b-80df-4b71-99be-cf4e22db1ebd", "indicator--cf3cbae3-8406-4adb-8d84-dd0c3d7cb6fe", "indicator--cfbaf6c5-0cbb-4b51-a09c-fb20a01c05bb", "indicator--2bdb5ffb-e726-44bd-b14c-0ce49cbac6f9", "indicator--ae33233f-a941-46b8-a500-0764a6ae83ed", "indicator--66fc6b5d-70e0-4db5-92c8-5d403001cd5d", "indicator--bde5f68c-24f0-46ba-943b-b89059805387", "indicator--19630739-9962-4cad-b277-ebd4500dee61", "indicator--c564a5de-653b-4100-b259-193804166ea0", "indicator--58bc3f85-7942-4c3d-9d93-975299580437", "indicator--f1e3d595-7515-4b48-8509-c3227e26e31c", "indicator--7dc5dc21-1496-41f5-8317-84fdaddf00d9", "indicator--96243d77-b216-43c9-904d-9d457e930414", "indicator--69732358-2d63-465f-9a51-82ec3c9c711a", "indicator--94cbbe45-e441-48e2-9caa-bd0fe50e0584", "indicator--30c909df-55de-4e3e-82f3-a668d5a2082f", "indicator--e5231375-b4f4-4b09-b508-8e279c3bc358", "indicator--ed8901f6-e35d-4f1a-9642-4852ca421356", "indicator--e26b4e0f-b628-40fa-8dc5-b17da46a8273", "indicator--0a455a4a-b4d4-48d9-a5bd-19a69b5bd660", "indicator--98b49e92-fde9-4989-9362-91601b5f6a97", "indicator--4d671bb6-79b3-4b73-8e7e-0f7a02c8ae07", "indicator--90578a65-d388-4c60-afb6-7f9a95623494", "indicator--63448f13-b372-440c-beb9-f5cfac192c4e", "indicator--8272356f-5e75-422f-b97d-4a80a540c9dd", "indicator--a5f7ce97-f720-4d0d-8b30-6312a9c37a99", "indicator--31099ce4-947d-4acc-816f-06ae581ca7af", "indicator--358874f6-ced1-49c6-a5f9-96190a78e8cc", "indicator--709828c0-0a2f-4838-8420-515a6a93b4da", "indicator--d70684db-e5f9-4c52-85c3-ccf46ab30f29", "indicator--5274407a-d1e7-4446-be09-0397ccc46b7f", "indicator--3f90ea8c-3df4-4312-bb1f-8be290c97f2e", "indicator--f68e0d8c-f8df-4e57-b87b-3e13fbe34352", "indicator--aceb5b03-a865-4799-a291-33c3818e3dd4", "indicator--8901726b-b703-424f-abad-fa80386e9701", "indicator--b9c21c3d-9b51-4e2a-9701-0b9c4841b438", "indicator--39656d92-2c74-4326-bfee-a59d8ddb7231", "indicator--1ad2bbc1-31da-446b-abd6-a9fcd28e2ddb", "indicator--a925bf43-ef43-48a7-98e3-fa1341184d8d", "indicator--5a6e17b3-f4c6-4874-abe4-cbd0db3c1b94", "indicator--d44f1de0-3940-4689-b1b0-368e2f736f86", "indicator--c85839c5-6131-47e0-932d-a338ef5d5131", "indicator--aab163e9-13c6-4296-9a01-6999ad5253c9", "indicator--b37d7245-852c-4e04-a81c-49610df04c1d", "indicator--97749c7b-452a-4dd4-8910-a53377a1ef9b", "indicator--426ce966-ac2b-46f8-a4a0-b17151e23e8e", "indicator--a4f410d1-50c2-47cd-892c-2cbb4ab3aa32", "indicator--06edb523-8840-423a-8981-052143c837eb", "indicator--05447483-6a7d-448d-95f6-40a34739cbc4", "indicator--720938ba-91c8-4fcf-9dbd-e9ceec67a00d", "indicator--b7037ccd-ebe6-443f-b9cb-a30c2c534752", "indicator--2dc1c146-cbfe-412b-a214-4f6addca4bd9", "indicator--61358551-e28c-4859-b5f3-eb48ec8eccb3", "indicator--dfaa4d65-75ae-40d9-8ca6-3289a02f92b1", "indicator--baebdbf3-6d55-44be-a447-ae146596fba5", "indicator--2a7fab66-ec8f-42d8-8111-4286d1bbb30f", "indicator--f4a0541d-24bd-448a-a5e9-453813068086", "indicator--7e094c6b-b5d6-401c-bf4a-10a332a9ee63", "indicator--9c8ac6e9-7b75-4bae-8f93-8882aff7624c", "indicator--a7e1636a-b563-4c2f-8aff-711b10d0af06", "indicator--98cb1824-6311-47dc-ba85-5d5fcbfffa56", "indicator--919f5e01-1735-4932-8076-d6c75bb17c62", "indicator--521b780e-b0a0-4ac6-854c-07716a5245fb", "indicator--099b35d0-a898-4fed-9474-b0b2dba99d86", "indicator--08bb7415-d22b-4c1f-8c7d-67a43b41dc7d", "indicator--6835740f-afe2-49a5-9ec8-aa5bb6ec6dfc", "indicator--c3502ec9-3b49-497b-a4e4-31b6ade238e7", "indicator--323e0c56-7403-47c9-af8a-41f6bbb5339d", "indicator--bf9002eb-e49d-4a78-ad4d-f95e921f7d85", "indicator--f2a957e4-1f09-414a-be14-7ed39ba92601", "indicator--fa008aa6-37ab-4462-92c8-a720fdab2e00", "indicator--4c907030-10f1-4c6f-90ee-15492997c1e2", "indicator--112d36c3-d9f2-4dc1-9a1e-23753b3ebc44", "indicator--e9ac623e-b5a9-47e8-882e-ef654dc07770", "indicator--93c2fe3a-eb97-4b0b-886b-c14f1f8dfa6b", "indicator--974e0aeb-5729-4e19-a018-845a7b362191", "indicator--1e174166-92b3-4746-9ef0-e121804e1961", "indicator--cbb28408-e39e-4e74-ab29-fdf37f6b9a11", "indicator--bd63b271-4363-4eac-bb77-740da4eeced4", "indicator--b15989c0-6b4f-4ab8-95e3-16121048c9f0", "indicator--be4c6669-3389-4cce-b4e7-8aaf04e850a7", "indicator--05381785-07bd-432a-a893-2d91c6757222", "indicator--d56d37f9-1bf1-43cf-91ad-974f07e0cf04", "indicator--bacb0ccd-a970-4b33-bb49-3527dbdfb57f", "indicator--b8dee123-5e98-485b-98db-98a6ef91ffc0", "indicator--83cb6ab5-41fd-4cc8-9efa-53b17681a1ea", "indicator--acc3b059-8504-4282-a7a8-ff42f67e0ffe", "indicator--3c02e2d8-4e65-4e58-b9f7-1f1402ece82d", "indicator--d5a2ad9e-f95a-444f-ae25-01ee26e2b164", "indicator--5111b3db-deac-4901-89a7-140ba0113d6d", "indicator--c5fe0172-fe67-498f-b882-10a7138413f2", "indicator--7a718064-16b2-47c4-947b-3a0f5fe71532", "indicator--5dc92643-8f0c-44a2-94f9-ed8651d6b26e", "indicator--77626f97-f057-4324-a593-d5afdef2d07d", "indicator--7c2804eb-c3f0-4460-b37b-64f65ad8c859", "indicator--b9d6e36f-4c87-46e2-8ded-a308ebb35019", "indicator--d0647f0d-f790-4ea3-a34c-04b76ffc0a5a", "indicator--ad6c9ac7-3888-41f9-b7dd-33fc8132ac6e", "indicator--50cf6d23-54c2-4eca-84b6-c693479140d7", "indicator--daf30211-0dee-420b-a715-f164de3785fa", "indicator--e46b9f63-3dce-4a82-8724-c27b6232b651", "indicator--1d95e836-7da5-4be5-81ad-ac4f1e082bab", "indicator--b0f2504a-a5ce-47aa-9fe6-31cc6018c77d", "indicator--5fa152a3-e2a7-4c0d-9999-eed4c5b5a445", "indicator--623c91d6-1ae3-43b1-9551-df89ababc0ef", "indicator--54673ef9-34c1-4359-be2f-6da0388df869", "indicator--729d6f74-66ba-476c-a97d-75bfc17ad397", "indicator--c8e294d1-719c-4b15-8c09-3a55c846b81f", "indicator--bac08e19-3fe6-4e61-bcb8-654a4befb3fb", "indicator--43a2d8bb-8612-494c-a735-3fb8de0453b2", "indicator--9907f00d-d96d-4f6a-b1cc-702e75500894", "indicator--e10b51e1-58af-4e41-8b85-c5b7965e2c61", "indicator--f1e0d6ec-1e9c-475d-a434-645bfa56afd8", "indicator--e1de1fad-f1e9-4390-9efe-0a091ef23828", "indicator--74978029-0510-43cd-b27f-7a18bf702db0", "indicator--ad72c0a7-6a78-4e5d-8edb-b255cda4e5bc", "indicator--6ddffa84-95cd-4f96-b259-556528b12397", "indicator--6de3fa10-dc95-4b1a-908e-b31b5a4c9630", "indicator--96a528b1-75af-4542-9661-7ad7fef1dce8", "indicator--46672ead-2f13-4028-9316-e3afd28566c5", "indicator--79b2f3ad-ce06-4d34-8d1e-3b36ee2e20b4", "indicator--d96e409e-ef03-4837-8eef-7abe375436da", "indicator--4b98792c-c49c-4ddc-98e0-86bf434597aa", "indicator--bff13c28-5877-4941-8038-3e8fdaf469d6", "indicator--48ef96a6-780f-4952-a144-3dc7a185ddf9", "indicator--1c237745-e53d-48ca-b140-714f131865ee", "indicator--28778b69-b5ed-4641-8340-6521e3c62c07", "indicator--8913c985-d516-407b-b840-b638c95860d8", "indicator--8c4a1569-28ae-41ce-84b3-be4c020e8972", "indicator--5bb30ea4-4447-440a-9970-41deceb6ad2a", "indicator--54e6f9ab-2004-4c08-93d0-bcb01da1530b", "indicator--76dae6f4-6046-4279-90e7-2fb65c4f56f0", "indicator--954de1bb-da22-4abe-8f0e-4f413762f8a0", "indicator--c024719a-ae85-4b48-8c3b-923ae96c14a5", "indicator--fed53361-de9e-4aa8-ab75-505e96e53d33", "indicator--affbbd40-b0dd-445a-8490-84556a5ca176", "indicator--483b7881-a33e-45e2-8ab4-e4a720bcc40f", "indicator--fa9693bd-432c-44d5-9bcb-a2fb93ab5139", "indicator--bd393160-f8bf-4d3b-abc7-a322f464cda3", "indicator--6e5e0393-378b-4901-8c6a-6053d2e61353", "indicator--d9579b18-4f12-4ba0-912f-6c79a71f9b12", "indicator--f830432b-58d4-4b19-b615-f9ed5ca76942", "indicator--bf64fdd7-82dd-4a71-a5c0-1cdc9ad86ad3", "indicator--0da99aee-5981-4c5f-808e-308bf66b3d6a", "indicator--92d9f28d-4679-48a1-96cf-ea6992521e67", "indicator--5f10badb-1265-470f-8f77-d71bc4af714d", "indicator--dcb2cbbd-f26e-4dc1-8de6-c487bbafa3b6", "indicator--fc9078b3-e4be-49cc-b8d4-ef4cdd0acf21", "indicator--0e07571f-8f8b-478f-a880-8d129e28e36a", "indicator--35c16b8e-c97e-4e31-8dd2-1dbf3ecee22e", "indicator--b3b4dc21-21ac-4b9e-878f-c2170b9e642d", "indicator--68c6f2ee-367e-4743-9a19-9434b8e10936", "indicator--2c2fbb1d-596b-46b7-87af-ab99b48b752c", "indicator--e15fd08a-51fd-4c3b-97f9-8eb6fbd1f3ea", "indicator--96428db1-8e52-4cc6-b214-058e62e9585b", "indicator--40478924-85cb-4c7a-abcd-3121a909aea3", "indicator--4086290b-cf25-40a9-9cf4-5af362bc1f33", "indicator--b2dc91c8-fbfc-4fa5-a675-ba2309bd92d8", "indicator--31607b4b-e4f9-4502-9dda-33a4b624e129", "indicator--6e194ffe-3f66-4337-b3ac-d055c4964c0a", "indicator--1462f14a-9aae-400b-81ba-537861bbd590", "indicator--c73f8fe4-2015-47d4-8d49-2eebc47f159e", "indicator--72c18edc-3cda-4bc4-b22e-37fe66a963b1", "indicator--94ef9de4-a9d7-44ab-99c4-2cdae9c512c7", "indicator--0393550a-3c88-4e5c-9983-cf34b268f43f", "indicator--9d1289d2-2f6b-4876-9c87-7a5388d4a024", "indicator--0877a1fb-f5af-4191-b228-259948aa90ea", "indicator--c7b34ba4-d88c-409f-904a-c966e0bd06cc", "indicator--ef3a8746-a869-4318-89ab-a94c2e0c89ca", "indicator--45cb43e6-8628-4a02-8e7a-474f9294f134", "indicator--1dc456e0-2e54-43b3-96e0-08d655cd55a4", "indicator--6a01e35d-0646-4031-a5d0-0659de6ea385", "indicator--4c48b3d6-e5d8-4cb9-b6be-517e01bd6555", "indicator--123958b2-aeed-4029-948b-4d06ac44a17c", "indicator--ee422511-8340-4552-8582-2e75254b7af1", "indicator--998d0017-78ff-4380-bad3-d63941c44704", "indicator--7004ac8e-85c8-488e-883b-46514dece460", "indicator--89ab4b31-eb12-4bdc-84c1-b3eb62328db7", "indicator--86bd80d0-0ce3-496f-8738-b293027cfe19", "indicator--dfd71f15-c8e7-45c0-82fc-5ff141946be3", "indicator--a015fc75-b8b4-496d-96a5-6a07240a3673", "indicator--5977580e-8c1c-4dbd-9521-a9111efb10c7", "indicator--ccb21e1c-2740-4017-b562-ca0ecb26c930", "indicator--4ddd9fd8-41ff-47ff-a353-fc53ba35c210", "indicator--88d057d5-07e5-43ed-9432-4de0c6c0c7c4", "indicator--2a65427b-9560-4ba9-b6be-fd9435ad3fb2", "indicator--8f3894b2-e9b8-47b4-8858-9816365c656e", "indicator--79be4dc0-5e9d-44b1-a763-70c8e323dd75", "indicator--61b25826-d71d-43ff-80a6-dc316e29a1f7", "indicator--74ad9178-f912-4245-95c6-94acc2032538", "indicator--7a9f3582-15c3-491f-81b8-c1cef95fdb6f", "indicator--9571ddf8-77aa-4a6d-8a4f-470c7b954d94", "indicator--999b1346-0788-426e-bce2-4c19f9767735", "indicator--530824aa-cfbd-45f4-82dd-87d59a8e7ff7", "indicator--75abd05b-1333-423a-af76-f1b9c541503e", "indicator--29bd3dfa-eb6c-4291-8ee3-3ef1c1b20c88", "indicator--16e1b3c0-c70c-4a41-8fa6-3f7a048159c0", "indicator--f3585dde-caa0-4d45-9d49-d90ff62bd6d8", "indicator--2c9f2184-7d32-402c-80f6-b3146bb3002c", "indicator--b8c1b8d5-01a5-4563-90dd-98ee9c86d427", "indicator--7c3f554f-fb48-4cfe-860f-323da8f246ab", "indicator--7a47125b-813f-4de7-a4b9-ee67e40f71d0", "indicator--e7cb61f1-5835-4528-ac17-fc7b37d10e5b", "indicator--691c7c88-a82e-4eb1-8897-30e713a9fda1", "indicator--00b1269a-f4bb-4418-95cb-a903b38fb6ff", "indicator--edaec7ac-1763-4ce2-8458-9c74298d3bda", "indicator--01ac3493-2ebd-41e8-9ac7-9e933d0ee516", "indicator--31b8c45b-8021-4763-b66b-f804bbddd7be", "indicator--1b016f68-deb4-478d-864e-29b5d29ea24e", "indicator--3d11cd58-171c-4523-bfdc-731e86ba7d86", "indicator--d616c179-8c55-4cfe-81f5-88a656623e61", "indicator--a9b48a63-8a95-411e-9af4-9ba8c2af00e7", "indicator--5047353e-08bd-45d6-851c-813c7a5c337e", "indicator--d1f5dcfb-d187-4a79-be1a-c4e16ac34341", "indicator--36d93eb5-89dd-40eb-9678-d486caa01f08", "indicator--068e6212-64da-4918-b4fe-b61874c5b93e", "indicator--e36242fe-eccc-4ad8-a3a7-9c536bd923fa", "indicator--6bbdab4f-a761-4038-a48c-9077fe20c110", "indicator--af4c6fe5-8c27-49db-bf5d-734973fb84d4", "indicator--9b931d50-6109-473f-935f-0a01ad54f355", "indicator--db722ec3-2900-49e6-9b39-be9ff42bd594", "indicator--b4e7102f-b018-455d-90eb-f669ab67ea8d", "indicator--5a7bc64c-0b74-4dff-a3fd-9aa31c04f890", "indicator--8b07af48-3d4b-49bc-a997-d8b9486f0032", "indicator--f6c0faa0-d29a-4637-96a4-140ed38cfd3b", "indicator--2ae88c7a-9b08-4f6f-9211-b7d93f224ece", "indicator--18a42328-07d7-480b-9ac1-b876a5c15c03", "indicator--c2a3a4c9-bf81-4af8-aa9f-51538c35cbd3", "indicator--0037aca6-115f-4df2-96ab-67c29a52a699", "indicator--9e170f0b-058b-4de9-b791-368dc8624d40", "indicator--af125852-cd41-4787-8b7a-d2b018e5a1cf", "indicator--44cb3429-d01c-40a0-baf8-654b98411940", "indicator--159289a8-112a-49d1-a796-155f0d773fc1", "indicator--52ad3050-d035-4851-8c83-95a1dc620a8e", "indicator--756754a2-74b5-4a6b-9bb2-2a120cbb2b3a", "indicator--18873d1e-482c-49f7-bc80-ba24dd3fc384", "indicator--da64a600-4de6-4802-9be9-ad92b0383230", "indicator--b4a9fa3d-d71a-4830-b126-2a424e90157b", "indicator--24530788-617a-4520-b067-bec1824f480b", "indicator--a41bac35-293d-45df-99e1-0710c7fff72e", "indicator--edc50519-8977-4cc4-b2fd-06ebfba214aa", "indicator--fd230bf6-056e-428d-ada4-ac7d4156447e", "indicator--4ae190fe-6aea-40cc-8314-43ff4d1dea95", "indicator--c5290692-ce00-4d3c-85bb-9919ac4a7948", "indicator--33414f54-9065-48dc-aec0-a88057b3b9b7", "indicator--7819fb73-7253-4a30-afba-663e1642d034", "indicator--0208236a-b694-4f2b-8ed0-a0b350c5a1c1", "indicator--b0dadfc4-a96b-4b24-8616-ba6452917cdb", "indicator--14497694-a37e-4ca1-8fac-e8f5de5a6984", "indicator--c96b2208-209a-468c-a63a-8ab854c3b4b1", "indicator--fe76b897-5719-4c9e-bdb9-8b57c4aee618", "indicator--754ea8d1-be1e-4748-9cc4-990fdd529277", "indicator--42fd4366-57b8-4199-b11a-b63e639a5bb6", "indicator--7d81a61e-de96-4bb4-9510-4cf25ac61048", "indicator--82244c52-d12d-47f5-991c-1518d93e4c3d", "indicator--9a240ec9-1420-4795-8bb6-b3facb54f8ed", "indicator--770b72b4-33c1-49bd-9c48-b2837af9978e", "indicator--90b9fc3d-68b7-48a4-840a-5961c9fb2bad", "indicator--d4466070-a675-43c2-ab27-65e5b849d0bc", "indicator--a88d91e3-45f7-4c77-8c6a-e8361a3b1d72", "indicator--72d30f0b-a6e0-4c7c-a9e4-0af48642904a", "indicator--81687ed3-670c-4a0d-b956-02a21bbfeb6f", "indicator--a9a67228-1b05-4072-95cf-a9040e449431", "indicator--89331dcd-5f6e-4e19-8527-fcd7291b22e4", "indicator--92f74196-426a-4a1c-b6d5-f8bcaa779796", "indicator--a204055d-64d0-4c03-b504-99aee43856ff", "indicator--a50235f2-f619-4b2c-9ed8-224be62a8335", "indicator--4dfd54d0-213f-482f-9796-3b3d8c629817", "indicator--53948bf8-df06-46b5-8233-d25007b6da6b", "indicator--757b998f-ed2d-4d04-906c-afb65744eb6e", "indicator--6366b526-2887-41ea-a87f-dbfc4e090a2a", "indicator--eaed296a-4ef2-4abc-be78-5709a9745f63", "indicator--502a635c-c52c-4ecb-8faf-addef8419a86", "indicator--b9bcf88e-7370-4d6e-917b-16e142516a44", "indicator--00a4a975-0c49-4e97-be8b-75953dec3920", "indicator--653c0639-1877-4d0f-b88b-221794f0cdcd", "indicator--74e86635-d1f5-4eb8-aa09-68e2faa43338", "indicator--38ff0b10-79ea-4be3-8e25-c1a8cae7e711", "indicator--f5497a78-6148-4038-9726-36ea352cba32", "indicator--55f66e6d-5177-44d0-a537-3758d5263d6c", "indicator--9fee2262-2bc2-4d6d-844f-0f3d6cde031f", "indicator--5777742d-6cc8-479d-8430-21cac844d73d", "indicator--41c0cde8-2463-42a2-b5ae-e70b289a2e49", "indicator--72029306-bb60-4530-9142-9377e6d51203", "indicator--a49ed38e-ef46-40ca-aa05-c7277474fb0c", "indicator--e938f2c8-ed27-4ba3-a98a-aac9541b4116", "indicator--bef5c805-79d9-49e3-80f1-82b7963707e1", "indicator--13226e11-e11d-40da-a37f-324c12358a2c", "indicator--958916ae-91e3-488d-befe-65d183249877", "indicator--6f6d15ad-345d-43b3-9e24-1b601f1d9dcc", "indicator--501f00b4-5847-4bb8-8af7-4e9737d61586", "indicator--0f7056b3-0c40-4ab5-86b6-7fe3c47dfd3c", "indicator--8e75e54d-bd87-486a-aebc-df1dc16a1020", "indicator--3f4b1cce-339e-45e1-8def-848b1f7af986", "indicator--d4a7b5c5-8c38-40b5-b665-49fff17196d0", "indicator--45924ca2-56d7-42a1-8399-ab151dcbec09", "indicator--23f5db63-f14e-4efd-ac18-a18a2532ba35", "indicator--8ecf216d-49ad-43d6-852e-d0d529a70c81", "indicator--6d6c1d12-293c-443e-b454-6dabb65211e4", "indicator--37b605a9-1144-4d0f-a82e-136ee1c9244b", "indicator--78c6cc98-6e54-4063-ba34-1b66865c2bae", "indicator--edc602ca-6421-4195-a527-6fa4360b1aac", "indicator--3e758c31-435d-4872-b56b-90a6900dfeeb", "indicator--f49b2ffc-b877-4761-b66c-38900907fe1c", "indicator--368b6598-7f7b-4615-851d-59aca6073198", "indicator--04ba0a4d-280b-4d21-b05d-56e1d63748c2", "indicator--ae9108b9-08e2-4204-b4be-fc1c86be34c3", "indicator--3bd4b68f-adc8-4f0e-abe6-dfd6769b756e", "indicator--27a6ae6c-3c8e-4dce-9af1-2dd6c785dd59", "indicator--88ab8cb6-c37b-48fb-9e01-a756aa21e070", "indicator--5747b993-ccad-49dd-8fc8-d3fa4c7b9387", "indicator--be22b1fe-0881-4b4c-9e7d-44603862263d", "indicator--f669563a-4ccc-43c3-9fc3-e1aa76d316f8", "indicator--d8c13082-ff62-465c-88d8-fc7215ca43c4", "indicator--a44d7fcb-9e4d-4ee7-82c5-45c3995eb583", "indicator--b6eaf422-d1f8-4a4c-908b-1f2e13ba94f8", "indicator--bbc4c643-b564-483a-b8eb-139db5d8f32f", "indicator--ae32fb60-5be7-4517-9fd3-4000b1f5d45c", "indicator--71cb1222-0cee-47e6-a4b5-0f951384306e", "indicator--1c5dbd1f-8c3a-4ef4-9648-c60e83b857eb", "indicator--070e8fa9-f998-4f19-b4fe-7004b3b61005", "indicator--a78d1827-2337-442e-a56f-d1b89119ab9d", "indicator--a821c2e7-b9b7-4598-85d9-891040ba873c", "indicator--27d2f3a3-a7be-4659-9968-36f83553ea5c", "indicator--df7cfb3e-8132-4734-9a7a-574ad6a27f78", "indicator--9cd68253-bdc3-4681-84ec-15c59610233e", "indicator--4c0fa6f7-2805-4616-8996-154038246e54", "indicator--0fdc4abd-421e-43ab-a169-423e5a8492f1", "indicator--30467fb1-9078-4ff7-85be-b7716fa8a76e", "indicator--1599398f-7dbb-4dc4-99b3-5189dd75c4e0", "indicator--f0af9a01-23bb-4113-93b1-d5a35ee6d7ec", "indicator--ff7c2804-7f50-4fe7-ba21-be4a0928de37", "indicator--5a7b0818-b53d-4965-ae47-b1a6a4d773ee", "indicator--7174df1b-9039-4638-a6bd-419d82d27d8d", "indicator--c3218061-9381-4e96-b5ea-a2a1b0d2d6e4", "indicator--c175db37-3646-4263-9527-b33db3578b8d", "indicator--ffa9970a-1514-484f-9d5c-2802b1495362", "indicator--92d33d85-5c7b-4b1f-8b42-7056d07545f6", "indicator--042101ef-fd44-4fab-a36d-7cb02a322b93", "indicator--ebe66c4b-ea73-46f2-a987-d488c7382579", "indicator--c9a17cdb-4ad6-4cc2-95ea-ab63d26b92fa", "indicator--e960aff9-07de-4106-a894-ca2d8aa81255", "indicator--fb9456cf-81ac-43ce-ab96-ee6bbad8fca4", "indicator--a4edde30-766f-48da-accc-edd996910045", "indicator--7a69ac5d-09eb-414f-93dc-dd81e756fc2f", "indicator--50ba40dd-2990-4dbc-b8c7-6a3e0749fe99", "indicator--1fdae452-dd69-4a26-a7f2-3d16d98ea126", "indicator--531aabac-047a-42ed-8955-972b7ed300ac", "indicator--7b1dab0a-491d-4046-88d5-cb6baa16e651", "indicator--082e6b31-4f3c-40b5-bf8b-21dae6bbd6a0", "indicator--9a73febc-b88b-4e09-96fd-4ff0a29ccb7d", "indicator--f76b33e0-caf4-4159-a9e8-d691ffc6632f", "indicator--039be80c-aa3e-4541-a63d-cc5f2647523d", "indicator--7c1bbe71-dc92-44ae-af35-02616761847c", "indicator--cb72f20c-6cb7-482d-972e-b16e8ef91b8d", "indicator--fd6aa648-4a30-4719-af7e-a8a93c5f22e0", "indicator--6f008d03-0398-4893-b500-11ad0f2a6151", "indicator--1527d6d9-7c07-453f-9f1a-472b64b00681", "indicator--fd48b35d-4e04-460c-afe1-7f9febc7eca8", "indicator--076f9c53-63d5-41a1-9293-23954c398150", "indicator--d97f57eb-3eb2-42e1-aea8-b741f555401d", "indicator--af85d166-a463-4569-9399-1cc76d5f467b", "indicator--750cbdd1-aa93-49dc-8bb2-89ec43c6e8fb", "indicator--02679cad-5486-4fa4-8b30-9f1910b505bc", "indicator--50a1de17-b44c-46ef-a5cb-a508a69ae662", "indicator--a24d31eb-0fa5-4d25-b616-46f86307cbda", "indicator--f88804f2-7ad1-4fb8-9df4-e129c003c79d", "indicator--1666bfb7-a4a1-4c50-8a1b-f8bed57b6802", "indicator--8a64cbd5-9694-4c6b-8dfe-246c448175d5", "indicator--7988ac11-611a-4c41-9834-a32214cc51ef", "indicator--5d732aaf-76a3-4e20-a2a1-c6e3fce5d891", "indicator--6fb29fd9-4acd-4a73-a73a-5e89a3254cde", "indicator--b807ef26-953d-48bb-abe6-38957f560a73", "indicator--dbb74262-09b7-4f07-897a-fdfd3fa8fd79", "indicator--a95e4d16-4001-4056-9edd-fe847d78218f", "indicator--5af4f611-2db0-4bae-b860-43430d096525", "indicator--e79ee857-d221-4e37-9ff3-1994c1426259", "indicator--9c25b49c-068e-4975-9e19-ef687bd7fb2a", "indicator--bebb4ee0-fa41-4511-997d-af79b36ee03e", "indicator--55ab126b-86aa-4c45-823b-c87b48b18b0b", "indicator--2048edc6-580f-4d91-943c-9b062afe09b8", "indicator--b4b8e869-9e8b-45d2-96db-b3d50296f04d", "indicator--c1e995f9-9942-4557-9122-989468aa4892", "indicator--9eeb0269-fd7d-4bbb-aa95-805906bccedb", "indicator--ec1267a6-20c4-40a8-b031-27cb021ed812", "indicator--ffb4a397-82ae-4bed-9609-e1226c29b503", "indicator--aba34986-5818-4462-be5b-dffaaad67fe6", "indicator--ba7b45da-4d3c-47ae-92bc-3662816c5759", "indicator--28f71a58-93b4-4b6e-a3ec-ba5cc249e9b8", "indicator--3f053bb6-6a27-4ee0-a80b-dd6f3d05b735", "indicator--08f82ee4-6577-4956-b6ed-007c6a7c7909", "indicator--bbab8607-a939-4761-a30b-758d5fdc3ee0", "indicator--3f2857a9-7ba7-43ee-b1d6-ce3a9cfb1cd9", "indicator--f08b7f9a-3dc7-4f26-99a0-ead566a60f8b", "indicator--dba53137-2e06-4315-9f4c-c376d2708640", "indicator--b4affa5e-da79-4207-903b-0389e8cb8820", "indicator--4042cd5c-cfe8-4ee1-91ce-b1a87540d192", "indicator--796f94a9-0993-4e2b-b1e1-1ddc06978b8e", "indicator--51958ac3-65a2-4988-8dd8-80345a5b4a4e", "indicator--efd5eea3-ce52-4815-99ac-16075ab3bd72", "indicator--bd801cd4-c69b-45af-8e76-2c5459b8eecc", "indicator--488f5151-405a-43b2-9e78-a836162921e9", "indicator--6c5fc086-a37b-45f2-ba64-31b83f484b43", "indicator--da862c4e-655b-4cb0-8fe2-7487a9e70e03", "indicator--d0a31e5f-4c4d-49e7-845a-67f0ef269915", "indicator--218b0f12-5cff-46d7-a4da-0c88a0ccf925", "indicator--f48b1a94-c867-44e5-97ad-3803bb5a87d1", "indicator--699eebe0-5ed1-4ce9-b4d4-50284ce100c9", "indicator--a5a76585-51d7-48ac-a23b-736088bbd5d9", "indicator--dbb3ca67-a9ca-4a4e-bfb4-5e89925f6fec", "indicator--70a3a250-6407-4435-8d01-dc3938652908", "indicator--943f58b5-8083-473c-92ac-371803d8ba4c", "indicator--be5c31e0-68b4-44c5-a644-4f3d96f91753", "indicator--bf334130-975a-4563-868d-e0b415eeb9f5", "indicator--92c8abd2-7175-4807-aeea-dc85ecd7845f", "indicator--82306891-9962-461f-a301-aa97cb255469", "indicator--2d7e4ba2-f277-42b8-a512-55d1ce4427b4", "indicator--94511da3-1dec-4ddb-93fa-e14d01a1192f", "indicator--b13020a9-22b2-46dc-904a-2a463086c0d3", "indicator--2b7f9951-e87d-4709-a421-cbb89381221a", "indicator--c024da64-7140-45fc-a645-a1d1a36e48b5", "indicator--73a1a5e5-60eb-471f-9ff3-e586460a4870", "indicator--fc4e822f-1b57-4a92-9b03-4f5059fc1edf", "indicator--66f7cc9d-a1eb-4c24-85d2-db59800418d3", "indicator--eafa8bf2-ac16-44f1-8dd0-6e41be533495", "indicator--5a22ea06-ee94-4787-a914-ac2577b6a523", "indicator--8e59e8f7-12e8-4a2e-81f6-120ad8ce4f3a", "indicator--049dbaa6-6f34-46db-880f-ccb145a2875b", "indicator--01a537c1-bc77-420f-9e02-51c6135c548f", "indicator--4c51cb02-595a-4954-9642-abfb6539f1d4", "indicator--1e4bfb4c-e67f-454c-b562-6fbf4a98737c", "indicator--7cebf61f-3604-4a18-95cd-5c097deafa20", "indicator--a12cd545-9897-44bc-8e46-2dccf60f0fe2", "indicator--7abacb77-3fda-49f8-abf0-83626afd0dbe", "indicator--db97457c-db48-4b24-a958-f2a5385e6774", "indicator--85af1990-d495-4414-acbd-f79d714208a1", "indicator--ff3890e2-3ece-4a52-bdf7-20f798b261e0", "indicator--94f00ebb-7cb4-4f1f-b477-aa904c1db220", "indicator--b3e33998-571f-447d-b0c2-feba9bc6968e", "indicator--a24c0f0c-0154-460b-9ed5-987a895adced", "indicator--426cd3fe-3541-4c6e-9a97-8c7b5aaa8679", "indicator--beb8904c-8ac9-4e63-bd2f-7fd6b6c222e5", "indicator--f2a26239-72e6-4602-9fb6-b0e6edee011b", "indicator--f047b1d6-717a-49cb-8ae8-9d4ed533bed1", "indicator--a84c111a-c1f0-4f5a-a3c2-33c4fdf84010", "indicator--639c298b-8998-4285-b205-91c7d4c0dc1c", "indicator--000c5034-2681-49ff-9a2e-c8503b74dab3", "indicator--9451b4ea-ef43-4dab-a95f-3cad4a3374b2", "indicator--097681b5-366d-4417-a943-aa7357d97c7b", "indicator--bfc95520-3edc-48af-a164-7a3f1d89519b", "indicator--617c8079-f261-4d85-a14f-d6fdb3fca535", "indicator--a4021c29-a62d-4f35-b2cd-f905e8ce5715", "indicator--cc46dc68-43e5-43ef-a825-d92df6a8dfba", "indicator--8af65899-368d-4688-a9cf-f67fb675f782", "indicator--06d822b2-c40b-4569-a5c3-e6d78b807639", "indicator--658c8738-ee23-46b4-a72b-8c738a8ab547", "indicator--a4d6ece5-db2a-41c8-867a-c9693a228c97", "indicator--97d1535b-1c1e-4220-8342-e4bc02c504a1", "indicator--a7ade04c-5914-4fac-b159-0a974246a775", "indicator--8faf8683-6c55-4f79-b3f1-c8fd7901e7ca", "indicator--ef04328e-e0ec-4952-9461-1a06cb7b851b", "indicator--87147bd0-635f-4a2b-87d2-73ee8b9b4491", "indicator--e01aa818-0f71-4a0f-9ecc-10f83ce2338b", "indicator--d6630628-1436-44d2-af29-93f3bcfb7201", "indicator--3d6587a7-c7e7-42f8-8c62-8b1f56dd1901", "indicator--6acfb0c9-f51e-47e2-905c-8a724b1a1d1b", "indicator--ca58123c-f585-4281-87c5-b01869bb16ca", "indicator--c5462a71-a855-4c6a-905e-7416858cb9f4", "indicator--5d596824-51d5-48b5-89c5-8eec5b77d23c", "indicator--d14e277c-7bab-44fe-b0da-b5ffd4ad3cbb", "indicator--38fe9c0a-eb4b-4f1e-b4ab-97b82b1138c5", "indicator--bb99627f-f0da-45f7-87fd-6116979f51e1", "indicator--17c7fad1-d995-477e-9fc8-015132d9085b", "indicator--0a9722aa-6b54-42a5-98a9-0580b079a5d6", "indicator--de52069c-3af2-46e9-bbe7-96a442546c0c", "indicator--8146ee3a-894d-4bb3-9f04-844ddd67ea37", "indicator--575d6fa4-13b2-46ee-b1b1-87ddc7fd694b", "indicator--785ca154-c522-4982-b302-f0a7f17f51da", "indicator--3fda589f-2016-4eec-8d03-2edd936a88ba", "indicator--76754b5b-0814-449f-bc11-ff0c5dcebbc4", "indicator--f440b65c-5985-4650-b5f8-a1ed85afcd27", "indicator--1f17a072-79f3-4119-984c-e8ccf96de6bf", "indicator--4ca61669-0a39-46d0-80cf-343b15016821", "indicator--4071f0e4-a58e-4657-a692-2cbd291cf278", "indicator--5cbfc01d-db58-4383-82a8-cafdb4c4e2af", "indicator--8c91e585-b8e7-4922-96bd-09c4273f5534", "indicator--897e1970-cb0f-4b8d-b53e-80f8b34c09af", "indicator--ea3a43b8-4a96-4796-bf0c-ca388e5a1509", "indicator--5bc55a73-505f-4240-a184-deda86d68976", "indicator--5795aede-d28b-4b6c-aa56-8b6143865389", "indicator--1d58f754-749c-4de8-a363-1406350af737", "indicator--0ad2ec18-a01e-4bdc-a0fc-f986c41dc3a5", "indicator--c0153087-8fdd-470a-8b14-3080b2b20ca4", "indicator--d42e3127-5a51-42f6-a331-12a76fb07ece", "indicator--b37564ab-6f33-47a8-addd-820ba178ca00", "indicator--79e60524-c905-4eff-b659-40e3985bceed", "indicator--72a99dc2-b779-4e35-839b-c82706e27014", "indicator--cd220c57-8ae0-41a4-a2fc-28b083c108a3", "indicator--43519c99-d829-49b3-8afd-6eefd77b94c9", "indicator--bdec1068-e690-4981-8ee8-92f3ad1e67d4", "indicator--bb34a044-8ec6-4618-87c9-a3546f142254", "indicator--c1756735-2074-401a-a75b-a379afa92afc", "indicator--4f907948-1960-4142-a89e-cd3a9abe2c38", "indicator--94c27c88-f899-45b3-8714-714efc9ff708", "indicator--a141df88-8140-4b48-9736-b32ed384435c", "indicator--b73402a3-6989-4745-b983-35a08ba56891", "indicator--6502a842-f4f3-4666-b9b0-dcededdcdae2", "indicator--47bb9f96-729e-4757-92fa-75760ab66c0e", "indicator--aa8eb8f4-13c8-4070-9ac1-3f0b6680e1a8", "indicator--d7b372ae-69a0-4e1a-b5e4-c704e856e7b8", "indicator--14feb005-a538-4f13-bd26-ac5d36a3767d", "indicator--e6951bd9-68db-4298-8e12-ae632aac1720", "indicator--790aa396-ff0e-4cbe-8eb0-c7aedf30042a", "indicator--ffbc3f2c-bb30-4ab0-ac21-0cbbec977a67", "indicator--8e904440-6558-4f86-b350-d1280929c429", "indicator--eade7fa0-67d8-4ea9-9cfb-b1e3903bdae6", "indicator--ece89926-6c6d-4ab5-81d4-b9819e50f25b", "indicator--c0bbbb83-521f-4bfc-bc17-2d5fee98dd13", "indicator--a48ed720-49e0-4aaf-8e00-cbe84128b286", "indicator--807b710a-1ae6-4f8d-a095-2815da9a1b6b", "indicator--5762975c-0ebd-419e-8d6a-bac6a44a8bbe", "indicator--f0a5389e-0ce1-409b-b632-42bd8106530a", "indicator--917b63cc-ca75-4a16-b70e-14fc457bf1b7", "indicator--858f9926-ad6b-4bd3-b5b8-6a48425c9d0c", "indicator--143c1c88-35f1-4055-8d03-808bc06e950e", "indicator--dc14057f-8f75-4785-896b-9d87c66f4ed6", "indicator--ae1a40fc-2619-4686-ab7e-358e491ff226", "indicator--9461d2d3-57a4-4051-8ee1-1d7f36eacd4e", "indicator--cab3b1d9-720f-43a6-8493-1257f563ec1a", "indicator--1d75c8e4-b6ec-4da3-9be9-8e101f1dff71", "indicator--dd056346-1f19-4806-8c50-fe9846c613ba", "indicator--9476b91f-3afc-4da5-ac2f-92b662fd0974", "indicator--adacc8e5-8824-4490-aa52-481605ae65ed", "indicator--0653ed81-c48a-4176-9be8-56a229d19e59", "indicator--973d784d-908a-4aa5-bb28-7147bee3e929", "indicator--3a654c36-d58d-4683-8bfc-fa7aa6b0ab0a", "indicator--e92192cd-85d7-43c9-8343-69fe1dbbcfa2", "indicator--1dc370ca-39d1-4df6-ae77-2f4320cd5c97", "indicator--32b161e1-cbe9-493b-b8c6-878db50d7399", "indicator--cc909233-bb03-47bd-a9a2-73fdbeb1226d", "indicator--de38f487-229d-48b8-abb7-490b18b1e1d2", "indicator--3956d957-0db1-48ab-94c2-c9056dbbbcec", "indicator--3262eb8b-1a2f-4234-b3bb-3ea8353a739e", "indicator--270a3f01-d491-4ba8-8139-2790412a0bc6", "indicator--706538af-850b-4e1f-994b-54dcf4137318", "indicator--668a2a42-15bc-4754-b708-44fe41814cb6", "indicator--60fe1820-1ba0-40fe-9092-aa5b20e4d002", "indicator--ed209121-219e-4fb3-803f-79c6e508d51d", "indicator--a0f133df-5765-48c3-bab1-cdd8b8e3757a", "indicator--41b4c3ef-dc8b-4ab2-ac63-524e0682c315", "indicator--ae1d2ee3-e1e8-4d57-bd2b-6d581601d605", "indicator--79c798a0-4dda-47b1-9085-648ed0ad8d31", "indicator--f708d3d8-5694-4227-bf0e-bb071e3bebf8", "indicator--ad596ed6-4269-4812-ac87-8f2c92cd4153", "indicator--dbe88bac-25e8-4710-bc9f-a1cdb5b7d829", "indicator--795f7539-4df0-4cb9-9a5a-b67960ed06ae", "indicator--b0889a3d-afe8-47d1-b8b2-f1f7975e8f87", "indicator--37e691bf-acd8-4e73-bb10-1dad19f34496", "indicator--b2a9dc64-596b-40bd-b7d2-2fb320bd506b", "indicator--72cccae2-a1d1-4331-9b49-aa168b1875c0", "indicator--db612617-3775-4935-b342-dedbd5c72c7c", "indicator--a0dc0c51-ba38-407f-a72c-b1b934ce9902", "indicator--365499d8-b1c8-4f67-81f0-0a34e0ca3f7a", "indicator--9e00a4a6-c2ec-4cfa-a511-e54d623ff7bc", "indicator--ede9d68a-73a9-47e6-89a3-ea94aeb5f2bb", "indicator--9efa72fe-7774-451a-9478-eaf8ae04d07a", "indicator--2497c0e9-f2b3-4b88-b79f-90a418900d32", "indicator--cc3bdc34-c3b9-423d-8f21-fec226d72410", "indicator--587356f3-50b5-4c2f-baf5-f5400fe02652", "indicator--dc70ad7b-0a37-4631-af57-9ea1d9cf5c7a", "indicator--788f97ad-c6a2-42ea-81c2-a95b3ef361fe", "indicator--64b828a7-e1a7-4aa2-980f-f774708cfd41", "indicator--a7899e8f-dc0b-494d-8b44-5314c245a928", "indicator--581738fb-0e1b-4610-bf9c-0c80a67e4775", "indicator--f1c56db8-2f67-4933-881d-ed181a37d9ac", "indicator--271b6d1f-407d-4051-9309-9e44c340c534", "indicator--bd05c17e-7361-474d-a1af-18896892882a", "indicator--47dcb875-df06-487e-ab5a-c8153838f969", "indicator--b222f73b-23ca-4350-8c37-09c9b76ded1a", "indicator--f3fac308-0592-4361-abe6-f67fc11bf64b", "indicator--528e8384-0c84-4af1-8221-017c07166279", "indicator--5670bf60-2942-4691-bafc-7cfe9be6da55", "indicator--a6429ad8-7df7-4fca-afc1-09fe1b679bda", "indicator--e7cf3c0c-18ff-4b2c-8806-b2e900a6f2c3", "indicator--5f9f1eb6-da92-4fe3-8610-646a5477cbf2", "indicator--b5ff5721-8ecb-4a15-91fb-452a7e15d53c", "indicator--bde576fb-8672-4366-ad4e-b5cc4873b650", "indicator--9b1a6fd4-d499-4a1b-a64c-f133f73937d8", "indicator--0381cbb7-87ca-4936-a5d1-421284cb963d", "indicator--3c6a4292-875c-407d-8ffc-36b45f5d6da7", "indicator--90f0d269-1b72-4ec1-948c-efb1d02f76da", "indicator--903d599f-db02-42c5-89c5-755eaa03c2d5", "indicator--1cc5e1ca-f558-46ec-82f9-2d25621ea5d9", "indicator--fe483bda-b4be-44a1-99c3-70a6f8c2ffd3", "indicator--3a59ff32-9508-438b-83d4-31949c31459b", "indicator--c0f7148a-cf57-46d6-9bfd-b62c18e27096", "indicator--e29a71cf-7a6b-4256-b7c5-01660a471566", "indicator--1d1b5b76-86b7-411e-8cdd-d38feba808fd", "indicator--84a3fede-a96f-4314-8913-d9cc7df7955a", "indicator--17c47d40-439c-444c-851f-0655b455396d", "indicator--f7ae533d-1ab3-4533-9d81-143a09821cd7", "indicator--59051225-2da5-4c4b-8eeb-264fe3584b15", "indicator--67a7988c-474d-4502-85ce-f95f53ed07a9", "indicator--03624803-e9a7-4328-ba6a-0b23b2e618f7", "indicator--c0e779a5-c00e-4989-acd9-e5d34a0dd489", "indicator--8b9d5542-e37c-46d5-8270-1de86846b288", "indicator--922fc56c-9897-417b-ace3-8d30b22fb0b4", "indicator--677fada3-e0e1-4fd2-8e41-0aa029c04ae6", "indicator--7d44b24f-9157-4c8b-afc8-930c718a78af", "indicator--b5694bd2-20b8-4ef5-b34e-e92fabe8ca0b", "indicator--ce3985c3-65cd-419e-8467-8594097043cf", "indicator--5f902fdf-c2e1-4474-b58c-b43e02078055", "indicator--b2e106ee-b78b-44fa-b6eb-c7e9f67cc673", "indicator--ca82629b-4861-47d8-b6ac-475fff280d90", "indicator--bdf33235-444b-4ab2-959e-71988b724347", "indicator--f973aa8b-1043-47cb-9d22-a747b32a3b6b", "indicator--d4a44867-417e-4758-8fb8-ec84f65d1345", "indicator--67378246-1ccf-4c01-96b7-8f67530795eb", "indicator--fa0d9360-d232-4bce-9ce2-e261acb83dfc", "indicator--59e576a5-8280-41b5-99c6-85bf59b4167f", "indicator--90bbeb2c-0907-42f9-94fa-130e95f7be5e", "indicator--4911648b-8cc8-4e3a-b486-b81db4acbc46", "indicator--54bcd071-7161-457f-b8b2-1ea3c8d44ae3", "indicator--2f77215e-c6d4-4021-beeb-f34c088fb6e3", "indicator--8d2012ab-c281-4bf2-8921-7c1b1dff9088", "indicator--9f7579e6-2ffc-48e9-8cf8-8fe86e021719", "indicator--b3c153f7-5e31-4193-91e8-ecef5ac4d545", "indicator--ec8a304d-c2ad-4a06-888b-407e77f53631", "indicator--22b156af-036f-4c31-8b9f-b7d351e9d3bf", "indicator--0589ec82-820a-47d9-84ac-dc4bb3ab315e", "indicator--e574a104-f691-47ed-8c3e-8e30079823ce", "indicator--15085f59-29d5-49d7-9235-26d914109ce4", "indicator--d424e56f-1e1d-4f55-acd2-ea126a685b50", "indicator--7c49d44f-82b3-49d9-86ef-88c7b22150b9", "indicator--bae07be3-70bd-467e-ad3e-250b8119c9a7", "indicator--06e8337b-11fb-48d1-ac21-d48d55a02dbb", "indicator--ade423f6-e501-455d-bdbc-3d730b6bee1f", "indicator--97c7f52c-7911-421d-9607-c68156b11bfc", "indicator--7a2e3344-641e-4445-82d2-cd60744baf5a", "indicator--3ea21867-1f9c-4298-8276-fc7f9bab46da", "indicator--54a46306-59a1-420f-9675-c6465678a6d6", "indicator--544d78d2-1434-4ee0-a81d-83506c27942a", "indicator--6be0593a-b7ce-40a0-9901-270117828953", "indicator--dce7bd1c-f4ee-47c4-b824-a16bef9ce10a", "indicator--68051773-fcf9-4ecb-be0b-f45e9f6e6c83", "indicator--793364a3-3672-4d89-9f0d-9b9fb004a3f1", "indicator--9afdef08-e071-4ba7-8799-ffde8a07cf26", "indicator--17a65a17-7461-47a9-93fb-3d9fbf0ec096", "indicator--76974594-73d8-47ea-be63-f4224d1fad70", "indicator--692e05df-0c5f-46a8-bb8d-1e3e287f1668", "indicator--8f310ab5-bf8d-49be-86f0-fef1e91c152b", "indicator--c2732fb8-2f07-4bff-a030-4184f0f8b8bd", "indicator--5b421131-5cac-4945-9889-48fc95d853b4", "indicator--f2b62a77-d216-4db9-852c-b4558b9bebdc", "indicator--efacafbd-277e-49b0-bf51-f0362d798903", "indicator--8908b58f-6597-46b9-8d1a-5419de2f7436", "indicator--df20095c-9698-47f3-88cb-063df331d2cc", "indicator--81435ce9-a49b-455a-b51b-3b43bb8bec71", "indicator--f3a24a20-4b79-4a2b-959c-e59e57bc1a70", "indicator--d52a932a-3504-4fcb-9ceb-1c29db25b3d6", "indicator--7d7823e2-514d-448f-a1b7-d852b5aefc42", "indicator--558506b2-6d1c-434e-819f-8b13740118fc", "indicator--b7785c95-4592-4b2a-9441-b487acb7c983", "indicator--d685254e-30c4-40d6-b784-b82756d343e0", "indicator--63904afe-63a0-4ad3-a9b1-2d86a33137ab", "indicator--4c143481-0a61-4183-b4d7-0ed19adf5bb0", "indicator--c5df7bb7-2113-4503-93b6-a58a5ab20b31", "indicator--35e11d0e-4ffc-45ae-9966-8d0c6095606b", "indicator--ceb27dd1-c3c2-4427-b1fd-5229b07d56b5", "indicator--6ce4f53b-a930-4ee0-88d0-1b690e85b65f", "indicator--b63e726e-5be5-41e1-9a93-20ee062ee9ec", "indicator--2f769483-49e2-4ffd-ad17-ffb91cb57ec7", "indicator--372f28c0-9d7e-4968-ac4a-dd93104687a8", "indicator--51e5086e-0408-4e5f-b9a1-c8a5bd01a5a5", "indicator--b89f24e8-0c40-4fa3-b464-ed9bea98e0fc", "indicator--2a39b63d-92ba-47d9-9396-6d223bdf8b89", "indicator--eabafe21-b0d4-4510-9a19-f7f2c653233c", "indicator--440e3530-a305-41ff-af4e-daa7a8d46f92", "indicator--999f5025-7804-47dc-a638-229b8b3d11ed", "indicator--98acbb63-e288-4a49-885e-fff17d549716", "indicator--b591bbac-8364-414c-b15a-19a4546bcd8b", "indicator--c1437612-8e1f-4419-803f-cead15e44f0a", "indicator--b618e8a6-babc-4602-a375-8abd9e81947c", "indicator--b14bc9d3-f8ba-4803-bbfd-667823f3321b", "indicator--1cefd9ec-5e40-46a5-9674-8a777f022a4d", "indicator--405a6d44-4817-46a0-89a5-2516fc095db1", "indicator--7c004daf-cde9-4085-9999-ac50bd80409f", "indicator--08af8f49-2868-45c5-bb99-727c185220d4", "indicator--c2f66b13-2924-4516-bfca-30518b61d98f", "indicator--0bc119d9-fffc-4336-8a2e-386293682b92", "indicator--23760baa-7e06-4c5a-b319-6c5c52e58f89", "indicator--775e07c5-3d4b-4bac-b661-f00fcf734833", "indicator--3fdd9631-7535-4e7e-ada8-9d16397336db", "indicator--c96dcbbf-1497-4dbf-8f74-8a76825752d3", "indicator--11443e0f-4e9b-4aa9-99c3-3e5b2cc3732e", "indicator--13f65610-c6b8-44d1-9787-8106a2ec4a81", "indicator--5f14e594-d6d4-4b33-813e-9c93c6f5dd9e", "indicator--f03158dc-05b5-48d0-8722-137924e77efe", "indicator--47449f2d-1c3c-412a-b50c-5b315e28cd15", "indicator--b3d25297-3ce2-4c5e-9811-79dd14937822", "indicator--05b55604-589b-4eed-8969-46d2fce6340d", "indicator--dc57cc25-9f2b-4ba0-95be-a044c3bcb737", "indicator--746e2419-2034-4a31-9cfa-a97a02a22f0a", "indicator--2ff090d0-63a4-4d4f-b1ef-5d48a1cb92c3", "indicator--ddee31d6-08a6-4cc3-902a-1794df54d743", "indicator--c4b01da3-3725-4af5-ba92-f62a36a98443", "indicator--36e5988c-889b-42a4-b807-61aad32d2ff8", "indicator--cbcf88b7-da40-4a65-8ae0-7766be100a73", "indicator--d6b8ed4b-3462-4cf2-9bed-7f06fbf11f7d", "indicator--d4360140-8a69-45a4-9362-2cce4eee3a38", "indicator--a50352e1-8209-40c3-aa3b-c2539d2ce5c8", "indicator--4b3d1c0c-7aaf-4a15-a5d2-7e74ddb7ac3c", "indicator--9c98dc35-dd0b-457a-80eb-8b036de1fae3", "indicator--1d8ba945-0fd3-4adf-870c-525aef3dd5bd", "indicator--9603dfc6-4dd9-46f0-8810-5b960172b237", "indicator--2caa1790-e0c3-431d-9add-0596f8a60dbc", "indicator--c2a09342-541b-4e37-bb87-732261017995", "indicator--bce4f091-53c3-44d9-99a8-4e411498bfe1", "indicator--ddf71db1-a279-435d-9db5-eaa1d867b0d7", "indicator--e27e5b37-0b47-432a-825a-64583686f47e", "indicator--c4012c79-6f49-4254-9467-9a2b3936ab17", "indicator--397b3591-d96a-4623-b5ec-f6e60943360b", "indicator--7aa331bf-5d6d-4de4-8a6d-a5af35120797", "indicator--55a4b11b-ff81-42dc-824e-774568c9a342", "indicator--2debfa96-0691-4992-9d38-e75d22dc138e", "indicator--5a3c29da-fe8b-47bf-82c8-8be2a68e0637", "indicator--9f75bc11-fed5-4871-a950-99240adba3a6", "indicator--081d545a-6d4d-46b6-ba66-d3c30666b7e0", "indicator--d7d3c75a-1d67-458d-aacf-fd3693472029", "indicator--7de300e7-756b-4b88-8ec0-4aa275492f0f", "indicator--6d750180-88f3-40f0-999e-c7f73c9d7e08", "indicator--a2f386c8-445f-4fb2-8a72-46ca6c99f4ea", "indicator--cce37c30-1394-49d8-a4ef-ba81514962bf", "indicator--32246fab-826a-466b-9be4-1aed511e2aec", "indicator--465f4be2-1964-49ed-9fcd-bbdaaa02b5f8", "indicator--46f1442a-dc12-4670-aaff-927816fbd9e6", "indicator--4f776f47-4e06-4b50-9d02-7555cc8351c3", "indicator--24877968-a15f-4c66-9837-c4ae87c4fc44", "indicator--b09d55ce-3682-4dd2-b100-ce6aec72a3b6", "indicator--1abc629b-7bea-4cfe-89df-92eee63f830f", "indicator--06dc2465-1427-4a04-b0d8-89df666e6732", "indicator--29688534-a129-4d73-ad9b-3932badcef78", "indicator--7f78a5b8-8f1e-496b-bab2-2a3b2c19c72b", "indicator--b8d4acb2-eeca-4cb9-b3a8-00e03b36981b", "indicator--b210dd9d-31ee-42e2-912a-ecd0328958e5", "indicator--adc8be3f-83c7-437a-bd8e-2b1b412c4811", "indicator--576920c7-6252-4682-a56d-5511f501229c", "indicator--25de30d9-456a-4d63-8e5d-24e0fc778a1b", "indicator--a110b883-222c-4dc1-8110-d0f751a05aae", "indicator--1c2dced5-d7dd-4c83-937c-5579fea18296", "indicator--73d4ba46-0296-402e-b109-3db30242a2e0", "indicator--e0e29bfa-1719-4dda-88e5-823d4dc56442", "indicator--801a10e3-903c-453c-9ac7-ce6c77382605", "indicator--2051537a-c294-46a4-a7c3-04f385df275e", "indicator--24877fd2-4a8a-46eb-b0b2-85afab06510d", "indicator--d2f1e272-eeb2-4bc3-8e3c-d5676e6ed731", "indicator--f6bac1c1-d4aa-440b-b2f1-eb7fdd88b87b", "indicator--7625b8d5-70ab-40fa-a3c5-a4ba6a569e51", "indicator--704ff870-30a9-43f3-a32d-ddbe57497f83", "indicator--d82f4f50-1618-4295-8c8a-05f590732d1a", "indicator--8cffadf4-6151-4d0c-8b72-49f872530c83", "indicator--04128e2a-67aa-480e-8f44-f124179de3cf", "indicator--e645a8bc-eedb-49fc-aa10-1b4263720867", "indicator--5b1e24b4-bf1f-4592-8b18-65cc0b2ad30c", "indicator--dd835990-80ae-4114-b68c-a144a59517a2", "indicator--065f5a81-6e43-41ae-83b3-353291d0746f", "indicator--fe01266f-5495-485b-abaa-634a558dd4e1", "indicator--b126b9c6-1682-4e08-9837-04f555cdda24", "indicator--c847cbc5-815c-40bc-8088-9a7ca09fe06c", "indicator--ffcaf8c8-2546-46e3-a0d4-bb0c911ed3e5", "indicator--4d20830b-45b5-4f7b-8e7c-609c25ee6da1", "indicator--9fb53265-7104-411b-a8c7-4d18870cd358", "indicator--8c4a01fb-6756-4e86-8f77-5d2b54f66113", "indicator--1b25275a-a6d9-4f54-8efa-b97e8bd19629", "indicator--89d1bcc8-e61c-41d1-af4a-ec3c68f13b85", "indicator--5c50ea45-5e80-492f-b927-d8600f2a98a4", "indicator--3c5ddfbd-584b-4c55-b92f-23ea00f43f0d", "indicator--f2575432-d01e-4aee-a3c9-13de02271800", "indicator--486960c9-774a-459d-9e28-7dbc5a867bc9", "indicator--e74694cc-bb63-42b5-94bb-6d604e7e13ea", "indicator--bfaf0710-11ba-4a84-968c-19989d2648f9", "indicator--76b97f9f-191d-43cd-a454-94e310e2f49b", "indicator--96b2334a-16fb-4153-a523-f1760e366a6b", "indicator--a763104f-57c0-4982-97f5-e1e4924513d0", "indicator--000e5e00-e7ea-4b87-a598-48c564b7b1fe", "indicator--74730d7f-7922-405a-bb3a-e7fce2cfbed1", "indicator--255025d2-a832-45bc-86a3-d3bd7ab8c520", "indicator--22f0ff29-ac59-4ca1-b7cb-a623383e7952", "indicator--a6b3aa38-9d7d-4b0d-bfb8-2d23e173abbf", "indicator--e1b714e8-63c5-4d6f-960a-06e435866a26", "indicator--8796ecfa-7f58-4ead-96fc-3e6f749685d3", "indicator--af552da3-e61a-42b1-a9f7-d20febc93664", "indicator--3e6b2b5b-11b6-4225-ad85-d0e0376b4f41", "indicator--6458ac20-5f2b-4d94-b6c7-e6286bf36f21", "indicator--51017cb6-e53a-4364-aa29-e97528b7ac80", "indicator--ed083369-17d3-48d5-aa46-635ee12f0739", "indicator--1c9f1881-86ef-4563-9276-877717d63d12", "indicator--45f24956-7b73-4e5b-be4a-6920bb1b595c", "indicator--ad8fdc02-8b7b-4e67-b8ef-0c0e8240c489", "indicator--16ac1ea5-47e9-44d1-9c1f-db441480cfae", "indicator--cfd50163-5c5b-4078-83a7-b90b10d90894", "indicator--a0b04255-aab4-4925-9480-8744356faec5", "indicator--664cf8da-05d8-42ea-8011-e9f90d0c01c5", "indicator--aecc41f2-3a34-4d3e-ab1a-123ec4ec7b59", "indicator--cfdd9d80-f801-4c66-9c6e-2e9c1c0e0a90", "indicator--cd1b3e49-9368-4975-98da-a4ad87b4ff8b", "indicator--b7b05610-121d-4b38-b3ce-09cc89d2accd", "indicator--36f810f1-c82e-4f10-b6ca-cbc846c2460d", "indicator--2972cdd1-93c4-435e-8aa9-79e8bfaf55f4", "indicator--07f6d7d1-98ce-475a-ae32-e811062c8748", "indicator--21982545-0d51-429e-8298-9188be14dca7", "indicator--3369f05d-b5de-4062-a4b3-e95ae3928d72", "indicator--092c52aa-4879-4cf3-bb63-085394b28bd8", "indicator--8dcd2198-c888-43ea-98df-0aed5a53a052", "indicator--e2036cb3-be4f-469b-9c09-b84f6e130bb4", "indicator--8cc03870-4db3-46d3-b18c-f310b2fa3e94", "indicator--9db38292-1233-4fca-849d-c67986c1da5a", "indicator--29f6d891-c036-4fe3-94b8-f07b033191cd", "indicator--114f813c-39f5-4c1c-990a-b19d52fa09d8", "indicator--2e32f67a-28d8-45b2-8fa1-f80775584ed7", "indicator--9367407e-8bd0-4ee2-a228-bf9690a0d25e", "indicator--f0e5b916-d260-4bb9-bfff-5c6a32e75562", "indicator--747472d8-d6aa-4193-b8c2-a6254619bf51", "indicator--ab219960-50ec-4d11-b597-775e2db06361", "indicator--baf43600-cb0c-43a0-ab5f-c8681eb9e326", "indicator--c192a15c-1f2f-41d7-a37b-ab4647a87050", "indicator--a5dd6c1c-7be4-4d97-87c5-d2af11e34116", "indicator--18107071-72df-47d8-a032-d7c13eb55468", "indicator--141b17e3-de91-46c8-8743-3f2a5b53fb87", "indicator--929e274f-663f-4dca-bac3-8313f0a0bc3d", "indicator--931cbc84-22ff-4744-926f-90cf2a53da3a", "indicator--0cc832bb-9573-4c6e-b7a0-a4dec111a40d", "indicator--a943c5ba-afe4-4f32-a2af-0cbbdf0cd10b", "indicator--643b8240-7a9a-47c9-9633-71de59d8da51", "indicator--5f9d3587-519b-4129-8155-bf5ecea6cb60", "indicator--5fc87ab8-bd37-4f8f-a7aa-bf54253387a9", "indicator--eb033c1d-ff51-4ae3-9d1f-c7584af1b786", "indicator--41abf338-c41b-4f4a-8b76-9e7163659007", "indicator--b69c84cd-caaa-4a12-8518-c86b4692dba8", "indicator--1103c2bf-9a56-42c9-801e-fd77b29bd57d", "indicator--810b12f1-113f-493f-a11e-a40dec63d5d0", "indicator--ebacafee-1c8d-45d2-accb-6516b325314e", "indicator--60363bd5-591f-4b82-b6a3-bc0fcb9014f3", "indicator--4061d15d-191a-4c1b-929a-1cfc16b2e43a", "indicator--9d6c79a1-f9b8-4cab-8803-a6ac2537d578", "indicator--3fd54603-ad10-44c5-afdb-2c23ecae4e06", "indicator--06638dae-c62f-4d6c-ba5f-26c23175921d", "indicator--6683218e-55da-4a9b-b369-43936f14f4e3", "indicator--c806a036-c0e4-4dd4-a12e-813116b5cfac", "indicator--7f7f9bf9-dca2-4dd7-a063-87e4915f672d", "indicator--6956b073-71d9-436d-9cb3-ca90fa74493a", "indicator--49c53f1f-6979-4277-9c2a-62aa61a5451f", "indicator--46f76ca9-37bb-434f-900f-487efb574a21", "indicator--b7c69008-9ff1-4931-b9df-4ee28eb16535", "indicator--453e794d-7f36-4f27-89f3-af9dbbf0e388", "indicator--7f3a8a87-1a40-42cc-9576-d5fca263e709", "indicator--7597ffe2-71b8-4a4f-b4f7-e2584c44bac9", "indicator--af929497-2fe8-41ab-9eeb-5e6f3f38a95b", "indicator--48f4b35a-d0b5-4d46-944b-15200a943270", "indicator--3156d35b-2ff2-48a8-9573-f92856e21d6b", "indicator--dc036559-da3d-4ed3-acda-efb41e54ee7f", "indicator--69957276-ecc2-405e-9a02-c775b7f203eb", "indicator--4cbcd018-50ae-4aba-abd9-e62c043d917c", "indicator--80168ede-bdb9-4805-8915-587de8f07813", "indicator--5212c564-ed02-47c2-ad1c-6baf65ab4173", "indicator--ee1b372e-e4d1-484b-8286-b6d81fcc8d36", "indicator--6484ed0a-31cc-4cfc-b562-1bc326ec0f2a", "indicator--fb320818-8260-4df7-85b5-970be3185976", "indicator--7f7e2e27-f008-4297-b3b2-acac94072cd4", "indicator--25db8d84-4966-4838-ae6d-a8c2183a1be3", "indicator--65a806cc-0333-48c4-9692-9719b12df9ba", "indicator--3ddac408-4c3d-46db-a70c-3794a6bc5245", "indicator--51a165aa-da87-4d96-b6f7-fe1abebf2901", "indicator--be96b11a-3213-4a56-8094-0a120ade4e7b", "indicator--0383e71b-242f-4867-8b88-eeefd9e4722c", "indicator--a55fcf96-b1bb-45ee-8289-b168906b62ae", "indicator--25cc954a-7e94-416d-9c93-6157990a57d3", "indicator--469727d9-5dd1-4d04-9769-007d9873f597", "indicator--d89d5417-e26f-4c47-942e-57cd63c9dfa7", "indicator--03a50ba9-f34c-4847-a0d8-311043faa97b", "indicator--eaa20d5e-36d0-4616-bd00-efd450f3ed0b", "indicator--47489e93-70d3-4ea7-8c77-bfeec8bd8612", "indicator--002bd7ad-12d1-4995-b81f-50334c8bc58e", "indicator--3cac9dd6-8720-420e-966a-88e6bea7bba6", "indicator--4250ee7a-4747-45cb-a441-21fad5db24aa", "indicator--cb608e24-880e-4e59-87ed-e0321e995a38", "indicator--88026522-bef7-4533-8841-d04cd7ce163c", "indicator--f35a4e79-dab3-4c53-a99f-05dce4c6f1fc", "indicator--8884f251-91bb-4cef-a559-1e7f525c36ed", "indicator--74ab56bb-b0e6-4907-b2ee-a6217a954a49", "indicator--873f9906-78a9-492b-a6be-fd43a56f6a89", "indicator--4daa60d7-f479-4fb2-b965-42aa64519ba1", "indicator--487a52b7-8d57-4f82-973b-2d5ff7e5b0ef", "indicator--1616da10-fba7-4c8e-ad9c-1f5a7712d91b", "indicator--9c897aab-2ecc-4b64-8266-4aa100048ecf", "indicator--2980235a-3eeb-42c2-bc50-849e4db99fa3", "indicator--8b8e501e-bfbf-4e6f-9dd6-b8abd071f17f", "indicator--f1abad45-6109-4717-90f2-266d2e568493", "indicator--960fff3c-e4e8-4a8c-988b-b348bdbb34a6", "indicator--97a182c4-5ede-49aa-a512-0f6096885be1", "indicator--1f0b921f-01a0-47c3-8d3b-a2b3b5142f46", "indicator--368c4428-d0f5-411d-b45c-d30d3058723e", "indicator--0fc6e2bf-8ebe-4341-a8d0-8f46ff03c4ff", "indicator--1316a4ce-022c-479c-bec6-cb16b9e90838", "indicator--d7c820de-5ba3-43e3-90fb-a5c5cc55fb74", "indicator--a360f1aa-5915-40dd-ad77-9d147e46f923", "indicator--239536fa-b631-4c87-8f46-bbec9e7b9d57", "indicator--5bba545a-d960-4df7-9460-822625d101a2", "indicator--31ed67fe-e19f-4b7b-b842-afca5492d4b6", "indicator--3459f2aa-97ca-4843-a40f-f258dbc87c81", "indicator--79bdd1c5-941d-49cf-a970-216ddb375d79", "indicator--794f6836-20f3-4db6-9089-f1c0b2b343db", "indicator--bbd34f49-ab60-425c-8064-0b5562b19ace", "indicator--01b9eb06-0330-41cb-a08b-58199a7541e7", "indicator--d50e710d-2739-4d9f-a5b8-da78ee7e75f0", "indicator--c47f8f46-f3cd-469b-92c0-201609748512", "indicator--85ae1752-4ad1-41d5-a952-0712812a18da", "indicator--a33bc4b7-c2a4-48a3-9afc-c8f3a4a23147", "indicator--ec2e2f15-e78f-4f06-b70e-1da273c2d03e", "indicator--04f1ac33-b193-41fc-98ea-3000a1efbf78", "indicator--ef902117-3014-4594-adc7-8ef53530ca69", "indicator--abdee47e-127b-4cc7-b7ad-f23153ceacd7", "indicator--1d231917-207e-4736-b15a-0868db313bab", "indicator--137fcd2e-ac13-4cdd-9422-460484749903", "indicator--603acf9e-2e73-4f70-9936-42badb857cd2", "indicator--82932d85-572b-4b4a-9ffc-bf43f621a646", "indicator--084ab3cf-1707-42df-a2b2-7d8a01c732db", "indicator--c14aeca3-01ee-4a32-96e8-17701129f910", "indicator--9759b2e5-70b2-420c-88c5-a4c37de1d002", "indicator--bdcb8ca0-68ea-47a4-906b-b916308e2e95", "indicator--d4efe8fb-816b-4383-be73-924384a6087d", "indicator--e04bf209-27aa-4571-8c55-cbef0af759ba", "indicator--af4c4eed-90db-42cc-a204-a488d710367d", "indicator--a850b1df-ffe0-4241-b484-3e59004612af", "indicator--e4497b02-41d7-44ef-bfdf-aca184e032bf", "indicator--79d9efcf-0345-4209-857d-d2ac97171f9c", "indicator--200103b1-4440-4251-a432-09c990f51ad9", "indicator--a09b9e48-262e-47e9-96bb-eef27a874ffc", "indicator--6ba2d673-abde-45de-9ff5-a407e4fc2ca1", "indicator--d88166ea-9671-4903-a79b-d6a850fd9072", "indicator--801f1111-0f78-499b-bca9-d223f36d5dd5", "indicator--5dd3dd55-9afc-43bd-a733-cfa8efeef569", "indicator--5854c7e6-2e9f-4a49-a3b9-3b2207ac2408", "indicator--83706095-bdb5-433c-a976-ce39d4b14cdb", "indicator--0199a7bd-e483-4f1c-a308-881bc73a7761", "indicator--6617cd42-57a2-4424-8ddc-7a8c12ef9aa6", "indicator--ec882a46-3dfb-4084-995d-94b6f6034f16", "indicator--f1ae4a3a-f686-4152-a75c-8eee4351607a", "indicator--30bff008-e025-4c7b-b66b-e16d22540a8a", "indicator--117eb48c-40f1-4707-8940-fa3694281540", "indicator--ae6ab838-ece2-4029-b1fe-fc556abcee25", "indicator--3a1a6b62-1f4a-4e2c-98c6-4a924f017b01", "indicator--4b8411ed-b3c7-4fe2-92ac-0740ce5c2dfa", "indicator--626553f4-f957-4283-9c64-8c39b2bfa9cf", "indicator--b2b95a8f-e788-468d-8c05-8a0e5d0deca8", "indicator--7e208d25-08fd-4dfc-8ce2-3b6f1be0a5b6", "indicator--f5d7853a-d6ce-4235-af43-950bf84a0c8c", "indicator--9c8cc9aa-5f38-4671-8551-5c7498954b61", "indicator--e2d0a2a8-92a2-4af4-9d7f-a9217686c4bf", "indicator--e76d48d5-9e00-46e6-ac1c-3ae87772b478", "indicator--2445b8ab-acf8-4531-8bd2-64c88a2fed84", "indicator--c48793ae-535e-4b65-a5fb-d004f1e8409f", "indicator--803498d7-a956-41ee-8b98-053ba32e9e48", "indicator--f0be57f5-c188-46ee-bb5a-b107cc6f4803", "indicator--f16c4114-542e-4654-8ee2-35c1397df6b1", "indicator--194276b6-941b-4bf5-967e-266e2ac92eb0", "indicator--5360f612-24de-40cf-a1fb-d68e127a2785", "indicator--c85cc2e9-eaa6-4c80-b310-09f046466e99", "indicator--546e6c28-0b5f-4c1b-bfaa-4a1c364d1d2c", "indicator--49723266-bd17-422c-ab0b-57315f118945", "indicator--ad022315-e4d4-4596-bf15-3b7af27862b3", "indicator--c56b4342-1f43-4a85-a3da-420f677452f1", "indicator--627c917a-cecd-415e-85b5-93d3001a6539", "indicator--321537ee-3626-4c18-ba14-c3800449c5d3", "indicator--0bcf8659-4e9c-4792-a8b2-0e185cf2a0b4", "indicator--b743f72b-142a-451c-b725-96f5b97fc841", "indicator--24c35ac0-c8da-43dd-b128-420cf7c1326b", "indicator--09064eef-80d9-41e1-b2c0-c3017371f134", "indicator--46f8037f-cc3d-47c7-a1d2-e7eefe025494", "indicator--17bb65d2-55b0-4715-99d1-08634a475eff", "indicator--d8a75a68-1f44-4025-9ff7-e2d2a5176388", "indicator--3ddde2af-e820-4d76-9e0b-eda5f5442c2d", "indicator--335f7703-ac3b-4649-b732-bc9b01802b0b", "indicator--1e6d75a3-2eba-4204-ac12-bbfc30c81643", "indicator--420ca600-87ff-4b02-a353-f54f5fa16b0b", "indicator--05d46561-1bf1-4912-9f7d-6c62e6ba05fd", "indicator--7d6ad229-f5a4-42de-a71e-97cf5125f597", "indicator--6309293e-cfb3-46ff-8ef7-cad5f162930f", "indicator--7dfc869f-6dc7-43de-9012-d6a7834e4319", "indicator--fa5f555a-2502-491b-8fdf-82091ea5aace", "indicator--0dcf3098-b315-4506-94da-ef869b76cd7f", "indicator--e473427c-6e91-4c97-bfdb-f5b712c8bde2", "indicator--d774c778-d13d-462e-baf8-da189651848e", "indicator--6073698f-b777-457d-b178-2dc57f82d00c", "indicator--e2835e94-436f-4e15-a10c-3101323dcec3", "indicator--0235d4c6-7525-4aa5-b439-fd609a77d032", "indicator--0921c82b-7968-4bcd-baf4-e61daae4dd4e", "indicator--cd07dfe0-d60b-4f26-a73a-98c9c7c81a29", "indicator--ff48fe7d-eaa0-45ef-878f-62c8cc8bdbe1", "indicator--7dab5c5c-cf0b-4c38-82f0-0790a5b6d90b", "indicator--cd4252f3-3ae3-49f3-985b-a1a5f954a285", "indicator--1983c679-31d8-441e-9f0b-1f56fd6c279d", "indicator--e2d12b13-7c58-410e-ae4a-3b1de564bb6e", "indicator--8a971af3-34cf-463a-9354-29fc15768094", "indicator--79c1430b-a07e-410e-a562-6043f2604c89", "indicator--1c16d3b5-fcb9-4e86-9575-dadfa4f98695", "indicator--eee05416-5026-4107-9b98-fb648ae52f20", "indicator--1ce87dc6-8f89-43a1-b2be-d15dce27de69", "indicator--dc656ef8-eb48-44b6-a5bd-4302867e1c54", "indicator--1d01ad5b-578c-4672-b892-fe024303a7aa", "indicator--ddec8c48-aca2-4f98-bcb2-c18b3fbaa331", "indicator--145f3a54-b00c-4963-8387-d930d992d6eb", "indicator--7621a54d-5f29-4c97-9666-9f76dbea91a7", "indicator--d3b52681-af83-4b18-81a3-5c3629639a13", "indicator--66f65444-54cb-4a70-899d-0aa4b69e2a6c", "indicator--39441429-ec10-42c2-96f0-2b6d47d95393", "indicator--bee9d18f-357d-4d18-9138-ae4963217b6e", "indicator--36a779b8-7ed3-4e5c-bd34-7317b4b908fc", "indicator--1c7a6bc8-b643-46bc-a368-cd34ae72676b", "indicator--5f7e8c27-0321-4c5f-8053-dce5db080ded", "indicator--601e35a1-1470-4124-a176-3862a8a57e9d", "indicator--9aa767c5-e3f5-47da-9ea0-a799fee19968", "indicator--0f557240-59a7-477b-bb94-482a9b8d5038", "indicator--7a675dab-208d-4bd3-a3b9-8fa296794302", "indicator--d84d65b9-4f20-45d5-9975-f8a478d637be", "indicator--60dc31c7-5bab-4006-90fc-dc7d7232baae", "indicator--78e469ea-02d4-4ace-b493-b0a27d8b7b36", "indicator--a150c832-2580-47e2-81fd-4e202762ca16", "indicator--748e82d6-ef1a-419d-92cf-2097688a911f", "indicator--420445db-17da-4277-b4cf-cfeace3e9245", "indicator--2169f309-bc3f-488c-a71c-7f07549ed9e0", "indicator--0637cc92-6804-4d1e-ad92-2c12f485e590", "indicator--986bb811-6695-457e-a44d-b433652ad9c9", "indicator--501cb32f-fee1-41ce-9273-83798bfa8bc7", "indicator--e5cb9df7-3f5a-4dea-956b-9c0738849f2e", "indicator--e488f700-8c95-4bd0-9675-3c09a94a7494", "indicator--270c72e9-5f0f-47ec-a4a2-200576e138c4", "indicator--56add024-a045-44e8-8ef9-5fdfe820e911", "indicator--aa7f9d4a-9c94-49e2-8ba8-64d66338ee58", "indicator--c3f21b19-6072-47ea-ab7d-12a2df3fce7e", "indicator--878a749c-34ab-44a5-b975-5a41277fd097", "indicator--449a41ce-f6b9-47c7-b485-122bf560fa95", "indicator--be1f65cb-0480-48e3-a39d-39ec86339e8d", "indicator--98bb4c03-9588-46d5-b8fe-f58614f838e8", "indicator--469127ff-f60f-4173-a3c3-6bc628f8e880", "indicator--eabc9d31-7615-4253-80eb-7766dcf21d16", "indicator--5c257884-97b2-4510-9b76-9438b1a448f0", "indicator--49dff621-4ad7-410d-845a-8d681f3c9c4e", "indicator--04bf83fd-29e4-445f-9962-927867976dcf", "indicator--d589a1dd-c66d-4763-890d-b0257b334be6", "indicator--31583631-cca3-4346-a81e-20ea9b24d4f2", "indicator--f20521ec-a149-4486-952f-362a4143d354", "indicator--c36ba4b9-ad71-4519-93b9-b9bfc7ae4ed1", "indicator--abb1db1a-3cf9-4eee-8b2d-5117aeee9739", "indicator--489a83d3-d34e-4d48-bcdb-a934266b8edc", "indicator--91f3c1cb-4dbf-4f91-99e0-348abd73c07e", "indicator--2976c4c5-21b4-4f5d-b03e-b8fce7db046b", "indicator--498d46ef-a921-4136-b5ae-63f24d802b89", "indicator--6a723b21-4346-4d9a-bf6f-85a2b695a41c", "indicator--164c9b55-0310-4dd0-8d12-571e8c5fd200", "indicator--848883d1-638f-4bb2-947b-d368b5cafb9e", "indicator--1b9f2dfa-33eb-4041-9b97-9ef489e551ee", "indicator--d3d33644-52bd-4516-9835-4e233ea3ec90", "indicator--d61951c3-dd91-49bf-b6c9-e8756236d459", "indicator--0ebebcb7-1e90-413f-84ae-b800adba1eb0", "indicator--cf01918d-ab56-48c9-9052-1c01a645e6c0", "indicator--48544d44-1d16-4c7e-84d1-2f63148e9f29", "indicator--398224f4-1169-4fd4-a366-f0329f41d15c", "indicator--191e0426-d7ba-4658-b5d2-777571dfe5d9", "indicator--44b160dd-9b51-4b9d-9531-60d4cb5abc74", "indicator--a3c91e22-a546-430e-89aa-ac69d02be431", "indicator--3bc44ce8-8b3a-45e1-9f2d-b089a5af981a", "indicator--8e50de29-b236-4337-83d4-d6ed9901fbe1", "indicator--87796538-9b7c-4538-99da-764863342aae", "indicator--81372f9e-cb4c-45a0-87ab-2039a24e6f63", "indicator--1d70aaa1-80e7-4e31-a07b-b9f27e3f19e4", "indicator--4542b4f5-5484-4bf5-8a45-2b08774fa52d", "indicator--29454500-f37e-47c4-88fa-e8923566a39b", "indicator--df4fe50f-9c74-4616-9aad-d33dcd2b2fb3", "indicator--63a45fb6-0919-4de8-b8bb-3f963a177eb8", "indicator--ad5e49e8-a40a-46d2-a384-9537b1041bf4", "indicator--e0b07896-61e3-4e53-9e38-3a10a7d7b034", "indicator--22d20bcd-d79b-4b69-a747-de7329c26798", "indicator--0911f2cc-6e42-43c3-9231-3484b15fb28d", "indicator--df67e865-60ed-4223-b47c-387c82a51f1e", "indicator--8c5549c7-4ac1-4717-91c3-cb8aba5d5d90", "indicator--1940e92c-e5e1-4567-a73b-cb5d3649b943", "indicator--784663c6-71ba-4aff-953f-7c3dde97c0f0", "indicator--343024e2-5c48-4768-9b4d-10e156db4b91", "indicator--76193116-98ac-4a0d-aeaa-25a449712fc1", "indicator--5672ea0f-060f-4f6f-af4b-6e3c75d86b28", "indicator--5dd7bac8-35b5-4d37-9314-c90cffa6bf8d", "indicator--a4b194ae-47d0-477b-8e45-7bb77b33a41e", "indicator--549b84d9-d9a6-4409-9ae4-d0a4effa6be5", "indicator--8cb890e1-7b97-42a6-8352-fe9e22abd6c4", "indicator--6c0f6e59-0cd5-4e93-9c3c-ccb0be80d055", "indicator--fafdefbd-6ca1-4dc0-836f-aa1603970c18", "indicator--419cc008-f865-46db-9716-ea3670447b8c", "indicator--d14dbef6-6671-4b74-9434-0142aec5a5de", "indicator--649312eb-aff7-4c76-86d8-38cb5ea990f6", "indicator--c49bd00c-b69f-47f4-b77e-6829b0e60bd4", "indicator--5c67cf65-62a9-4df5-a332-75e1ecff981b", "indicator--487fc478-1a84-4553-aac4-1e45974fb296", "indicator--72293a9c-dfc8-4dc8-94ce-4fab59f621d0", "indicator--ed391d1b-161c-4109-aab1-8d0d22ffed40", "indicator--0b9c44ee-12d0-476c-b748-3675c2b119c7", "indicator--55210777-7993-438e-b845-e71c9a3823b7", "indicator--3666a915-af12-4af3-aac1-e8c3d502d054", "indicator--55c4fe8f-60ee-4f1f-a1ce-01d448ae72d4", "indicator--899e5e98-3793-43f4-9d08-865cc65988ab", "indicator--5a982817-552c-4141-badc-f61d101ced1d", "indicator--a1a453fb-5f3c-4fd1-a93c-4bbb965ad502", "indicator--1f9b1374-efbd-46b2-ac1f-0cb5de456b96", "indicator--8a0f5ef6-b183-467c-8d8a-d2ed28c09291", "indicator--90afec86-b3b8-416e-9f68-3781c5c3c8d8", "indicator--f7917ec9-9821-4e11-a60a-495f8998afdc", "indicator--bd5fdbbf-4adc-449b-96a5-4a1260f85ad8", "indicator--fd83e7c7-b736-4ed2-9c1f-e91851f2b8d8", "indicator--97cfb3c3-e138-46bf-bd46-430579d59d7d", "indicator--8163b1eb-f23f-41a7-8d38-242cbb4e89a0", "indicator--d9fef810-23a4-4a21-ba17-a472e674450f", "indicator--f4efd50b-74e5-4e41-a8d2-2d341490b62d", "indicator--26cd429e-bf05-4a9b-91a1-e37aba7ed3c4", "indicator--09664ab7-e062-4060-a688-671b33e3ec26", "indicator--7b6a2aba-031c-4e02-ab44-303a39ae6e25", "indicator--2d25763e-9c00-4184-96d0-a1380c5ab86a", "indicator--8110ad7f-0320-47f9-ba45-15b6980864ce", "indicator--8098432e-9ebb-49cd-a21f-17d01f0ad877", "indicator--69bed565-5154-48c7-91d2-2d2ed634ca2e", "indicator--fd3aac12-5e5e-4c4a-8a12-7540aeb1eeda", "indicator--2f8be3bd-90b2-4092-9611-5f6c19307b71", "indicator--c5fc14e1-a23d-4a98-82eb-cd22962a0a38", "indicator--1b955c39-1a44-41b4-ad0e-7982c73225c3", "indicator--418faa3e-6ddc-4582-8962-cda70de96d3b", "indicator--d93dac2c-6c62-479c-99e1-5fcb77505695", "indicator--fd4b48a8-ff17-4e4d-bf5f-033b8520dfbb", "indicator--d3e2a295-5656-4439-aa42-74eb51f3935d", "indicator--3ab458e5-d755-46e1-9e50-6a92382ba1a9", "indicator--d3af9a90-8c9c-46d9-8abe-67d4a5b40a96", "indicator--b5ac2137-e1e1-44dc-9eb4-530e4e4b22e8", "indicator--ec85f6ce-ee65-4127-a015-5a750d21c2eb", "indicator--c14b27f2-2908-4aa1-884b-907967149c1a", "indicator--e9465887-90a1-42e1-8693-48e4e12e3f47", "indicator--2b3228fd-4e8d-4d05-ab08-ec669f78303f", "indicator--70df7367-5035-4931-b22b-6c6ad37880d3", "indicator--039d1066-5111-4634-be07-e6fdcc7a11d1", "indicator--d26398dc-2982-4a8b-a54a-fca8ff79a0e1", "indicator--878e4e1a-e02e-4916-ac0c-d8193b2e3bd0", "indicator--61b2e17e-abd3-4247-b4db-9a81d59503b2", "indicator--2f229372-8863-4717-8ea1-c3da456b0c8a", "indicator--414449d8-a69a-436b-81a5-9c8f4318b530", "indicator--d53e69d5-f88f-47c2-951b-0c23297e6f76", "indicator--181a8c94-8496-4977-abfa-25c7e4695a64", "indicator--1a6c7876-7b1e-479b-a747-0d56e776dfe5", "indicator--2edfeca0-2fe3-4766-b0a4-8d8aab6c560a", "indicator--5cb633ce-d389-46a5-a774-5e1647fb8642", "indicator--a2249258-41d2-4c27-9693-ba4e9493c5be", "indicator--5862124b-738a-428a-ba5e-ec104ad942a4", "indicator--d0e502a0-3124-4d23-82d6-0fff43787611", "indicator--ce610fcf-aaeb-4836-af07-049d4f92952b", "indicator--b85bc3c6-8d79-42e9-91df-8273431dc2ee", "indicator--bb5fa3b7-745c-4b14-a139-fdb5b8accffa", "indicator--e956e721-6888-4036-b338-d7140efa1668", "indicator--fe70fd37-6b7c-4058-8c7b-b7b274bcc7f8", "indicator--d02c3641-c804-45aa-88e3-7ee23df33ef3", "indicator--e143f1db-79b3-4292-bd55-319fee7126bf", "indicator--73ed7a97-d665-4bfd-96b1-3983e4415d9a", "indicator--a21b4ad9-8f0e-400b-98d2-20a60c25bcb3", "indicator--20db9d4f-6bff-49a1-85a0-e54719dbe43e", "indicator--be503dd9-fdbc-4673-bee1-e9ad551d3075", "indicator--97279753-5715-4473-8527-cf825e17739e", "indicator--9922bbdd-9ee7-4052-95eb-d160cc810b27", "indicator--d1f61d6f-edce-4c6c-8a6e-bee845597890", "indicator--8cf38f36-171b-46ae-909b-7d92c7f0afa6", "indicator--42019a44-b7fe-4031-a24d-f04981c8d53e", "indicator--0ac98f72-a303-473e-9576-773f0e7cb642", "indicator--d00ee020-09c5-444c-ab95-24d151bb06a0", "indicator--c3c802b4-4fb5-416f-a88d-b2a108332468", "indicator--bf720317-d61c-45f5-9718-016a652e05fa", "indicator--4efc83cf-795c-4dc5-80f7-788e3fa8e2da", "indicator--c11429f0-875d-45c5-ac90-6164f4fd9c5e", "indicator--db927cac-5b1d-433d-ad8c-771e9a6ce138", "indicator--56dc1633-ae91-4454-8065-b89fb93f0280", "indicator--ea5456b7-07fb-4de5-a2ad-d9b89d870bd7", "indicator--752826f7-c2ab-4776-bc8e-494600c74c02", "indicator--3f336881-9801-4199-8fc7-a7ff905701fc", "indicator--a35edf25-7523-45ea-8825-1d0e01aee0cb", "indicator--e0889847-79bd-47d8-b48a-77a7f2747ebd", "indicator--3af73183-7a9e-4a9d-b11c-4860453bd6eb", "indicator--890473ba-2d52-4fd9-b3f3-4966405948c4", "indicator--85860f05-6b86-4802-8d59-d0f9de5ed14c", "indicator--b827d66e-d2ae-49fe-9d2b-0433573e3e21", "indicator--6332f26a-e270-4c85-bb7e-853896c5a4be", "indicator--4736f0ea-94be-409f-b282-9d568e774ab6", "indicator--2e2ef141-18f1-4b2d-97a4-862adb90dfbd", "indicator--f0268541-8caa-4f2d-88ba-ae8800391451", "indicator--fc1d03de-c592-4480-a02f-8f37d121ba4d", "indicator--4380609d-0fc1-4169-a033-dca8ed747747", "indicator--b26628ad-6f9a-4a9c-9337-7576c089c428", "indicator--67a23c07-5cb1-40f8-8cde-d1defd6e2f0c", "indicator--75aa1317-ab2c-4214-a377-1e4a176246dc", "indicator--cfd5bb72-afe0-4563-88b8-997a190d203b", "indicator--9b55d45e-2eae-42e1-b1c3-48c7d29618f0", "indicator--71b64e68-e8a8-4b6b-8ebe-a513c4f17009", "indicator--ba1ed420-37e9-4759-b677-20a101800d3a", "indicator--d12c05dc-9719-41f4-b341-e105f37dc240", "indicator--fc5a4fc8-7441-4869-be87-6e601f9a4fd3", "indicator--e3fcc2c9-a835-40c1-8ab6-8daba352846f", "indicator--038f1abc-3186-4b39-ac48-ef714ce093d1", "indicator--fb04c034-4fea-4138-927e-bacc03ce1dd0", "indicator--15d18742-e1f7-4b19-917a-50e2d90517fa", "indicator--fd870f4e-6d18-4dab-8255-37c355c4e844", "indicator--563769c3-56a5-4039-9389-d045fe28cd4b", "indicator--2d3f2a3c-69f4-4720-848c-e27642d31f35", "indicator--54c0f1e5-0c48-4720-852c-71fb14cf0798", "indicator--e8e43f94-dbed-4335-868e-85f8718cf06f", "indicator--bb693595-03ae-4404-9a99-81d29f73b277", "indicator--4358f74b-fabf-442a-91bc-377437c90dbc", "indicator--6c21ce0f-03b2-4fd1-92c8-0004fb89d5f8", "indicator--8a3a9c76-738a-45e0-a0dc-17373f3f00c8", "indicator--85faed5b-8902-48dd-86e1-4ab1117ad1ea", "indicator--2e7e28e9-119f-4d90-9306-b6cf949c01b4", "indicator--c0f4f482-de2a-4d3a-a17e-ce39cdcc31ef", "indicator--7c95a6e6-e960-4bdf-aea2-0ccea3b4fb7d", "indicator--8c3e3524-05d7-466a-a7bb-57f4f40c3bb3", "indicator--50e14298-3c10-463c-a637-592c19aaffa3", "indicator--93c66aa0-9d72-4199-b8de-c3e58279222a", "indicator--3148babc-9ba5-48b0-8cc0-b652cfd443b2", "indicator--67f355df-7858-4375-8313-f577fd3ec76f", "indicator--e3080dad-129e-45ac-960f-ff0c6cebcedf", "indicator--8bbbf634-04eb-4f94-9532-8232684f0f86", "indicator--354b80bc-68b3-4519-932e-ad3bd6f79b5a", "indicator--17a43ee5-2f73-46cb-a942-b5ce46393aa4", "indicator--682aee18-1e7b-49c9-8be0-f934c675f748", "indicator--bfa5fad3-8da7-4d3b-b0e7-770d7465d81d", "indicator--29393a10-3ab4-423c-a5aa-d842fd809df2", "indicator--cacc8a2f-8f80-44a0-bae4-04697ce90abb", "indicator--18925182-014b-4788-81d7-238f47e9a7fb", "indicator--c2a7dfa8-85b1-4ff3-a2eb-219ea71a3a06", "indicator--9b7a4ebf-8b54-4728-8105-586b229977be", "indicator--8c973f1a-c617-4663-bf3d-1b2ee227ded3", "indicator--b7ad4a75-196b-4b46-80e7-2a4877340159", "indicator--64d2ef5e-a115-44be-8d75-a4b01640daa7", "indicator--086b5f8c-2c5f-4abd-b654-a6fa8ddeaccb", "indicator--f230bcec-2525-432d-a9b3-ba97d4d8f144", "indicator--f092b488-c002-43a1-b097-72acd7907bf7", "indicator--06eda3f1-3627-4b84-b82e-e37e71495a19", "indicator--d411c065-5753-405a-8134-636f167637e1", "indicator--3cafdd26-9322-467e-8221-5f824a476be1", "indicator--3dd67204-f827-47a8-a656-ddc5df2431be", "indicator--214cd5ef-815d-4c33-a030-1276b828e12e", "indicator--7858dd70-a217-416a-83bc-2f8399f0d1a1", "indicator--3a820039-f794-4972-b105-17641f612b65", "indicator--beabdcf3-126a-476a-854c-eade68a7c514", "indicator--4279ec2a-fcf5-46ae-bfcc-f1ae7fbcb0f2", "indicator--bc36b28d-a23e-443b-84f6-6eefbf927ffe", "indicator--77e358ef-abd6-467d-93c4-06b3cff16a56", "indicator--9c9cf4ac-5630-4b0d-8a4e-67600258dacb", "indicator--7c67e40c-69ee-464b-ad8a-d6600c0d0094", "indicator--3df28a72-32cf-458f-830c-1ceb5e844f00", "indicator--d6b93894-9cd3-4d69-9b99-1a8899531549", "indicator--fa0e621e-ab74-4d70-8de7-478641269f97", "indicator--8e743de4-52cb-4975-b655-f335522e9cb4", "indicator--7b6dd904-c684-497e-9675-c3c4cf756afe", "indicator--6a18b69f-a945-4f2d-a177-7218203f4929", "indicator--9d7651c9-ee61-46cd-a956-3a82939e0681", "indicator--2ea9783c-a36e-401b-bc21-c9b2e01ab021", "indicator--0fda0abb-8384-4b4d-ace0-d45d547668b0", "indicator--dd7b16a7-400d-4748-af8a-0d62e276ad7b", "indicator--e27e0a73-5727-473e-a0f1-ae23e4569e30", "indicator--5ae3c440-7bd8-48ef-bae8-de9284c15d28", "indicator--ffe1949e-053c-4eb8-ac28-eca3061addb2", "indicator--e2754f26-26e6-4ddb-a322-fcc7ae3f1194", "indicator--c7c82d3d-67d4-48c5-aa73-c7b1d34f8500", "indicator--86448ba0-4c51-45c4-99da-c9b2ca5c2a20", "indicator--285e3371-d53a-4dc4-a67d-9423d720788b", "indicator--298e5b02-6015-445b-8b9d-dd093731ad25", "indicator--a38c8518-3a97-44db-b903-3ccdfc3a2f81", "indicator--57ad744a-be12-4ec5-8e9a-aaf57e7b964c", "indicator--6832083a-a930-4489-ad66-251052864571", "indicator--25d0c35f-f32b-44cb-84e2-ab133fbacc80", "indicator--a29e0c45-39b5-4768-9a7c-d99bc8dcaeba", "indicator--d2edc996-4ae9-4eea-9ea5-c7eba1769d3a", "indicator--3eac8c02-2510-43c0-b6a0-9eb14fdaeba2", "indicator--7edc5803-e401-453d-89f2-6f9f4e268418", "indicator--ec4a358f-45e6-4606-a46e-1a29ed2bc8c6", "indicator--787d4ddc-23f8-42ad-9c72-3431610f4d75", "indicator--8a3af7ec-cd77-40b4-a37c-8084f232879e", "indicator--0ec41b74-f30e-4cc2-b73f-6dcb58496b3c", "indicator--1559635a-dc25-46d6-aed5-56171419934d", "indicator--8d6fac90-ff42-4bef-b34a-cc9c7a564f48", "indicator--71c13762-f825-4731-8c74-338e13a0b98b", "indicator--d338db42-0d20-421f-8abf-cbe82578c7d2", "indicator--8b5fbc84-4fca-46f3-a312-e59e7759892a", "indicator--0b936878-5223-41e0-be9f-d2adcde0d149", "indicator--dc462890-eef5-414a-a0d7-bfe7dba96a67", "indicator--06dabe4c-63ed-4d64-9614-d872ee84b946", "indicator--6cc2917d-1a32-4286-a02a-55aa80256e66", "indicator--3bb79dae-8231-4aec-98b8-bebc99d45a2d", "indicator--eabc186c-31f6-4bca-a572-453e5ea75c0c", "indicator--f6772085-108d-49ce-a0ad-736253c4a2ba", "indicator--81d4cc39-ef42-4262-ba35-e7cc296fe51f", "indicator--fbb0ece8-5c6b-463d-9c84-0f41677c5fd0", "indicator--550b3d11-be12-40a5-8474-927938964c51", "indicator--aa2015b5-13f5-4e84-8264-e83285ac3c0b", "indicator--0a39db4d-d29e-4494-8145-2e2497c038a9", "indicator--221ce64e-fba0-473d-b701-d1aa56d30e33", "indicator--31f3797f-ebc9-49b9-86f3-37b57416ccb7", "indicator--68948618-b40f-42ca-9444-c5e4160a7f4d", "indicator--562df0ef-4404-437d-9ab9-87c933db3ac6", "indicator--7d961c1e-e155-439e-b72f-3c61ddea85a0", "indicator--44f56b19-1b5a-40b6-84da-b19718e3188d", "indicator--f1f6c69d-78cc-455f-8e48-acaa077bb9b7", "indicator--4da261d2-16e5-482e-be53-04181d11c75b", "indicator--43d09c39-8635-4105-9112-28407ba4eb05", "indicator--a3bf9211-69c6-43b6-854c-4cc2fda7fc68", "indicator--4f645593-d22c-46c3-a34a-e8d280a0e52c", "indicator--216d08ee-eb21-4756-be4e-53bcf33d5f44", "indicator--9c3f9799-7571-4a45-9935-d398b42c870d", "indicator--f5efb850-de5f-4b8b-ba2b-1d234e483c70", "indicator--e6f6a402-861b-4844-bf74-5883d94b917e", "indicator--1be5c0a6-782f-49cc-86b2-a054ee6e79fa", "indicator--9f246846-5e13-46b1-af7f-120eb9fd36f6", "indicator--5c83f320-f352-409a-9f68-cf7edad06ad0", "indicator--e45d37a7-af00-4c1b-b310-80bcfdab30ef", "indicator--b0b3fc72-17a8-4ebe-8fa2-3f5912912f8f", "indicator--9578d3d8-1713-45ab-a916-150ab03b018f", "indicator--98067a88-dee6-4d5c-b33e-6c2edf477c5c", "indicator--6edc138a-6d9d-4f76-8446-e0b94ce23653", "indicator--843724b3-4495-48ed-a032-85264ed36f1d", "indicator--aeee4d98-f364-4533-bd9d-2a18cf4f6afe", "indicator--87509892-34c1-4ffb-a439-a1a3a4189273", "indicator--599014d4-3bf2-4955-abbe-c1ecdc42a78d", "indicator--0c79cf81-a3e7-4600-99c5-8df3ae3829a4", "indicator--1bbe2416-348d-4f55-b494-17c4bae991ff", "indicator--9608e6ca-99ee-4e26-bc0f-0514d1977a66", "indicator--133a4732-6382-4c52-8eec-daeb85214f18", "indicator--4dcd6c52-3661-423e-a89c-14400b48e98f", "indicator--0a276c58-cb93-49cb-a2fb-d0517d8fc268", "indicator--751a9ec5-b8a6-4cf1-9117-94050dc8426e", "indicator--eb327247-f249-49a4-be24-fa1f87af2e72", "indicator--77d4d017-cb9b-4b0c-b109-11e278ad1746", "indicator--3fcb257a-e7e1-42ea-97d4-ea9c017f87bc", "indicator--60743b1c-2daf-42c6-960a-fad218b61374", "indicator--2d4b3343-a8a9-460d-aa31-e2877305c039", "indicator--d23b001a-de18-4849-99f6-1cb179ea2b05", "indicator--1baa4622-e27a-4967-8bcc-dc491f0846ad", "indicator--9fff9f05-f788-461a-8479-c4bad7dba49f", "indicator--41a6aed0-e5e9-413c-a0ec-3c725e246257", "indicator--53af09eb-f358-4094-a358-3d3518ad7e45", "indicator--cd7bc2e8-012f-4f11-bc03-228088afe857", "indicator--3219143b-f1a7-42e7-8593-d3c36e582c64", "indicator--03804aaa-ced7-4b7f-bf91-0b0242eac4f5", "indicator--bfbcf3bf-d7b8-49bc-af2f-2dcec66125f0", "indicator--24861f7e-1064-4e8f-9b30-b205b5d487b5", "indicator--f23138d0-14d5-43f1-91b8-62db7e40c8ff", "indicator--02e1afe3-b314-4eea-99d5-2498f25c1e6e", "indicator--d999080b-9faa-4466-8bc5-315dee3855bc", "indicator--b1cd438a-7921-4127-8a1e-8e0d7f1ea9d1", "indicator--0e4d45ab-6a3e-4016-9f89-b47713712978", "indicator--513dbedc-b6e1-4845-9e6f-7a4a87fdbb06", "indicator--3c8bc7e0-0f35-45fb-b280-0f5f46c63ff1", "indicator--54d03eed-b264-47f4-9aac-28ef18b4ddf0", "indicator--9b96617f-586f-4fc4-9bb1-3afb569f87a3", "indicator--50ce88c1-7ad1-474b-b979-628e3fd2fee0", "indicator--523e80ae-f55e-4e41-b47b-8035ec2779e9", "indicator--e89e8dd9-6c10-4834-8026-52460fdc3648", "indicator--cf9c9e15-a5b4-4ea4-8bad-2aeb0d8848fe", "indicator--d896ee8a-459b-4d32-9d9d-544af824ad61", "indicator--70ac8a77-ec9e-4222-b578-757a8da7f27e", "indicator--ab84d0fb-74dc-4a2b-b4a5-fa326bbbf872", "indicator--7c6bc834-c11c-45fa-9c20-1f2bd565df54", "indicator--b5646e29-fed7-4bbf-b686-3ed8d50618f5", "indicator--7e61cd78-293e-4c1c-88cb-59f47797b8d8", "indicator--41955835-d4d7-48c7-bbd0-297a9d4af93a", "indicator--fa798d67-ec63-42b1-8753-4ee0d9dae04f", "indicator--ae5bd777-fcd3-48a9-8ee3-09f0cf113fb3", "indicator--40fc361c-3e91-4f2d-b65a-5d007b321ee9", "indicator--0e33402a-c558-4eb5-a8ce-37a1eba49881", "indicator--e712118c-10bd-4a5f-8877-51a34e62e21e", "indicator--917274a6-9ceb-444b-9242-e39fd8e95135", "indicator--9d302d33-bace-4702-a494-95a556936632", "indicator--eab5b599-bdc1-403e-9047-cae615c5eac3", "indicator--9f6f6e60-c6bc-42ec-b8de-d61d9d3abdab", "indicator--da89f3ca-e521-493b-8b69-72fbe3aca1b7", "indicator--a7e8e67a-a16f-4ac2-8e12-01b460511b03", "indicator--31b9906b-35c2-4829-977d-a4b58f85a683", "indicator--10070b8c-10b6-4eb2-89d6-e50dc3544f2d", "indicator--754c4ee3-e7f7-40db-9929-edf7e9892c21", "indicator--d97f4556-bd8d-4fef-be43-f1aba7e5b0c0", "indicator--c66b168e-7aa4-4a7a-91a3-80a0e2b96e62", "indicator--342ef8fa-b1ab-44cc-80bb-d91bd92471fc", "indicator--c2233e6d-5060-477a-adee-77241dd902d1", "indicator--9c51de8d-05bd-455a-a33b-6467d3f20f3f", "indicator--f614eddc-8308-4e02-adaf-902937df49da", "indicator--87afb8de-de13-43bc-adbd-1985381a6b6b", "indicator--f45351d3-0972-44db-930f-fceb8b548b0e", "indicator--a6b83732-f571-4aea-8bf5-ab779b4c5964", "indicator--605a51a6-8c31-496a-8fbd-4625b0e06a14", "indicator--ffc71a2c-0e75-4554-82b3-42d5a970e744", "indicator--8f22b78b-b527-4b0f-9574-4f39b8109add", "indicator--34ca1dd3-a8cf-4e14-8193-ec240c284c4a", "indicator--d1d6dea7-b2c5-41ec-9006-9feead86a672", "indicator--9131e09d-8ee9-4f80-a1c0-bd89d6dcb147", "indicator--3c6c59e9-3bab-4590-8069-cba0179b8c73", "indicator--e9a27718-4b86-433a-9ed2-97480dfc1bce", "indicator--f6bdc915-e1a1-46f8-8908-4863990bb918", "indicator--479aca0e-b286-427a-8839-a38d99701e46", "indicator--e12dae2b-f18a-458c-a333-6ac9fec5b13a", "indicator--ad25017e-c06f-47c9-b676-34b3f87c99c3", "indicator--fd8c8808-69fd-4f4d-b65f-7bf6ed817660", "indicator--d7cba386-c8ae-47b7-a3ec-b7155eeac817", "indicator--28fe7e7d-d613-4ab2-9411-58fa38336bc2", "indicator--cff08035-5e24-4b8a-8410-ebe296f145e8", "indicator--e40d187e-3014-4701-b9af-ddbcd08aa91b", "indicator--1366f371-3d79-447b-94bb-fb71813c52fa", "indicator--01252741-717b-4c1e-963c-e716a141c177", "indicator--42b6c27b-5f4a-4006-804f-b0da711f3406", "indicator--96527b9d-3659-42dd-b2d2-c93f3ef7de0f", "indicator--65eb343a-dfa6-4420-ae6b-fef0f0302038", "indicator--e1eb5dba-15a4-408e-9ea0-bdd880d180cc", "indicator--ee436102-83b6-44ee-9646-df31143e9958", "indicator--fbe9a0e9-b548-4abc-8ce1-3ff81e9d53d2", "indicator--9aaa79b3-065d-4c79-8e10-e1fb49ed725d", "indicator--f4fcbd00-2c8d-4a1d-9738-d2ee012987e3", "indicator--fcd7afde-8a24-48da-a2d8-41ee11ae068c", "indicator--0ce2a340-3683-4c01-86ac-1e6c6910e28b", "indicator--9c022d5c-9a37-4ad1-9162-03c4ac7f42ae", "indicator--2b3166f8-9f6b-474d-a8bb-3ab91c52d739", "indicator--cd6fe63e-3e4c-435f-873e-d186471a78ef", "indicator--02d91e58-4a9b-44d4-ad5e-ca27eee6f6ae", "indicator--90e79a32-5e9f-45bd-9858-88bb5ca8c467", "indicator--96652afa-ff95-4962-ba50-12f4c240e7e6", "indicator--926e6209-aee2-472c-8a0b-9cf2d92c9671", "indicator--ec0e1ea2-4b59-4fe7-be1a-56337338456d", "indicator--f64e57bc-d564-4fe0-b3a0-4738f05b5cb7", "indicator--402d3f6c-388e-4066-80f0-58e5b29aa531", "indicator--41ede246-000d-4c2f-a1a0-4d21189d0169", "indicator--289a6f8f-ea40-4f0c-85cd-0e53a9aeee22", "indicator--031f9fb7-418f-4401-b270-482b4a755f76", "indicator--e8688b43-8ce6-4dc1-9883-5b0f096c041c", "indicator--c2eb55ce-2970-4516-b541-d281c1e640b9", "indicator--4a4920b2-7149-4d01-8136-45f9b6088017", "indicator--bd200721-03db-48e3-a5dc-0bc101a91bcc", "indicator--5f403dd2-773a-46f9-97c4-c17301214be7", "indicator--0ad78fb2-aa41-49f6-95b8-e3f3b932c661", "indicator--31af087a-f6eb-4ba5-854d-d0051fd542d1", "indicator--964aae71-af0b-438f-9066-3385de7a1726", "indicator--5c31aca8-35bc-479e-a6cb-2f30f1c78fd7", "indicator--c1037b98-ba45-4528-b24d-4a62997327bb", "indicator--f8272210-ab62-419f-ad3a-f2bd71923bd5", "indicator--775ce7b7-7024-4b91-a3e7-109b021668c1", "indicator--60a5f649-acde-4d95-9bf0-9a372887c03d", "indicator--cd33a932-ecd8-4038-87b3-fcba84366b90", "indicator--0a6cf6ce-b849-498b-b815-b1a982ae4616", "indicator--d64da7bd-76fa-4611-8a37-7434c988f23d", "indicator--054521bd-b3aa-4842-a581-934c63871e0b", "indicator--6e37d365-a2cc-4a10-b857-507dd5180bf4", "indicator--6eddd32e-ede6-49e1-807f-67ce5d8056bc", "indicator--cef46242-3644-44c7-a24c-c5c4e4bcd631", "indicator--1166822e-b3e8-4583-bf77-3ee1c3abec12", "indicator--52765507-d6e3-4ff5-bf95-76d572d2149b", "indicator--9f9f107c-6825-4dd1-97ba-4e12b942d1a2", "indicator--28aaab57-d5d9-4cc6-8888-a21f82f4a0b1", "indicator--8422205b-4ad5-4bd1-835a-e5466e6a5b63", "indicator--349c11c2-2e55-43df-b510-8e62505df2ae", "indicator--7407e673-0238-4959-8233-b71d8ae58907", "indicator--6fd480fb-c0cb-4f24-a184-0428a6e10c32", "indicator--9e8c0bb6-87d3-41a5-b7a0-c253392b7305", "indicator--d385d36e-2545-4715-998b-f522776287bb", "indicator--c59aa6c1-78ab-4338-b903-a3ee920bfa7c", "indicator--410400a9-541b-41cc-8d8a-f163bfdca8b8", "indicator--4d8f38e3-f647-44f0-a6dd-8d8e355c3829", "indicator--01066766-9441-495a-a88a-f426c28248be", "indicator--5123672e-6e62-433d-a5f5-3363a3a2a081", "indicator--397ae289-5129-44be-8b9e-5d347353cf97", "indicator--0b4d69f9-44e1-4465-a5bf-94ba9c557a74", "indicator--43949f1e-e83f-42f1-a53d-57ab939201dd", "indicator--6fd0afa1-214b-4dfe-bf14-ac7a0f310b6f", "indicator--064145ee-8cc4-49f5-9d83-8640332a4380", "indicator--f57616c8-e27f-4fda-82df-65747a694780", "indicator--1e8cbbc1-fb8e-4423-8fce-e8bb226712fb", "indicator--47327190-8cb4-4673-91b6-84c32061be6b", "indicator--93268d59-b69c-435d-82a0-fdb879bc7032", "indicator--9c02e49a-69da-4ffe-9582-6519003f237f", "indicator--5f8ef5b5-3c2f-40c6-98bd-1d435afc3f54", "indicator--6f98c9a2-9f68-43c4-a884-58dae228132a", "indicator--ace1589c-8c24-4db9-865b-d500767d191b", "indicator--e745e4f9-1126-4f4d-b85e-896eacbd3413", "indicator--ae6f1b65-6e30-475d-a3ee-d8e42b7898ae", "indicator--3535bfde-ca10-4eb8-88a3-f36c51a6f4fa", "indicator--53ca20fe-6e95-4d0a-b179-3bcafa02542a", "indicator--c034a02b-ea4e-4efb-9f68-a61d48b45fdd", "indicator--62cb9289-4c2f-4c57-b4fb-5ebb198fb7bf", "indicator--fa8cf68b-6cd7-42bd-ac3f-727febe4b5be", "indicator--faa12910-74b8-48ef-8399-ede037fd08e1", "indicator--2bed7c1c-0d1a-4948-82ee-20147b7198eb", "indicator--d8dc53e3-96ff-4e67-b605-514a226d532e", "indicator--4242518f-270f-4c35-8e43-13b9307b66a1", "indicator--14b6a5d2-6959-4745-b365-26442a3bdb7a", "indicator--549c7f65-681e-4ba4-be51-b20f6de42e87", "indicator--d7839b77-f9c8-4f11-8512-47bcb9260956", "indicator--63e6524c-f674-4571-8979-afea2cab87ef", "indicator--ea5fadf4-3777-46ad-82c1-8d200917f4bf", "indicator--2a8496c2-df16-4361-a863-e7ce33f82cd0", "indicator--b170d883-dba7-4210-a974-f3077ff3d8a2", "indicator--75580cdf-dc28-441d-9458-8faf42efbb3d", "indicator--92d2e21f-e92c-41a8-9d0e-efcb64509df0", "indicator--9368e0f3-e170-4b04-99e7-86db8af76047", "indicator--dce8fdf6-609a-4900-991c-fcc154f3c0c4", "indicator--fc8c77ec-f0e9-4ab2-bf34-c3f84e4ebec4", "indicator--22bde52f-82b4-411f-96c6-455bddbd99a6", "indicator--fab5e6b0-fc46-4d57-be41-6619ae1cd32d", "indicator--5e37c655-95bd-431a-ac31-158a9137e72a", "indicator--5d27ea0e-50e5-44cb-9f15-335ac1c88eb8", "indicator--505019a0-5c67-4951-b738-f311d3dee3c7", "indicator--aae3b8a5-48be-4813-b827-34cb903d37aa", "indicator--8e0a6700-4790-4529-9e25-e2cc3be6ede6", "indicator--f7005f96-42a6-4155-80c4-41d498c3e114", "indicator--bab758a4-a459-444b-be80-0802d5302fe2", "indicator--ebc39698-9158-4836-9d79-00e0416621f2", "indicator--19d7d394-e989-49ff-bfe0-cd45f3448fce", "indicator--ab48ad95-275d-4579-9a1c-9ee0fd2fa41b", "indicator--d3e53006-70a5-414e-88c0-f203121fc4f0", "indicator--dcee0719-368c-4afe-a226-7192800a8f60", "indicator--9dfcd3bd-ebe4-4eb8-aa36-52217f6d3016", "indicator--11b75a33-95da-4ea3-be2f-6aba6669e9ea", "indicator--e8a50f41-ce89-421d-8fe3-c7a77a3b31d7", "indicator--0aa42523-7b5e-4d4b-b194-652951932464", "indicator--2bde6a92-b639-4f34-ab3c-cf809682b379", "indicator--960338f0-0c85-44f7-b99a-e8c04f110636", "indicator--bd3bcfe2-9de6-4d0c-8077-fed935621d80", "indicator--46d32190-6407-4199-abbf-8d66109526fa", "indicator--26705b04-c2a0-4cbb-81b3-84625b8cdc41", "indicator--0c24a30a-04ea-44e7-8bc4-eed274e79915", "indicator--01ab3940-29a3-4e10-abe3-6e0b7eb32864", "indicator--c201762a-e6c1-491b-bf0e-e8ad081f1e49", "indicator--9d12da18-529a-4f3f-a281-2ad637a27fb7", "indicator--b71ea942-a743-412f-95b6-e6cd51f0d0e3", "indicator--b6efbcc9-348b-40e3-9b1b-7d030ba4c831", "indicator--bbe41ba0-650c-4d7a-baab-5f7ffa355c8e", "indicator--15379822-4cf7-4e82-8c88-9e133d89233e", "indicator--605024d6-d189-4feb-9bc6-084ff126286f", "indicator--ee4fe639-6274-482c-b97d-7acfeadf0e1b", "indicator--33a9ba37-0a53-4c6c-8589-70faf491f757", "indicator--2cb8cdfc-f32c-44b0-96f3-920b107afab8", "indicator--fde86eda-5eef-4f60-90b5-a14a3b0abf7a", "indicator--a0f51291-b324-453d-a157-005d3aa2a223", "indicator--35fbed7b-a11c-4346-bffe-11a609c0aeba", "indicator--fa9663b7-55cc-4243-a25c-659ec0a99083", "indicator--f511dbfa-300b-4352-be92-56aa2f3561b5", "indicator--b8737379-9f0d-4035-bdee-f82f4e072baf", "indicator--175b58f8-1399-438e-9854-93ef247fbfa0", "indicator--1d569b77-e74b-41e0-b64e-8f788beac866", "indicator--40f9ea67-4589-424e-a10b-46c3ce0f935e", "indicator--003ca04b-4ca3-48eb-9bbf-e9dedfca9cd3", "indicator--334603dd-0ac8-4960-9df2-cfacc1626593", "indicator--4085b931-ded2-4cb2-848e-cb64f9fdc122", "indicator--c7935f35-543c-4361-9f2a-fea09a523c8c", "indicator--2c2bb150-b37f-4265-bfe0-a298588a5050", "indicator--932c2131-bc77-4460-8aaf-3d38dbf58a3d", "indicator--3fe13186-1f4a-4084-a150-b4f0474d9a1c", "indicator--ed486cb0-5644-4d12-bfa6-dd0be4f5370c", "indicator--e6032dad-f8ad-4423-b04a-d4a92ece6e97", "indicator--792ca16b-eacb-43ab-acae-24d2a281a065", "indicator--4028f6df-1e69-4709-8aad-0f84abe9084c", "indicator--d22cd954-0e61-458e-b550-4ee52206d033", "indicator--c2edcef4-f61d-495a-a0f8-a825df27dffb", "indicator--e5bcb9e7-0000-43f5-bf59-936303d098e2", "indicator--e79a4335-b3a6-44bb-bd26-c2837fd0a72f", "indicator--d699376b-70b1-47ae-9437-c26bf0c2ea65", "indicator--75c4dac7-6224-4f81-ae33-05cb1bc4aa7e", "indicator--f93292c4-10c2-4c32-bb71-970e7586c391", "indicator--b99e20c6-7b22-431b-9688-00e3b44c39fb", "indicator--69d5d090-733c-4b2a-bf03-6ef01510c469", "indicator--eb33dead-ffd8-467f-a2cf-31c562c595e1", "indicator--baf864cb-0b18-4431-a164-4992513fd65a", "indicator--250dfec1-8184-45be-8f12-edd216b41d9b", "indicator--82c69b19-41ba-4d10-9f5d-bce7af7afc01", "indicator--1abad4a3-9821-4504-b5aa-b360241eb418", "indicator--7b62995a-5dbb-4b31-8387-123b32573fac", "indicator--5c63123a-8cef-4054-87c6-0df7299f5853", "indicator--2657711e-6fae-4529-8e45-809ef7604070", "indicator--8fef8e12-1a8d-4dc9-b77c-5816ea9dd303", "indicator--43852372-dd56-4998-8598-39173734da1c", "indicator--9601a649-e67a-419f-8f8c-ea024d03604d", "indicator--ec5f682f-5d6c-4da1-8fd5-1f0c8f2631b4", "indicator--2d23824f-426f-4729-a509-5978d0401e62", "indicator--5b8da7ac-ee83-4bec-a14d-fda5034548e8", "indicator--4c25236c-6c52-4dac-b40e-49f02d7e9a7c", "indicator--93d6fa1d-0437-4cf4-8b25-048f7b29e7bc", "indicator--ec0a31bc-ea56-4b50-8cc1-c0c2355d82ba", "indicator--4f6bf485-a201-4b98-88cb-071be261b954", "indicator--84de227f-b4ea-40ce-9a29-a20352228649", "indicator--b293ac06-9c82-4c82-b41d-9070efecb6b7", "indicator--486333f8-b4e2-4bba-b59a-d0c04cb0b8dd", "indicator--9894006d-f82b-480e-a6bb-a5a8ea2a4d7a", "indicator--ae132c25-b7dc-4834-b091-872478f585db", "indicator--5061f1d1-a6ed-436c-9f11-421fbc4561ed", "indicator--56b21b0c-ce21-44a2-8f7b-1b88c6d72c4d", "indicator--9573fbda-5207-4d27-aea9-902ade9a7da8", "indicator--96a081ad-7e07-4e5c-a9c0-b7507656f848", "indicator--3cb2a02a-3566-4542-98b4-86356d50f722", "indicator--98265bf9-8501-4248-979e-406b2ec6efe9", "indicator--5b03339a-7b8a-4cf5-9630-fce15a99cc14", "indicator--13762076-d0c6-463c-a0f8-241b1bd9b0ed", "indicator--3d85bbc0-4987-4b2d-803a-93d1ca519ac6", "indicator--237b9732-7132-4d75-b94a-2d02fa076d4f", "indicator--40417205-9825-4564-955f-dd968b764f76", "indicator--3069b211-c3cf-4e47-8c38-e852e96eefcc", "indicator--bd5f2dab-0354-4c63-800b-de8246b7c46c", "indicator--f2effcbf-d0fc-4b0c-beaa-77bec4dc9ced", "indicator--a489eea6-f300-41d7-9a88-41380c6cd961", "indicator--38c614aa-3438-41df-b47e-7f2c0094b009", "indicator--73616525-b9da-4740-9718-263e5118fdb5", "indicator--ab54573b-ce40-4705-87a1-21bf523879d7", "indicator--7d6a173f-d19d-47f8-aa00-1bc9327a398d", "indicator--d953cbf3-b193-42f3-ad1c-e1f51e033a96", "indicator--7e261277-35b1-4852-a432-06a787bdb09b", "indicator--dc3c81ca-a5f1-4643-a97a-f70dc5b89166", "indicator--7cbd2888-da94-45f5-9eb2-37534097e9e1", "indicator--95cca180-631d-4f53-b8a1-7fcbb87ba674", "indicator--d739f431-0cc3-4e5b-b0a2-dfa2a832a12f", "indicator--103fd768-8c1a-4daf-afb9-e368abbcf29a", "indicator--e193f573-9b7e-4cbe-a2c8-998ce2caa035", "indicator--362c1650-e7b1-474c-b7f8-3d0b068d78f6", "indicator--a7acfd18-60c8-4291-a47d-c6bee693743d", "indicator--7c48936f-7a79-4920-89a4-6e66faf8926b", "indicator--e1d228c0-851a-4e07-a6cb-16aa088b4390", "indicator--8e0551c5-f218-469a-bac6-6bfafa8ccba2", "indicator--176d2002-d7dd-43e1-9709-2d96b1d23181", "indicator--25b73193-7505-4583-841f-baa59ab855a5", "indicator--a2e168a9-94f8-4285-a9df-6661b36f46db", "indicator--59d0a054-1788-4bed-96e0-3a4a0a3851e0", "indicator--8d5e7012-a375-4f93-8080-7153668fe807", "indicator--dbe6c7cc-cbe6-4b07-935c-346819c42eba", "indicator--863d6cea-fc3d-435b-b3e9-68d88c32dbcc", "indicator--a4adc55f-e724-4b74-aae2-f8e8a7bb722a", "indicator--ea61dd4a-ce56-48c7-ac09-e9f00831f523", "indicator--829fa77c-5bad-4762-a341-72de9041b70e", "indicator--691d258e-c59c-4ea7-a73b-b2887a93773e", "indicator--0dc0ca21-df7d-4054-9982-26b74423223a", "indicator--e4e79f42-9e9e-40b2-9062-4e72770bf36a", "indicator--9f088297-df4f-4a9c-bb44-151ca39c9fda", "indicator--af2ff6bc-1de4-40ca-ae3e-f5ecf40c55bb", "indicator--fc08b0fa-f92c-44e5-934d-8c971899ebe1", "indicator--946f8bd5-0b93-4ff7-8ee4-04ddceab987d", "indicator--66f9d389-871e-4939-b3a7-f8aebb785b9f", "indicator--89c44155-41a1-4776-8018-da158d7d34e6", "indicator--fb54c50c-1dda-44ad-b153-040217414cc5", "indicator--e26ba93a-2661-4c1e-b9be-a57a3b1c0e47", "indicator--3bd5b4e1-db74-479d-a6ba-65673dded10f", "indicator--6902aeec-a1c8-4bdc-b631-ad152aef5b9b", "indicator--8f826b97-0304-48f1-be52-8b5a8f3069c8", "indicator--0802f2da-5629-491d-b286-d36015fa03b2", "indicator--b89a9c04-a41d-4353-b898-9b286ed16b09", "indicator--1a64cbb6-e786-431f-8bc4-e0755dfa5c3e", "indicator--7d44c625-9420-49f4-b354-3e96c8e804e6", "indicator--a8d76656-9cf0-40a1-9926-70f868eb73cd", "indicator--0a5a6db0-ee3f-4cd6-b65c-7015e2406961", "indicator--4f84859a-f22f-49aa-94bd-d7f220a12443", "indicator--e2c3f32b-9fa0-4c9e-9b67-8cc64455b140", "indicator--1cb2aca6-6dff-4557-b773-55a392053e82", "indicator--fdee6a84-5d30-498f-8e57-7b556a6be4b3", "indicator--dc7e009d-eb75-4185-8823-053465ef4a0c", "indicator--4b67c17d-abf8-4134-b6cf-01e5740cccf4", "indicator--40bf04e2-c0c8-40b3-ad6f-c298745c33c9", "indicator--2d6b0a8a-39ed-4f05-af75-a0d799b9d05d", "indicator--ed3a29b7-eb3e-463f-88d1-34e1e6bbac85", "indicator--cb617545-90b6-4e43-84f5-df8934bb145a", "indicator--ac77c658-6102-4b9b-bd35-6a67a49464ac", "indicator--e5c3321c-a795-4b9e-875b-2856fc12ecbe", "indicator--82a81055-8c54-4178-98ca-1aeb7754cf7f", "indicator--72696e25-394b-4f7e-ae13-05137557b736", "indicator--d64895b5-09ba-4e57-83da-05f129d8b0ef", "indicator--7b9890d6-c35a-41aa-8bc6-d2fb86c4ebba", "indicator--39996a8c-1188-4631-a89d-c066a01ee148", "indicator--6c442f05-b47d-464b-bfb3-a752f2384943", "indicator--149c2231-db0e-413a-a95c-5c06b028ccc4", "indicator--0b3e1509-3da8-421a-807d-017ae59d740c", "indicator--23d7bdea-181d-4bfd-a5b2-4cf47da69c8a", "indicator--f9cbeae2-7cb4-483f-b5bd-d3a223e89c0a", "indicator--71722c39-a66a-45ad-b995-8d5cbf4345ee", "indicator--2bc85224-cd92-43b8-a903-5510f9f26065", "indicator--78826fbd-591f-4543-9005-20d64803d23f", "indicator--9a312a63-0792-4a02-8140-ed79d4eec916", "indicator--17e32042-b068-40aa-9edb-d416860a854f", "indicator--8eff53a2-c2f6-4930-b5cf-ead3ee692332", "indicator--c5995cfa-c506-4239-a86f-f387e91ac94c", "indicator--04a0ba21-16db-4947-ba58-db059a86e34e", "indicator--f1f6371f-0192-4599-8146-134197f7df30", "indicator--5996d849-4a42-4201-929c-ea9d86443a98", "indicator--443367a0-1826-4745-a2d1-e6cb4984e80c", "indicator--85454ca4-04aa-417c-b63b-552488fbfced", "indicator--17ffe764-cd66-4985-be83-6f825a24cbc1", "indicator--51f3e48a-6b7c-4c3d-8a8d-b50e2dc3bbc8", "indicator--b9a6be10-7dad-42c3-abf9-605010182566", "indicator--c0fffb63-69cb-43f0-bbd5-8823b6e89db4", "indicator--036a2f73-c337-49e2-b681-bbb6f1be851f", "indicator--b075dc8d-6615-4ef6-9961-4d32eab18415", "indicator--e01b80f8-e449-4841-9385-791df5a57fb8", "indicator--1a18147c-b907-4514-9c5c-2dd6ceb0f064", "indicator--a4a14e3b-85a5-4188-b9d3-a99ca362dbfd", "indicator--9fb6d638-7926-48e2-9aed-f3722209cd0a", "indicator--0d1c143b-26f6-404d-bbdd-9a13205d7d35", "indicator--3c951200-4b62-4793-9c0d-ae8b89de6868", "indicator--fb77e887-b229-4b09-a8c2-337be50c07b5", "indicator--df90d137-8f70-41ad-944d-257555e5d1f8", "indicator--54c8be91-ff16-462b-b49e-6d26802ccde9", "indicator--b47976ae-2018-4024-b081-879e295850e3", "indicator--53b93260-60f8-4a94-a1ab-25bbf4f8a6c4", "indicator--32645184-70b4-4171-9319-d29738ba2562", "indicator--a599edae-c288-492b-b1f0-f08801293e6e", "indicator--595397fc-1041-403d-9b47-b24d1183db99", "indicator--6f68f4a0-9148-4707-9a35-b3935c25f999", "indicator--ac1cc6d2-cb19-4916-abc3-5c7e275ec758", "indicator--2a7c315d-b9e7-4599-ab75-27224e3227ed", "indicator--bcc95a2d-45f6-4493-9506-7de82caa5bd3", "indicator--0778144f-e5c5-4691-8f8c-d56aa9c3cc41", "indicator--c8b0f53e-5a37-4d71-8b3f-86a07cf45faf", "indicator--dce0ec54-6b29-4d31-9a3b-f59308bccdcb", "indicator--d165d526-5f4a-4840-9446-7fc7a1f45591", "indicator--8231f264-dfa0-4528-bf82-80b57d9cad31", "indicator--402bc653-1376-43ee-b187-ef259371924c", "indicator--26dffdc6-279a-445d-936a-cce6a70f7de7", "indicator--7e4de772-26e5-4853-abf7-865f9c0af8f0", "indicator--446f8939-a3be-4ad5-b2c1-d1cc5ae6d3b4", "indicator--9f01aca9-7f53-4004-a31c-12dfb83a94d6", "indicator--0a5c10bb-85eb-467b-a171-856e923bf585", "indicator--9f08a727-7914-474e-8df6-49309ccac34c", "indicator--8d50324e-f12a-48eb-944e-e898229432e6", "indicator--92e77aa9-a4f0-429b-9acc-387d309d298a", "indicator--d4350ec6-3507-49af-b830-65c2794b3988", "indicator--b18f97ff-e4a4-4448-8bf3-b41e03f23097", "indicator--f19f181f-25c7-4b33-a51a-231cd0904b10", "indicator--c0e83861-c6c9-4c96-8854-db393d76ca5c", "indicator--24b960db-755f-43df-8c88-8e86b2859d46", "indicator--d9493241-078c-43c2-9798-009717a73c9c", "indicator--733b610b-eb23-4bda-8292-06080fd4ecce", "indicator--8d8651f8-194b-4115-8618-7c0dcfe34771", "indicator--9df8cc0a-6a99-48ce-8b3a-f2f38fc15450", "indicator--18cffa03-cffc-4490-a710-7bb71ee7a1e1", "indicator--1c2ac0a5-d800-48af-abe7-68b46aa6727a", "indicator--0f44b071-7f24-468c-ade7-3c21e2c7d931", "indicator--331e9916-d34e-4d68-a9eb-0fc05119b807", "indicator--d2cbf4b8-7074-4908-b406-a1cc6c6be33b", "indicator--e1463332-5c9d-4a45-abde-7929ebecb4ef", "indicator--520407b0-7410-44bd-acc8-b154e85b14a2", "indicator--c2c7413a-7686-4fba-8e52-8ef4f8445c7e", "indicator--a4183a84-1423-415e-a2d4-75178b858953", "indicator--d1bb40bf-aff9-46fe-bcb7-470f4a65608b", "indicator--e1911750-2ca8-4a1e-add7-8b9b9789928e", "indicator--f556b01d-38c1-489a-adb4-b417bbb3ea96", "indicator--6c81b7d1-8c13-4a3e-9e07-3bdf8e04a2dc", "indicator--f3a67026-3a8a-4223-a828-b8250c78fe87", "indicator--cd95324e-4a6b-4dc3-920b-0636143457d1", "indicator--44ddaadd-92d9-4ef2-95b3-082fd1337a46", "indicator--533ec9e2-16e6-46a0-9dbd-f7a90d652901", "indicator--f98e4b7c-7436-49d7-856c-673c7c6cd4e5", "indicator--7482f773-95c7-4323-a4df-7086d42c9eeb", "indicator--35ec237b-a902-438a-8c80-a9fe25e7892f", "indicator--d281677f-2d8a-4b07-a362-180505cd8124", "indicator--ea1be919-d5db-4e17-b401-9a4a58cf406c", "indicator--910f724b-f33b-432c-951c-ac3033ea1656", "indicator--5c1ee8a0-d907-474e-a670-fb72a0ab4cc8", "indicator--38e9513a-6ab0-4124-859b-a6e6d8701ee2", "indicator--272f89c2-e1cc-4156-8be4-51e2ffe652d8", "indicator--e91a498c-71f8-4f15-8272-f0900f740f90", "indicator--28f26526-5fa8-4311-8f60-984da2ecdf13", "indicator--90b03be1-dae1-4ed4-81e8-d9a0db32afe7", "indicator--f4d4159b-7d5f-4af2-a78a-e6310edf66e4", "indicator--daee3bba-4fb3-4017-ab05-f8e4cb159d32", "indicator--c6d996f1-4dd5-4d74-a624-6327f4458221", "indicator--3e53ac31-6688-40b7-a1fc-42ac5f4a07f5", "indicator--a596da41-a9ec-43cf-b515-b6585aa1702e", "indicator--1aef0308-cd9d-4d56-a8a4-1d8e3c8313ae", "indicator--aa9cec45-26f2-4fbe-a57e-68a1b504b75b", "indicator--e844f83f-3401-4e67-abb7-65daf49e8822", "indicator--00130adf-9f4e-4339-a412-ab82cb24c182", "indicator--f81c7555-78b0-46cf-97bf-e04d765da467", "indicator--763cfaaf-42b0-4292-80b7-b626335a8c2f", "indicator--b616e331-64a2-48eb-a4fa-100469b12fc4", "indicator--bc5f47c6-0bd3-4bed-b51d-2cd671605013", "indicator--e5702e6d-eaab-42f5-8172-2bc376a42716", "indicator--27985d99-eb69-4f5e-89ba-3af33a09d719", "indicator--2f807365-a0ce-45fa-8ded-94ef52d58548", "indicator--08864493-7b28-45b9-bdda-0d12a690864e", "indicator--86a13a14-80bc-4c7a-809c-dc90a782217c", "indicator--66607288-479b-443f-99d5-0a536157eace", "indicator--8715591a-96d2-46ba-9704-8227767a4313", "indicator--01eabf7e-0894-4542-a123-336fa79f5b3c", "indicator--064f4929-e8c4-4b16-b05e-92d4e61cb6af", "indicator--302eecf3-b487-40cf-bf62-cca195a91b51", "indicator--7ef69d6c-0b14-407e-9b73-907d4a7eb031", "indicator--431e4547-a5d9-48b7-8cd7-a9d1a354eec4", "indicator--9b10825f-c846-4c30-a2b0-fee68d1553b1", "indicator--824cc709-fa21-4a95-a305-19750fe5edd4", "indicator--61a5c22e-1e5f-4699-bfa9-c4321f03a0d9", "indicator--356c945b-5f5f-4aaf-ac06-07bc9e1e7ff3", "indicator--e5b5b707-ccec-4555-b908-4990c41a1de2", "indicator--81c23583-001d-496a-af04-c612fc197c93", "indicator--513654dc-2623-4959-96e1-1c1b59cd59c8", "indicator--e6f1685b-578b-4c25-bcc7-87364c563bb7", "indicator--65556829-4d35-4c4b-bda8-86fec406150f", "indicator--1baf24d1-73fa-48c0-bd64-4c2a7bee749a", "indicator--74052187-4990-44c3-aab1-22ca029b6ac7", "indicator--0a044cd4-e9c9-48e4-a8c1-d7034c1ba982", "indicator--24d8674f-6af8-4509-b57b-3572a463f8f8", "indicator--b59dc970-b143-4225-ac3a-dfcb8d24912d", "indicator--0a485012-5e27-4be6-b825-0322537ec889", "indicator--89750b36-bc61-4d1b-869e-3781ba00702e", "indicator--3eef6981-e70e-4a4f-9909-41262ed8b98c", "indicator--6d90f641-427e-4ee9-9c13-694667d316d9", "indicator--035d62ef-29e9-4b27-8c16-7dd634c6ff47", "indicator--7cb450e4-fbfc-4995-b7ae-15417ea661b3", "indicator--3736944c-ae3c-4bcf-ad6c-21fb1c9b1bd4", "indicator--acdee2f4-b739-4097-a962-becb6c55652a", "indicator--39490d0e-8974-4108-87d2-61eaa7431ed6", "indicator--64d9a23f-21e1-453e-83f2-511b84c7172c", "indicator--3670f563-1420-43fd-9410-22e6eec9ef55", "indicator--0d0edd73-cc13-408f-8c1b-bc1c5ac4afe6", "indicator--88c0d3b0-19aa-4e69-b241-1defa2db2418", "indicator--0da2eaa6-153b-47df-ba9a-fa9d92e571b8", "indicator--0a7bdeec-4d26-4892-83b0-75dd82418139", "indicator--80717376-3998-4434-96a8-b0f69a5c222e", "indicator--c3f0173b-373e-479d-a9ef-899d3ff96ea4", "indicator--653c7fd4-94f7-454e-8db3-53619a84de0a", "indicator--69534325-8b5a-4ab5-8e8c-505c204c4a97", "indicator--1e945308-0c69-4406-b01e-2f48939d0011", "indicator--28d6b63f-ae7c-42c1-85bc-48a3f96a6fba", "indicator--ac90cdda-33b5-4037-85ef-f6e475f9fb91", "indicator--e051d9fa-ae84-4655-a13e-2b33dc2140ed", "indicator--2182b2c7-3635-44cf-b56b-7f6070f329b0", "indicator--fc3711a1-4c78-49d5-84de-a2cefc2686ef", "indicator--f2b3455a-134c-46e4-afa2-2799387ddc60", "indicator--0505a702-5a5e-44a9-981d-dc7d7d68ff42", "indicator--4d7c9566-067b-40b9-a63c-9c953c3e5808", "indicator--f381a38a-260d-4df2-ba25-405c14732865", "indicator--1722417e-0022-4ab1-ac5c-95ac1fff2295", "indicator--c17f2a1f-7ded-494d-bf42-46084fe3c587", "indicator--996c7d35-ad0f-476a-9886-a2a8cd1e70e6", "indicator--563b0bf5-e347-411c-8335-47bbd4397656", "indicator--98fa1eaf-d871-46ba-99b1-0329af93edcc", "indicator--7fdbf785-6a7d-40a4-8a18-8071b3c3d974", "indicator--6978d4c9-3151-4cb8-a41b-6bcd6545ab12", "indicator--44e3d7a4-b893-46e2-a5ac-40cd9d0b60c7", "indicator--0d386112-872c-488c-8997-4fdc14d5bfab", "indicator--945af1d8-006c-4b08-867e-481c1584dca6", "indicator--3c4782a4-7197-4c86-9bfd-8727534df91a", "indicator--efac467f-7c87-457f-993e-7b3d876f7484", "indicator--1a16caa5-9cc8-480e-a34c-68efdcf1f268", "indicator--ab33bdfc-e676-450f-9366-a91814ab6f9b", "indicator--7f97e6ed-15c6-44c2-99af-e9b13c305b06", "indicator--7a3a19da-5677-4502-ab0d-e9f2cf87cf45", "indicator--e527f581-971b-4a6c-91fd-031fb978e9ca", "indicator--49e0d98a-60ba-409d-8b8d-61a66ee5a09e", "indicator--82f9023a-1570-457b-9175-bf06e1b720e9", "indicator--aa0f797a-e1ea-4b79-b5b7-507be509ac35", "indicator--3a16686b-1f27-4ab6-b5ef-22f27d58c7f1", "indicator--e6ef8e37-f56e-4fa2-b2ea-37fc5dbd74f1", "indicator--ecb9c26f-260a-4c29-ba1a-78128fdb0537", "indicator--620611f3-0cc3-4c4c-8237-fe22ae90d273", "indicator--926474df-f11f-4b88-92d3-e17ee0f4c3ed", "indicator--c2b708c9-88a4-464f-addc-cbdcc4db55e5", "indicator--b646c488-7dc8-464a-8c8f-c1204604e391", "indicator--160eb2df-508c-4aa0-819b-95d19c87bd1e", "indicator--43fb8fc5-39c5-45ec-9fac-8d00b8d52306", "indicator--1ca30c3d-e3e1-4c50-b45d-02468da9f782", "indicator--a1b7da07-2de8-4478-bc99-ca05b5ad2fd9", "indicator--b56e0317-4e84-4470-9a5a-8f7c4748a0c4", "indicator--26bf74b7-df69-487a-a8b4-76370b03707b", "indicator--a38cf514-6f43-4b21-8246-40e076d40d0f", "indicator--bf27c208-4e90-4ae6-a059-42d45530372a", "indicator--a66ae81f-1aaf-4611-bc8a-19cbd2583849", "indicator--8d08dad9-af55-4386-87e8-8520b8ba9834", "indicator--93f0b74d-f205-492f-be52-c6ca05ac9331", "indicator--8b7bd734-9eaf-4bb5-8e61-d1c6c0c2a0ad", "indicator--bfd380f2-a1bf-4aad-991f-7f472e092658", "indicator--d60c3c75-e394-4e5c-8b6e-43ba4c59d603", "indicator--9d6b7d13-5b07-47d5-9d5f-04f176386e98", "indicator--5fd9694f-ea58-4f8f-b8cf-b75fd9bb9443", "indicator--5b8cea5b-79e1-4c6e-9845-c1a0a21832e6", "indicator--2e40ff04-31f6-450e-8eca-51a9c1f7fd43", "indicator--3cc75446-dbd1-4ba2-b4a9-69e4d456b58f", "indicator--cf6de188-95f1-41fe-a69d-3081e9f0c3c9", "indicator--1d40422c-2518-488e-a6a5-8a365076c7ef", "indicator--a056734a-15d0-4b5d-ab7a-b9d9541a6a1b", "indicator--44fa1c92-89ca-47f7-a562-38fe63cc10c8", "indicator--236970e6-a53c-475b-aa85-e8ffd883565a", "indicator--14167b8c-f49f-4d4c-9f50-a8d5b9ff780f", "indicator--4b6e6ab3-46fc-4469-ad0c-c40107eb1098", "indicator--64129437-dbab-44f8-8558-94da25f07f2f", "indicator--ba60f951-d615-42a7-a3c3-1a00bda52e03", "indicator--145316f3-91de-4a5b-b77d-04a233602eaa", "indicator--516838be-9163-44c1-984a-5b8f909e485a", "indicator--09d20580-0c89-4858-99b0-fa71d6cd99f5", "indicator--a9768c69-9b94-4ddd-8fd7-24ca92668bc9", "indicator--9ecd0283-a897-4ad1-860f-7261cc562e38", "indicator--1c1e7c91-85fe-4a1b-a5fd-abc4bff267aa", "indicator--8838d9a8-84e2-4ae8-8959-b167b37d52ea", "indicator--0d5a90ab-5860-4d9c-a519-4831ee453137", "indicator--54662efc-c065-41c6-a283-0658e386be41", "indicator--364ddf8e-d897-4139-a1ed-9fa1078aa5dd", "indicator--fbb1ac35-f04a-47fa-92c7-e5579182217d", "indicator--212c4e8b-9d33-4562-9550-ef4bf42ea2d8", "indicator--41584da1-4949-48b4-af81-a457eced0dc5", "indicator--e2068bce-6c97-4a24-b317-5bee17c10b53", "indicator--55b1f232-e2a7-47aa-87b4-4a3a7f2daeac", "indicator--1568f9de-be1f-4401-8c33-4596b6c66ab1", "indicator--19c32f81-c183-4726-b81a-914abfb60475", "indicator--bb015b6a-27a8-46b6-a9ca-1013b1b9b702", "indicator--06d207da-4120-43e2-a595-77ff2a6b7b70", "indicator--7ea2768a-a1d0-4f7e-b6cf-2454c2d0cef4", "indicator--887e40dd-fc85-41ce-8f87-5f47bee4090e", "indicator--304da6bd-2ec0-42a1-833a-01dc696f9f5c", "indicator--e5581017-35a6-4a92-b0cd-cef7eb03e6a9", "indicator--d18de0eb-a62a-4215-9cd4-8f8cb43a4fd1", "indicator--7cf7aa78-0393-494a-9519-3d964d197f76", "indicator--6b4f68ca-bab1-46d9-b823-61cf0be3ae5d", "indicator--46c5326b-ea36-4c0d-aa34-eacacb88bd46", "indicator--11cb19fc-522f-47d7-b746-f26b73beb67e", "indicator--313e098c-3b51-4832-9073-4ba13ba4082b", "indicator--2ce5158b-440c-4705-8eac-b938919563f2", "indicator--2eec4167-1d69-4137-8266-0fc24ebfd8ce", "indicator--eae632b8-c771-43b4-b3ca-13a3387c4bb5", "indicator--a4ee0a4b-70d9-41fa-9fb7-c9b401d356c3", "indicator--eb769d0e-21b6-4679-a676-97b07fcb8f6e", "indicator--3dd37a20-d18b-48ba-9482-16666eea0631", "indicator--fedacccb-ad08-4f6d-accb-e8e6370feaaa", "indicator--45dd398a-4449-40d1-907a-47c094e5d6eb", "indicator--ddbb7d92-ff8b-4a89-ba68-9fe10a58dc99", "indicator--f8bbd3cc-52fe-416b-b503-81156b6b83da", "indicator--5c9bf145-dff6-4d5b-9b9d-daa93e785402", "indicator--a7543bc1-59b9-41f9-92b3-29a8c8bc4045", "indicator--18882a00-5a47-436a-8a02-7c49ea71224f", "indicator--ed49b123-a492-4c56-ae97-4c06c17d7eff", "indicator--eefc6acd-0f5a-42f2-8147-3f3b8b7d20ad", "indicator--8c8f3002-774b-48af-8c9d-5082f035c1af", "indicator--dd78ac17-e85a-42f1-b18d-07a65ecdc18b", "indicator--f10168b1-7593-44ba-99dd-f176c3afe087", "indicator--b61af116-d928-4e92-8c2f-7bd53053bfe3", "indicator--67bda937-b6fa-41b1-ab0e-5e1fdaa67c67", "indicator--2597b77b-dc39-45fb-b6e2-9221eb374be2", "indicator--11791d43-1e13-4aa6-8b7f-00f3661c2e2a", "indicator--1ec1b814-fe29-47a0-8db8-fd7e6655ad6f", "indicator--3c63ffb3-58b0-40fa-82bc-2f05eab538f8", "indicator--55349636-ca54-4d5f-86e4-3c0e20fe310a", "indicator--566800eb-c671-44e5-9c9c-1906b2a67893", "indicator--93e2d005-6c31-48ea-972e-50d68d1af71f", "indicator--952cd4bc-1542-4959-bc42-0a69fbb194c6", "indicator--6adba6a2-cbc0-4197-b253-e7feb1b5131a", "indicator--0a6119f9-f48c-4be6-ae15-9a00985ab6c1", "indicator--377ccc1b-6ced-42e5-a127-509b22bd9dd4", "indicator--5d33343e-662b-4ccb-981e-5f6d13d783ae", "indicator--03103db1-26c0-4878-922a-8bf4a9a33bb3", "indicator--90829371-47bc-4be4-a84b-3cc16898e264", "indicator--c1ce916f-0568-423d-ad07-40a8714b3e87", "indicator--8535df0a-5854-41cb-af46-9d8675c1b46c", "indicator--8c41c857-1c46-4858-9381-1c4d48a42558", "indicator--b19bea9b-dc7a-4d4c-a878-a7bfc577f8fc", "indicator--4eb2f59b-3f0f-4eaf-a90f-97fc789db56f", "indicator--d707388f-1ce5-455c-a143-6a8f99d3487e", "indicator--ada5bd2e-11b4-428f-a479-77a5e7457591", "indicator--1149b011-6f98-4917-aad4-ed917adfb127", "indicator--ad4ebc39-c2ad-4119-88fb-369df8517086", "indicator--4a4e277b-3d4b-4a9a-a163-1a35bb591b7e", "indicator--837fdf70-fbb2-4e01-b775-07198ec7e362", "indicator--86261bf9-f989-412f-84b1-fee97d4e9f85", "indicator--58a893e8-9ec8-4519-b20b-e7ed7238f983", "indicator--2cd6512c-2b0a-4b75-bca8-b3a5b243a692", "indicator--c78b0299-321a-48b2-8977-ddd44972c483", "indicator--0c027ddc-7f34-49ba-a422-51500bb1ae53", "indicator--00eaf6d8-82fd-4f0c-b507-1de3b398f0a0", "indicator--bdd29486-e3d0-4100-b7b5-4e4169e8b5db", "indicator--e23d6b84-ddab-428e-8b97-91c4cac4a0ef", "indicator--ac37c98d-25e7-479f-b79b-5f71697293a8", "indicator--fbe8a2c4-8cce-4c50-b5c0-0aa1e46c0a24", "indicator--981d50f8-b8e0-4909-be53-3f5656ba3ee0", "indicator--21efb56f-0c61-4a34-a57a-710ec5feca11", "indicator--7c388339-255d-42d7-809b-6419c0046354", "indicator--51e3c0f7-d0f4-4c4d-bb57-07fc294f285a", "indicator--bb1fc2c0-0399-4a1c-a792-c17c3aaa9119", "indicator--e3c4be07-fda7-4972-ae19-7d03318bca95", "indicator--4e095fb8-3687-454d-bb0c-0862b5f0356d", "indicator--e7aae08c-f363-436b-a24c-8bf368af5d9c", "indicator--e68e7a73-25f6-4dac-a047-6c5ce293f197", "indicator--34f11866-c5ae-4147-b155-811d729006a8", "indicator--b9120472-323e-4630-9ca9-6e439ce4de96", "indicator--bb039616-8634-4252-a859-029da3a7b9e1", "indicator--6778b9e6-10e2-42a9-9bed-792907d8ce0a", "indicator--e3d02c1b-e475-4dc0-8089-f8799a6e2aa7", "indicator--c2a5a2bb-3ddc-4435-a104-30cb92d76d26", "indicator--f58a6bfa-586f-4c50-97c8-af7fe1de24ca", "indicator--920b5db2-9e67-412e-aa24-0ed84c089c6e", "indicator--ea3fea00-6b4e-4bf3-9e2f-687f0eee97a1", "indicator--3b8716a6-fe18-407a-890c-87689c1f4963", "indicator--9c592cd0-4327-4933-ae6c-509d50d5ec07", "indicator--8732266c-46c7-4268-ae9d-28499508e328", "indicator--d1d953be-3b11-47c5-b7e9-df8143dd8f9e", "indicator--ce11f4d6-c561-4afc-a881-68daf7de085e", "indicator--7f30b07a-0a86-4209-8723-96015b4b73c1", "indicator--a055ae25-c57d-4185-b910-60af6a125fe7", "indicator--079483eb-0554-49ec-9d43-778773107f6c", "indicator--6a2410a6-de72-467a-b276-50f4fbec7a77", "indicator--173345d7-80ab-4325-9f89-c670bcb902e3", "indicator--37af8a1e-a173-4ca2-9e5d-c3e014e212c4", "indicator--9b6f3f20-f4f3-4551-8321-d7a49410bfa5", "indicator--2db3b2c3-d105-4885-8f48-a8f51dbd7aa8", "indicator--d072c163-6a60-4ea2-8149-64a33be83bed", "indicator--64975592-399d-4afe-a76f-84524f622768", "indicator--0e8607a6-61cf-4e96-a929-1fd4d9f6ac6f", "indicator--7abb2855-6c1f-4224-acbd-bcbd37146d99", "indicator--4753afcd-a93f-4345-9c36-9db161c556ed", "indicator--d3b2ab3f-2c3a-490c-93f6-d86e0ae07095", "indicator--9c858340-762e-416b-b62b-d760a5da35fa", "indicator--fb1395f7-83bb-46d3-8f2e-4162609ec062", "indicator--b2e99f03-1a1f-49cf-b4a4-2f3fb20d487b", "indicator--554838b5-ab7d-4f4b-ae6f-6f3484f0f746", "indicator--598bd10a-498c-4680-bc09-cf87d0aee52c", "indicator--9c6f1e48-cbdb-4638-a50f-0ae728d32057", "indicator--fe3b6f83-ba93-4b9b-8c6e-e6dba4ebbcf3", "indicator--0cf4487a-bc17-4b73-8151-a73edfd50535", "indicator--9fb97986-1da4-4021-a2eb-12ba653f7313", "indicator--c636fcff-a9b9-408d-b7bb-c315277ec598", "indicator--7758e5da-40db-4509-8542-9fc411764ca3", "indicator--4f045939-2b4f-497f-baca-004ccaa62ed9", "indicator--b0695964-a52a-4f11-9087-d5303e07ef6d", "indicator--3af34e2b-97a8-4712-91ba-d001031148e9", "indicator--3956cc85-24ec-46e9-bfed-02432da93467", "indicator--90feaed9-19c4-46c0-b00c-4975e997a90e", "indicator--8efd5006-7cf8-425c-b7a6-1f05e117d98f", "indicator--8492e6df-c0b4-46aa-a83f-022e7f8098c6", "indicator--45e9b18c-8c26-4136-9517-d317daa8e7a0", "indicator--2ff44f30-204b-407a-b84b-e0b5bb8738fb", "indicator--b47dd9b1-5c04-468c-9d9c-f5517b9c9370", "indicator--9dad2122-92ed-4b44-9c2b-6a004bc13e66", "indicator--6d17ea2b-d695-4bd5-9766-000cc956b121", "indicator--2950ad1d-f194-4c27-93de-d6c2fd85236e", "indicator--4c929555-c576-43a6-a1fc-22be137ebdf8", "indicator--755159c9-da95-40f5-828c-c01d0b9e4951", "indicator--8d14ac3f-d9d0-4248-a410-a9c49297319d", "indicator--1e2cf894-c5bc-4015-9984-993a7cfe5e3f", "indicator--8409e8db-337b-44da-b490-0c2354f2ae19", "indicator--6ccdb3ed-f94c-4d50-83fb-87db922d51d3", "indicator--275b0fdf-e32a-4914-9b58-cdd974b18579", "indicator--bd7df996-0f53-4317-8087-824ccacc2034", "indicator--37807f96-d04d-40b6-ae6f-ee9aef935e55", "indicator--1d40d08b-0f60-4738-b1d8-6207795c3e62", "indicator--1cb44f25-ebe9-4611-943b-8161b898d1c2", "indicator--dd99d236-551b-43b0-bd21-0fa87788ffd5", "indicator--a6ad9614-e61d-45ed-bc33-f179a509d9d5", "indicator--fb07a558-a3e1-4386-97c3-fc788386ce1f", "indicator--7a408634-9ea9-4e3a-8a4f-e8c6e6e93a97", "indicator--7232e177-379e-48d8-9925-577d51c88169", "indicator--5c6c5daf-684a-4a0d-8aab-48f9529c5e3e", "indicator--16af2154-4873-42ed-bdb6-6849de55d212", "indicator--8db62350-ba3a-466b-8c59-416fd73e75d4", "indicator--b094cf7d-a8a8-4638-8a8c-a11b09e427d0", "indicator--5f56d5ad-1876-4144-8397-85d6bd062a50", "indicator--c62cbef5-6029-4c56-b524-a8f158763061", "indicator--c56a7535-b11a-403a-b797-d130807c69e3", "indicator--c014e437-3493-4f86-865a-27d9cc490920", "indicator--8a06c558-1fc0-4498-aeed-bfe901b4e803", "indicator--5b002433-756e-41ca-95e7-bcfd5398e6d9", "indicator--26105f76-ee5b-49ae-9468-cb24d112802c", "indicator--7f5d1cdc-5ccf-4747-b09a-0cd5fbef1b7b", "indicator--d199f484-8410-43a1-841f-786962c83cb0", "indicator--d424a5dd-ac5b-44ce-ad0d-3a02eca19309", "indicator--a21ac3c1-1fbf-4f52-a8c9-3a3236853cc5", "indicator--78ed1f47-cf4f-4bb4-9340-0eab2ea3f019", "indicator--3883784e-b4b9-4a50-832d-ecd04d611a33", "indicator--a56bd2b2-91db-4123-b97d-45b20a53da65", "indicator--ab2e0773-5b24-4f63-9a97-22e50bd71d26", "indicator--56273b28-71a2-487b-8215-86fb4c16ac7b", "indicator--b9b6dafa-9c97-40cf-a7ed-5a979d061f11", "indicator--4c5178f4-cdd2-4a40-bbef-481961461302", "indicator--e317cfda-73ef-4050-bb38-387fe89f311d", "indicator--bfa0944f-ccaf-445e-af3b-7fd978f4d2a0", "indicator--b520249f-995d-416f-87be-60fdc7de7c78", "indicator--f2a7afde-6d64-4aea-9177-f097216c6dfd", "indicator--ab3ff3c2-0919-41ad-a94b-0ea42b1f77f4", "indicator--123220bc-5179-49d9-80ae-243546b4a8ec", "indicator--288cc8ea-eb20-41f7-9259-b1d89a4e5083", "indicator--de1b93e1-0732-47b6-9a4d-5628f9b5e98e", "indicator--13229a0b-b9de-41d6-8f25-6b1173ed693d", "indicator--02bb143b-164f-454d-a08b-cda2320da74b", "indicator--890b8ce1-3133-4b77-85b3-b970533e8814", "indicator--081a3914-2edf-46f4-8e16-18f67038afa6", "indicator--e0fdbf83-7d1c-4d2c-8c5d-92c8a2e60043", "indicator--f8abdc2f-2976-4b2a-aad4-8f06622ac421", "indicator--6701db9a-89d1-4caf-8a71-f83d448da244", "indicator--854ccadb-1f13-449d-b337-73d9a882ac9b", "indicator--b8173151-838e-45df-8a2d-37181d3aa59f", "indicator--6a34af67-2a0b-4a70-9c63-f43b8822d161", "indicator--da723568-9fff-464d-bd83-8cfcc20a35cc", "indicator--b4b4b285-36f9-49fc-bda2-0d9de273d902", "indicator--6066612f-7c03-4096-b002-249511ef69e2", "indicator--82958ef0-ccc2-46ce-be17-5b749226e7ea", "indicator--c6e1cd4c-6894-4aa9-b0a7-086c3cb93c3e", "indicator--19b98588-3f8a-474d-a63b-0f7844181777", "indicator--f32339a5-433d-4c3c-affb-d4cbd5000df2", "indicator--c995f498-21b8-428e-bb5d-63273333f42c", "indicator--28e8f067-f378-4e2d-a711-b83a3bec2451", "indicator--7b48b2b9-4fa4-4bee-a7b7-09fb0b441680", "indicator--872042c9-432c-446c-9a63-21f36f7b40a6", "indicator--afe2a9f9-2204-4812-bdb6-ee3e2bd987b0", "indicator--a90dba6d-8e43-45eb-ad8c-bd7910da9374", "indicator--cce23122-4e23-4636-9bbb-7fe5e7998578", "indicator--94eb8e52-f72b-493e-b347-f9fbf42a9e41", "indicator--26ff6f41-c4aa-483b-955e-c8c6cd3af94b", "indicator--0d1879f1-712e-4cb6-8003-7ea23afc222f", "indicator--df264123-3510-41f8-85cc-b288c87c505a", "indicator--0378fa7a-d54d-42ce-aa31-1ae94dac665d", "indicator--8819ddc8-88db-45d4-b814-02d371bc66db", "indicator--35890783-9a2e-4790-8f5f-0efef5339076", "indicator--1fb5d5ad-56df-4334-8f96-5f4f034e88a6", "indicator--94dd0ff4-1509-48fe-9e70-c6a333410218", "indicator--be02bce3-896b-4267-a9ea-7b2e9c4e5e07", "indicator--c8ac5711-fa8f-4c57-8844-6c8b3add257c", "indicator--6a90036a-86fc-4ecf-8843-30290481305d", "indicator--73648e40-aaf9-42f1-a78f-21915d5c7c8a", "indicator--14735dac-ce15-43d0-94d0-2f3b88754cc3", "indicator--012f2962-40ca-43b5-9cfc-655724d73b67", "indicator--5ec75e27-8bbe-4f1c-ab0b-56e3a12997ef", "indicator--c40b79d6-734d-443a-b66d-8c7eb6019c04", "indicator--8fa52cb7-9d8f-44b9-8386-d6fc5f92c689", "indicator--7dbdc9a5-2f2e-43d0-9005-988fa312c9b1", "indicator--92518fe1-df68-45e8-8c98-25d03c11d7c0", "indicator--ed7d6d96-744d-4ffe-9668-e996ef3ba22d", "indicator--102b2046-3f45-4ee9-870c-d45d158a638b", "indicator--8e59b61e-a6fb-44a7-946e-aff03dd49dcf", "indicator--81baf560-39cb-4c22-a541-6df103973594", "indicator--c541d86b-66c2-4a00-a6b0-2613b2f90563", "indicator--0a9e5d74-14d2-48f4-a25a-380a1f873680", "indicator--d3bb3975-c2b8-42f2-82a4-0b109bef6655", "indicator--91193468-1951-4309-95e4-837e861f0039", "indicator--1d484283-9ba0-471d-9cea-77e7c5dd2092", "indicator--ab0b853d-8c19-4e6c-9648-b245805e5a7f", "indicator--0d39870b-b3e3-4d49-9dec-d9c947b0f525", "indicator--770dd859-6079-481a-939a-619a65a434cd", "indicator--f6d12955-db38-4bf6-a914-750b50160cab", "indicator--e5f6d006-ca06-47a2-8a85-3ee9f51630f1", "indicator--1006b165-cb18-4335-ab46-c0aa3d530ed6", "indicator--969dfe85-945c-4e7b-8182-4d7fe35d788a", "indicator--2f344559-1cc1-4dd6-b9d4-1b8eb138e542", "indicator--ac9b2a9c-4bf6-465c-83d2-e0b8d6762466", "indicator--f0b9c05b-fe3c-4f81-8ec2-a58c5fd67754", "indicator--b4a95cd8-575e-4398-899a-900d50cc8b77", "indicator--afcd1e0f-e019-4d3b-8f56-01c9e55952a8", "indicator--47ddbc19-89c5-4609-ad40-fd9838c40387", "indicator--f500b285-d38e-4c68-8494-b7fc337da7e8", "indicator--35321ae4-fe94-449e-ad4b-29c8c7636bb1", "indicator--cbf5585b-8953-4e0f-881b-8d91d9667ca2", "indicator--66e3a847-1cc7-40f1-a37a-8e4e78c7bda1", "indicator--49b3ff1f-0227-466d-911b-32c16ccfbe6e", "indicator--3e1c21e3-035c-461c-a1fd-fb677c42e09d", "indicator--95042a98-99bf-4519-b714-19d64d815f82", "indicator--dbd58cf3-ca37-425e-aafb-a63ca0ace442", "indicator--7a5d3f44-b2ca-49e8-96ea-3d95a04655f3", "indicator--8950ad98-489d-49e8-ae7f-20d714cb0bf5", "indicator--72c2c52e-5542-4002-8960-e30b0103c640", "indicator--246f64ce-9340-4f76-9601-bd82f3ad58b0", "indicator--223dc8fb-11a2-4e25-ab4c-78928ddba562", "indicator--2fac43fe-a372-4dec-8aad-b79f23fba29b", "indicator--747b91b9-789a-4caa-8e10-c87413608b58", "indicator--1cfb5e91-98a5-4242-bb93-de223ea16f4a", "indicator--3f575db6-a18d-4519-b782-af73e001df85", "indicator--181b4eb0-4e48-402c-8d40-d48c99f908f7", "indicator--ba90dfa0-aa50-42c6-83a6-bcc43622c6d6", "indicator--a5f762fa-bcd7-457d-bd82-d25fdd072306", "indicator--4f9bcdd3-f682-4ca5-9d36-ca13650ee38d", "indicator--95c1bea3-8943-4ccb-a386-075c669eefa7", "indicator--16ab0811-f042-4fe9-ad2d-c9626b1df5d3", "indicator--6d701664-57dc-4e1b-a587-f87ec6ba3302", "indicator--b5b1f141-2c92-4239-9696-e98b55eab7ea", "indicator--f83c4090-1791-4cad-9cf1-a19b07f9561e", "indicator--be8017f9-23ad-47ba-ae87-acd28d7dd6c2", "indicator--4e684625-9692-41e1-91a4-c0d6a03d79ac", "indicator--c5d173fb-7f65-4054-932e-518cc133dc41", "indicator--abf28d2e-37d2-4aaf-843f-436fdf51ed44", "indicator--43009c4c-8fca-4340-b2ca-2ebf1eff5926", "indicator--86ce4a4b-0110-4f9d-a867-4105c2afc9a6", "indicator--85a74485-61d8-44a6-bb55-ace32ae53872", "indicator--fcacf1f3-9805-460b-b1be-9829459ebf1e", "indicator--28310990-831c-4ae4-9398-62d06bbdc6ba", "indicator--b2c6b724-7a3d-4166-82f1-927f81074bae", "indicator--84e89924-8206-439b-bf62-28040cea4284", "indicator--92d692e6-4c34-487e-9fd5-293305b89863", "indicator--42a25910-b5f5-4bec-b1c1-128866db58c2", "indicator--4af04995-ca18-4143-9b12-f8aac2be791f", "indicator--7f25d5a8-4788-4a48-b682-2178a9d3d3fd", "indicator--95b78072-f638-4c03-bc9c-9aa8e103f795", "indicator--cc256fa4-5d3c-4402-aa66-168741e162c8", "indicator--27a91fe4-051a-4715-9797-ccacbf125d4b", "indicator--600fb6c4-554c-41a6-92e1-acc5e3e22e36", "indicator--a49b3f0f-1171-4e28-a248-47b83755f21e", "indicator--0147634d-f05a-4128-896d-fae07078f552", "indicator--e5e70f27-2bec-4bbc-8293-461e02477c24", "indicator--9edd3ace-e36b-4043-8e3b-6c6a0dc3f7fd", "indicator--86067fac-2835-48a3-9fe2-2f186fafab83", "indicator--faedc0c2-f0d6-4c18-8111-1e8c075eeabc", "indicator--5e7c7648-bbfa-478d-af89-e5b968cc9ef8", "indicator--e27e57f1-9691-410c-b6e2-95dd55adebe3", "indicator--3cf41b06-2ed2-4aab-b92c-68f45c55a036", "indicator--c4e86977-c7eb-4afe-98d5-26db1be9a1dd", "indicator--48341a15-fc42-43ad-8e01-54b16bed0e0a", "indicator--104515f3-7cc1-4cf7-b02f-33ae2aae7e0d", "indicator--cf33dcdb-dc28-479b-9ce8-e807492fec65", "indicator--b289f759-9992-4f05-8780-ea0da6108eb8", "indicator--c97ac65e-e9ba-4756-bc25-887ef200ebf0", "indicator--dd103efd-3fff-4711-ac06-baa1ec94e652", "indicator--a1c0f838-0458-494c-a04b-14d778a6bb7e", "indicator--740a0891-d828-4aa6-99bc-22ee92dbc241", "indicator--06de6b95-0ef1-4d43-93f1-c8351badea53", "indicator--5130675c-1fc0-4227-91b9-2ac95ce58d28", "indicator--6e65033f-1aeb-422e-8131-ee1001f7c0aa", "indicator--1894bd24-c1f3-4def-b67c-3e98ebd890d5", "indicator--b53a2076-52ea-45cb-821c-89bfa283974d", "indicator--95ea6607-958c-4138-9965-66dd5f4fd92d", "indicator--083dee76-5c30-4af9-88e6-934251d09144", "indicator--83e977ba-d105-4b0f-81ec-98b20d8b40d4", "indicator--0105c8db-6d70-4519-b9de-ea60aa993d67", "indicator--6367a983-da1f-42ee-98e3-46a986932210", "indicator--66763b97-7556-4d1b-8e38-4040570cdac3", "indicator--ac8778b5-4436-4cd1-ab56-b06b9d0953ca", "indicator--e062dad4-ca04-45c9-a04b-04fd0a1d8281", "indicator--65428ada-147c-4a04-9743-11c902f1a00c", "indicator--0f64617e-3988-449e-b6e6-a7c325a57637", "indicator--adb55c2b-6429-4e2b-8c52-404d692980c1", "indicator--7a57eb20-731a-4737-ac06-6e5010e222f1", "indicator--290316e7-d1c1-49a2-80f0-072b20189b2f", "indicator--44f11516-1d80-44e7-98e7-17e299d91b03", "indicator--cc3ff467-c293-412c-8530-6c466946bcc1", "indicator--d8689ef3-8936-43ed-bb94-192ecce722e7", "indicator--b2c9e43e-7daf-4144-8a12-6dcda19e977f", "indicator--17eecc50-eb3b-4906-88ba-e8a439f51472", "indicator--535d9907-4e41-47a6-86eb-2f00d2f01a4d", "indicator--e22f1e59-19c0-4bc3-82f1-0f1ed3ad830c", "indicator--5d4449fa-f687-4d04-8e4f-5f15939f42ab", "indicator--0820e195-57c5-4412-bcea-29c468a60a81", "indicator--1c1b7814-d701-4a3e-8eeb-565b9af41d0d", "indicator--f651125e-0257-4c9d-9313-485d10dbccfa", "indicator--425ce0f4-a426-48c3-b39d-cd388a690aa8", "indicator--9ebd67f3-0b8b-4ef5-a77d-f0a47b361c11", "indicator--3658c691-d3ca-451d-b230-eac80537de3e", "indicator--5ee9af2b-78d2-413a-b33a-500e1db3051b", "indicator--68ff74e3-3dca-4900-a10c-fa515c48da77", "indicator--d4600061-367b-474e-986c-4f6a6f150985", "indicator--24afa028-97c1-49a4-b47a-a404f133ca67", "indicator--e63c6d7e-80f7-4f18-9884-5fd92566217a", "indicator--1458d0c4-ebd4-4a57-bb20-4259cd5fef35", "indicator--f341640f-1108-4043-b04f-f0eadc7837e2", "indicator--e1cb7306-4c7b-4441-9832-4fdcbf258a51", "indicator--992a35de-6716-4d1c-a230-712a5c5d7a39", "indicator--868227ad-e0ef-47b9-b1c8-837b3ce34b8d", "indicator--44be29c1-d91e-4f8a-8ff8-00ea6591d462", "indicator--43f4aad0-e98e-42b9-9a6a-28f7079e9dca", "indicator--e6804255-b145-43b6-9f4a-29bb0bd5d538", "indicator--d88a7807-f9f9-4b41-aafd-bb9e1c5eafa0", "indicator--f3d26b20-396b-471d-a0df-e3b8d5e9e9ae", "indicator--fc1d338e-695c-4d38-a84c-81521f13c3f1", "indicator--5b318b9f-ccda-4adf-a2b1-ff1ff4234921", "indicator--764e061c-d86a-44ce-a05f-a6eadc4034b4", "indicator--f1355197-26ca-4044-8239-ac7f2f8d7e98", "indicator--5e0bd784-395d-4659-8a3e-38aec4de1702", "indicator--aa28df33-d90f-40dc-a8ce-0b9eab40eddf", "indicator--58a84a97-6b21-4ab0-99eb-92d7c163f940", "indicator--12b0d2f0-6641-4af3-b503-d4dfa1cf7944", "indicator--7f53a056-28c0-4974-a734-dec01b03535c", "indicator--cdbe88a6-45ff-47e1-b576-cebbe68e2769", "indicator--65778aed-e0c9-4271-899a-916718229a7e", "indicator--fa190f65-8e90-4680-8b80-de4c68362438", "indicator--2b166c06-ad09-4f5a-9969-88007748b49c", "indicator--047f63c3-ac00-451a-bb2c-aa3781753f07", "indicator--d75ade97-8cc5-44c2-9d57-a7568320a261", "indicator--3b4de206-5417-44ec-ab9f-b59dd649c166", "indicator--7e5597f2-6d50-407f-a87c-fec0d05629c8", "indicator--43c30b92-d087-4651-a21b-f40b3ba31135", "indicator--bc5759b7-4ab5-4e95-b6b1-27cf97bacec2", "indicator--3c28102e-a191-4547-8872-1f0f65f00f05", "indicator--42b63d48-82cd-4c6d-ba70-59cb9178ee36", "indicator--a91130ad-5dae-4cd9-9d97-50ec60dad360", "indicator--eec53d4a-b320-4ca1-94e8-e2b3b0dbb9ea", "indicator--17b43622-d511-475e-80ec-e9fbf1bab96b", "indicator--8e6fa2c5-fb69-4730-8b20-63bd2ea9e504", "indicator--1de358ee-74e8-4c17-9e6f-c7c53b4a57c0", "indicator--3955f4b4-16e4-44ec-a763-7a9b570f605f", "indicator--bc530873-fd3d-4145-a358-7a543ab8bf73", "indicator--444b2b38-9a42-4ad3-a4ee-47d735fa8ff3", "indicator--dee6bfd9-215e-414e-89de-d2ca749ffc1c", "indicator--7e9b3ec9-6445-4d3b-8899-bb137154c253", "indicator--c9a69e72-ce7e-4a8d-a0df-c34d20ab0414", "indicator--b5e154df-3170-4935-ac9c-912e30792bbc", "indicator--e9695f8f-5c03-4622-8ced-0771097dba82", "indicator--635804ce-f45d-489c-86b3-323381e6d726", "indicator--13bcbd9c-b254-4669-8dc2-e0e5b2347c5b", "indicator--3e0b3e56-2b4e-4067-a12d-48d807992a8e", "indicator--a7601b26-7105-49bd-9927-0baaf7095472", "indicator--041d6645-c582-46f4-ae7d-ce2344ad759f", "indicator--a090f0b0-b213-4e05-a430-9ed466ea6cba", "indicator--eb6a5019-45c2-4d6f-8613-ca550480afab", "indicator--aa892542-47ab-48bf-8057-5f489e415d19", "indicator--fbfeb81d-975d-42c6-8d47-e0c3bd6cad29", "indicator--63cb8f54-469f-477f-a5a1-25d507b7de86", "indicator--cf15d9ca-780b-49ab-a47b-fd2ca020ec8e", "indicator--d1d654f5-0543-43b6-9b75-b09fae3aa72a", "indicator--8fe0f5cc-a84e-420b-a980-21590db89269", "indicator--509b608b-892c-48dd-b374-59ebdfb20d20", "indicator--23bfad9e-4856-440f-b6fd-e05432892d5d", "indicator--6012b626-05b0-4ef5-a332-8f6830b0800d", "indicator--62cce82b-1de5-4524-96ab-0d4fe9e1ec76", "indicator--2faef383-fbf5-4658-93f3-f3a1b7bc587a", "indicator--02238702-4402-47f6-8ce2-53d747020794", "indicator--06120843-2093-4ba9-84a0-7a383c16a671", "indicator--5e5a443b-177c-4ce7-9c83-b7b7affa2e42", "indicator--d5d281b1-340f-4852-8940-10ed65d76f34", "indicator--91c8e281-8c33-40c8-aac3-f4e180767524", "indicator--7d5b9232-55d8-4b1e-a9a0-c197bbcebcbd", "indicator--299fbdab-96e1-49a1-82a0-9b1825113e6d", "indicator--e521783e-961a-4c1a-8ba4-2bcac5d06611", "indicator--3d01f475-de96-4974-ab94-718546b6330d", "indicator--9d9d19d2-7bb3-4941-85b8-7b1a3d9d5374", "indicator--307eb99e-2468-421b-961c-b027440baae8", "indicator--caeb65c9-bd36-4200-8c9f-080bb293086e", "indicator--4d6d3714-25ea-4ca4-aaad-62efb8abf99e", "indicator--4ebc11a9-6fab-463a-a2b6-0fc3c4db3cc0", "indicator--5dee9420-ec0a-4a8b-891f-9a12a973458d", "indicator--24f8745f-c361-4bdf-86e7-e72e20e52ef7", "indicator--62d70c7e-ad96-4a75-a79d-a25ea3343149", "indicator--30d04bcd-b7e9-4235-9fc8-cc341003ae0f", "indicator--8d13b1e6-c311-4109-b754-32df91438792", "indicator--1d0291c9-23a7-48f6-8670-b079465af01e", "indicator--8c804dbb-80d3-4857-a976-08dca34f32e3", "indicator--9e47f89a-6941-43c3-864c-7ca0db483623", "indicator--85dd21ad-0aa1-4acf-8a71-a88523e73dd0", "indicator--a1f4d030-d499-45d3-a092-022a1c7c358a", "indicator--81b9e0f6-6392-43b1-ac84-157fbfcb5aac", "indicator--1450e750-23c2-4be0-8e94-af82497ee09f", "indicator--b5e277a8-5b5f-4261-9421-793f60e32265", "indicator--6f361fdb-a80c-418c-8235-90a3e5df450a", "indicator--5032c909-eaa0-4ce5-82b5-9d0c0f103e9c", "indicator--1792e65a-4759-40d4-aa76-c841c4e33ef5", "indicator--e836b1ac-dfd9-4544-8c49-2bfc9095535c", "indicator--b87ae073-db6e-42e9-9bad-0c4a4eb1b6b3", "indicator--bbedaf7f-ad3c-4f49-8507-a1870def5c45", "indicator--8b37dd1d-b0d8-41c6-a183-6979bb68e347", "indicator--7f4155bd-3d56-476f-8c48-c69b550d55e0", "indicator--73f29303-91f9-4b33-b2c3-28070e233a50", "indicator--cb73acc4-899f-4b46-959a-9550662e9a40", "indicator--b908c881-8c91-42cb-985f-c6117862bee8", "indicator--daf2b221-933d-4b0e-afd3-e93ac08c9829", "indicator--95a3682e-d507-4199-b9fb-612fd5d81e2f", "indicator--068282ec-9474-413e-ac5d-4276bc71a9fd", "indicator--24a65e78-bc51-49c3-bd8b-810dd4262136", "indicator--73fbc049-7cd3-4eb8-8e73-0a35242628df", "indicator--e6589eb9-82aa-4592-ae01-5060f5f40af4", "indicator--d598580b-7232-49f7-a983-9a02041efafe", "indicator--65648332-2c1b-44f1-8cc1-f372ba226d38", "indicator--ce898d50-778b-488d-bdc1-332b03b836df", "indicator--e1c4ea1a-6c20-48b7-a4c3-649de3a5986b", "indicator--69f3697f-8406-430c-8442-46049dc8c08e", "indicator--8da3c7e1-e82e-4dde-b676-b626a3bfffb5", "indicator--3c94bb3f-11af-484d-8349-06eaff3e5743", "indicator--ddc0eec9-08e7-4ec7-a374-3c5e53cb5d21", "indicator--fdd764ba-f9c3-4f74-b87c-727ba1f9fac7", "indicator--9942d426-4a9f-4bd6-b892-3038b72f905e", "indicator--de2dbd2c-f333-4e43-9fd2-1d219787b5ef", "indicator--56e9c832-0c19-4e17-9c46-fb99b51dc33b", "indicator--134c71d2-baa6-4f52-b491-659df9e2beb8", "indicator--5bb16c74-a164-44d9-9b5c-d36ec93726c3", "indicator--9c0adbd3-3335-4286-ae90-c6e42a8ca514", "indicator--af3eb932-30e9-4506-a7ce-fc1211358097", "indicator--d6fe3b1c-38e0-4769-8295-93e98b6ae1f1", "indicator--9172b2e3-141a-4e41-bf37-06790ad5965c", "indicator--16fe5614-55a3-40df-8181-234c184b5a5d", "indicator--d7ee0919-89ed-4c0d-b76e-221747b67380", "indicator--95fbf89b-9330-4bf0-acc5-674c40dff340", "indicator--18c379b7-7d05-4db3-945c-6bcbeaa56671", "indicator--34ffc11d-6de6-4936-a618-e07b3c959627", "indicator--a7d6240a-2e04-45c0-b90c-5303ef1fcd39", "indicator--741b0ac4-e9f3-43a0-92ea-666e8984d1ea", "indicator--24e07570-b5f8-427d-9a75-a69eef53f74c", "indicator--2741b0fc-25e6-406c-bf59-af25f568bde4", "indicator--fbf2e689-e6fe-48ab-9bfd-64d950351d29", "indicator--18dc0b74-db47-4311-b27a-2714193bca3b", "indicator--fbdc432d-92bd-4699-a679-74d8598b8319", "indicator--acd3cdb4-9c09-4061-8493-a97422bb870e", "indicator--f1890f51-a096-45d5-b4ea-c2642814e213", "indicator--18ac5cf8-9ae0-45cc-a83a-eb4fdc10ebea", "indicator--eeb39816-39f3-41a2-9da1-b59eb40f9f0e", "indicator--bb5636ac-6fb8-4305-b964-9dec486d18de", "indicator--543565b4-f758-4671-98cd-8b263094bbc2", "indicator--3864a342-2948-4f1e-9257-e89bc757af80", "indicator--e8a445fc-58f5-4c75-ad80-e2bdeaeae3ab", "indicator--352e6ece-6308-4c14-96ee-03eb2e6e06a4", "indicator--f5ee5511-b020-4170-baaf-17905a593e49", "indicator--2c700b15-89c5-4bf2-bed6-ab2abb07857b", "indicator--cd76d2a1-a05d-49b9-b791-b22b5d12e603", "indicator--fb1814be-47a8-432f-977d-11d580a6fd21", "indicator--04886890-0da9-41fa-a97d-e76d20da3485", "indicator--50957ee0-a935-4780-9f0f-77de4eb6a512", "indicator--e24d3a61-9ea7-41bf-b550-db419d4a24b5", "indicator--f714473b-9b7f-410b-ba68-9453a225f94e", "indicator--6c0e8c4c-c9f4-483c-a6ca-9ae031b6cfb3", "indicator--1d611ef0-7b51-437f-a2bf-e36f60c9fcf4", "indicator--3d495cf8-899e-4791-8c82-057cf417794b", "indicator--00e83af5-d0aa-405e-8811-cff80f9153e2", "indicator--af7ac68b-f518-4bfb-91de-b552456ebf45", "indicator--8b74ebd9-967b-4dcf-87e8-337850a517d9", "indicator--56480c78-9dd1-41c7-b873-a952bce5ed46", "indicator--843ba34b-2516-4979-96fc-cc76acb4cab4", "indicator--88393773-a23e-4f8d-b2e8-fa4015b04620", "indicator--e7f2ceb1-6363-4489-b5e9-e85b33905f7b", "indicator--4fb34a91-d108-4c2b-bf66-161d4da1037f", "indicator--5302231a-c8a7-47b9-a528-a47fd0f60948", "indicator--144b861c-8304-4d69-848f-90649906f270", "indicator--733cd3fe-b6ff-4259-a02a-ac6eabe36f64", "indicator--8c3615c3-658c-489b-ae57-8f9f5398a3da", "indicator--2f29e731-bb03-4591-a674-d47e1f6993c0", "indicator--0f1a001f-8c4a-46b0-857c-da22572ef756", "indicator--8d9ae5be-5436-4e64-a517-05d26c85628c", "indicator--b29eb1d0-b18a-4f1c-88d9-5b4705e85522", "indicator--b3d2d5d8-260b-4d9b-b683-0e455b4bcada", "indicator--d2616f57-09b0-4524-9464-c661130a707f", "indicator--b29aaf3c-da24-491f-bc89-11259318d8d2", "indicator--f3ff3f03-cc32-4510-8678-dd1af945fcb2", "indicator--82c1d8d5-49c0-4506-8ff8-577e9e9e8085", "indicator--054dce34-1e6e-47a9-a2e9-84b7bc5e8925", "indicator--b080ed81-f717-4058-b11e-5e9b4c93a9fa", "indicator--c17fc2fe-34b8-4eae-9254-ee85e573f346", "indicator--ccc8959b-cd73-4f90-845d-6f49ca25dbec", "indicator--5e88584c-b70c-413e-ac06-2bcdb4465b1c", "indicator--9676e76c-4aaa-4d84-9595-7d115e71c188", "indicator--86b06ac2-fb62-4eac-9153-0ab4c5cb34de", "indicator--63ba60d6-11de-4a18-9334-215a6915a2a6", "indicator--f4b4e096-843c-4a26-a034-affe4be40a21", "indicator--e7870714-985e-49a6-bf04-db63a071051a", "indicator--a1ec367c-19cc-40ea-8146-c44b95900825", "indicator--c3fd1b2a-aff8-484b-b3bc-de794f479dc4", "indicator--2e2e18f3-0ee9-4e29-be9c-40c40d08fb8c", "indicator--84329481-7360-4cb5-a457-d7ee343573f8", "indicator--8b04710d-ebd5-4e07-a3be-ada246c83117", "indicator--800c9a2a-d9e4-41c1-9dea-e39a93a4d65c", "indicator--e15a6a6f-f52f-4bb8-a183-87ad904780fe", "indicator--71b15925-d62d-4ba3-b53e-40a9ebfd817e", "indicator--ee65fde8-ef8b-450f-bbbb-7b28d4cdd6f9", "indicator--f7173953-58f6-434a-a354-25b993207a95", "indicator--46607c79-5123-4199-a11e-b86730dc0a6c", "indicator--21ddc680-dbd0-4bf2-8f8f-2a3eeb7cc0db", "indicator--4a4b46c6-5c39-4997-9a67-42edd0abf6be", "indicator--8c39d1c2-b2ed-4628-b798-3d6a09804ac2", "indicator--85231ed6-d45f-47d3-b7c6-f1c69148a4fc", "indicator--8c9a8d81-c115-4d03-9e3b-1e03e273781a", "indicator--d3bf757a-b0ca-4be4-8137-cfc05ba6abc9", "indicator--f0c3ad4d-80ba-4942-bed2-8890bb0f0d08", "indicator--561ec482-8d50-446a-88cb-f3772ab36654", "indicator--7fa59a78-e3e4-40c9-b860-77d6d3aeee08", "indicator--7b47fb3a-e49e-4ead-aba2-325cda116136", "indicator--de4cf733-f214-4ed2-8e1e-c5742e98368b", "indicator--9c613b54-1c66-4850-aaa9-49bc41490dfe", "indicator--09a0424a-4103-4d1a-8d27-239590da5c04", "indicator--51c3e08c-53c0-416a-b948-21850613cffa", "indicator--8ad2aabd-a235-4c9e-b9af-45377f1bc25b", "indicator--42e2b04e-3ea7-4ea8-85b4-0535bb872ce5", "indicator--7f36b711-9ca3-45dd-8293-586cb01d37a5", "indicator--93591d44-e006-4573-8016-ac1a87927ace", "indicator--c4c1a45e-0296-425f-a957-a22f2589fa17", "indicator--91570670-d045-4189-9e18-4f8e90a7cd1e", "indicator--1e740174-4a88-4cc2-affa-14ffcb53280b", "indicator--28cd6de9-6332-481d-8aa8-cd7b95756340", "indicator--5969bbd2-1a02-4f5e-9949-c4042f6a8e1d", "indicator--213e5713-2a1b-4d99-a33d-d41581392453", "indicator--fdf2584a-8884-47ea-ad6b-fbe146bc58d9", "indicator--f410fdae-55d4-4238-b070-7e8422dd3599", "indicator--71c4a6d1-9d91-4d50-821c-c75f34223dee", "indicator--4b76f494-2695-4e53-9d48-74d771c9bc5f", "indicator--d63c7682-9cf5-4675-8cb1-328397271a26", "indicator--c68f234e-6b28-4e0f-af81-bd27a6888c8f", "indicator--df6664d5-f463-4a27-8430-bfdf00965d07", "indicator--eff3eb8e-ff75-4cf1-9bae-5bab7d6a88e8", "indicator--ddd0a797-4eba-4dc2-bdbd-3f6cd6d012fe", "indicator--17d0dc1f-f47c-4d3d-a000-7336aecf2c88", "indicator--49f3e517-60b2-4527-b03e-8461e7b0b19e", "indicator--90434f8d-bab4-4942-93c3-537aaa4a91da", "indicator--f37c6779-243a-46bd-bb8f-425349587035", "indicator--551d2f5f-5d0a-47b3-9ee0-418d011af169", "indicator--ca4f79e9-e82b-4366-9c5b-9fcafb65165f", "indicator--d64989bd-ceb3-4311-bc98-a3ddfb266513", "indicator--d1df2639-13b5-4be7-9d0e-4b088b6e98da", "indicator--e8a55b21-c70f-4425-a81b-dc376fae3374", "indicator--8f0bb9ee-112a-4464-9e3d-077b79475c0c", "relationship--6d15fb91-34c0-43f5-98bf-3caaaf01b35d", "relationship--d6c008ad-a255-46ad-b634-c5a0d314ec87", "relationship--29d9aaf1-9e29-45ca-a902-e4ee2b462785", "indicator--c612f276-a587-4ed8-99a6-9e40662ed7b7", "indicator--f847af97-6c9e-4cfe-b027-69f330e525da", "indicator--5d86dafa-3a04-41a7-99bd-88ed33866315", "indicator--c5f281a3-5bc7-4249-ba31-6d9216234332", "indicator--70ee617e-060b-4ec3-98a7-b79008f2870c", "indicator--c152f709-1fa9-46bd-9b63-11de869db05b", "indicator--9482703d-4f1c-44ee-97eb-7e45f6ba3763", "indicator--6dabc6a3-a010-4162-8f77-cfe6ace07b63", "indicator--7930b2ba-bd06-4efb-b50d-0c637f53dccb", "indicator--7d2a8337-aa3b-41d7-8391-e5f3cb8ae4c8", "indicator--294b9531-d1c0-4fab-854e-c53e81d796ec", "indicator--95d5486d-5c93-40c0-9baa-63e3ae2d3d2b", "indicator--8ca8f358-eca8-4e83-8c1d-42f3a63fcb8e", "indicator--659af032-5ab3-4255-ab7a-9c68266d3284", "indicator--1a7ccdf9-b537-4a8f-bf01-2df9b8809ce3", "indicator--52c40fde-ab7d-4f38-81a4-b8efb63340ac", "indicator--bac7f4ec-2b84-4062-ad50-8de6495651c6", "indicator--406fd8ff-9244-4cba-838b-e1bd0caa7dfc", "indicator--4ac5e0b1-a637-4418-b401-2c46a89dde21", "indicator--5733449d-0e63-449e-a212-50956940393c", "indicator--b4443b80-8c5a-49ec-b112-5f2c2a4d3fbd", "indicator--3306762a-907c-46af-8af9-957ea3909b28", "indicator--e26132c5-ee36-4362-97d8-a9a9daa34348", "indicator--7b221372-450c-4ce0-8b70-8d06db1a42c4", "indicator--d7c62f1d-d8cc-41f0-baa5-a39232c901c1", "indicator--e00dabff-f56a-4c75-9dfc-b9c525355c9f", "indicator--a58c10e7-3b59-4b07-ba61-2fc8f61ef829", "indicator--db72d14f-6074-439a-9481-c2f3ebce91ca", "indicator--440ff1b9-8ed9-47df-8a37-3a97a8e1edb8", "indicator--30673c98-b119-4e63-8829-0dc42ea217e4", "indicator--b06defd6-d5f6-4126-b426-6c7ae359166f", "indicator--b145a29d-d618-47cf-9f18-5fc70d90ea90", "indicator--c459d319-1526-4e6c-891f-5e66be6af232", "indicator--0e3dc31e-1e67-4e56-9e53-0139280a5295", "indicator--f6412df0-656e-4a0a-aea6-939771a41ef7", "indicator--3a70c695-92f4-4e49-ba25-b67d15e9bd6c", "indicator--792b210a-98a2-4371-a05c-d2990cb0a225", "indicator--02746d1d-f4b7-4686-a735-b7864fe3e82d", "indicator--c6d1d05f-4ae2-49b8-ad8a-24a737c1dae5", "indicator--3c9f4a19-468a-4821-b80e-62f47fa73d43", "indicator--268d86e4-52fd-4d0d-8a08-331985b8e659", "indicator--9f560e71-e4f3-4f69-a9e5-3a4c32972749", "indicator--108f0a77-f610-4ddd-bb32-0cca4b6dbd07", "indicator--07de38a2-bbce-4d60-9e79-d95d04395887", "indicator--f19e05af-5feb-4742-bd2b-3d75290dcd39", "indicator--230f625e-6589-469a-914f-cdc578283d88", "indicator--64105af0-a38b-4307-9267-649bf5f1eba4", "indicator--0eb49970-02e2-49e1-a160-2801a4f836b5", "indicator--49df7bd9-ac59-4b85-94b1-c6e7f335e55d", "indicator--4ebd8986-fba9-4d21-b6cb-1c4b8f8a8f93", "indicator--d85aba27-3e74-45cb-a096-5cd62e8a9b09", "indicator--0857316d-c4d6-4e0a-aecf-33cf3a3abe56", "indicator--ce66ea9e-6665-4c2f-810c-5dd2fd68d20a", "indicator--e50a0a30-2c5d-44fe-b5fb-7d6326deddee", "indicator--ad5be84f-3472-49e2-a75c-0ad9fcf30f62", "indicator--46bc1231-3305-4d40-9960-cd744ec3116a", "indicator--4742c2fa-c854-42f8-ab8a-8a6beef4060a", "indicator--8ad8a2e0-009e-4bd0-b0b0-75bd8f35006f", "indicator--4b9cbe30-2cf8-4a8a-becf-615a7525b756", "indicator--9b69959f-d946-4b72-9629-6b46092aacd8", "indicator--223d16a9-6957-438d-8606-cba38e19b400", "indicator--a72915d5-0493-44a1-8b46-fa09a33a1f65", "indicator--49d369fb-bc6c-41dc-8f61-1fd213ed7355", "indicator--28fb6095-3855-4214-a94c-8e7c9dd585f8", "indicator--f3396ac8-b133-4d60-a9bd-6d8b5cd94233", "indicator--334265d9-403d-4745-ad1e-bdcea0b55e6d", "indicator--690c1154-44a1-4a33-b488-e89953e9ca62", "indicator--ff0099dc-cbe4-46ba-8203-433e5e3df96c", "indicator--9eb4d7df-2182-4a71-85b6-9cbf6e67e493", "indicator--65f1b4ad-63d2-43a8-bf95-e11a31aa1466", "indicator--184ebf05-b8db-44ab-b5c2-bf9492d54ca7", "indicator--d15de891-9b26-47d0-a7df-ea7e32e92fe3", "indicator--0d7de91e-fd6c-4e83-8a1a-77cefd24931a", "indicator--65334fdb-b4fd-4e1f-9786-8d5afa406465", "indicator--b704bc28-059b-45a7-921d-f3b0561c1dd3", "indicator--2d31ecb1-892f-40b2-bb98-fdcaad446bde", "indicator--ac81f810-058d-4b17-814b-456b28500596", "indicator--b0158f92-da69-41e8-84c4-1e619b07d668", "indicator--60ff074c-204b-405d-8a50-f09e6b0bd907", "indicator--0d3a1864-9380-4035-a0fd-776b6c678ea1", "indicator--1b561519-c177-4c99-ab30-9decc3ebfa13", "indicator--a6c8751f-231a-4f9a-9cf8-68db8a6c760a", "indicator--611f8528-020e-4a6c-9803-8daf9ad010f4", "indicator--ded0f75f-9bab-4da0-ba69-9fd972f42ba4", "indicator--9a79fcc1-92c3-45ea-bc6f-7dce1079bc4c", "indicator--56d89400-6f64-4e4c-965a-83b1ea89e10c", "indicator--493ceabe-11ca-47ee-ba1b-22330277b1be", "indicator--f03e94c1-ed4a-42ad-9a67-5b99d91964c1", "indicator--1ba4ac9a-ffc6-4dfd-9ef4-8c9e909a1ee0", "indicator--bffc4eb4-809c-4adb-8c51-062c9148c005", "indicator--972675fc-10ed-4041-b978-5f15a3551a5b", "indicator--fa6968c7-936a-4052-ab1d-2688465479a2", "indicator--5bfbd4a1-a478-40f4-9d69-0157f3f23a41", "indicator--5904d93a-8f77-4afd-85f1-528770c4d78a", "indicator--a7dedd35-3359-4ca6-ab49-f90a43877aac", "indicator--d9cc2854-d4b3-4469-91b2-833e46805b5f", "indicator--9c6aa25d-4f47-4839-9264-3892971dd40c", "indicator--81dbe1a1-036f-431a-954e-6da19843ab18", "indicator--d03d25ea-143d-456e-bd91-6695d104592e", "indicator--70b12105-cb6c-4499-b085-750f5073f081", "indicator--e84a171b-5f6c-4922-aea3-c4e6166552f0", "indicator--47cd9f1b-e182-4349-989f-22929adf66f4", "indicator--c173e7e4-ca71-45a3-b11a-213dc1fff5ad", "indicator--cbad5474-8499-4c56-a37f-a16645ad7a6a", "indicator--bcfd380b-7966-455a-bce3-a85c3925ec63", "indicator--91aad627-2ffa-4b96-bc09-a29332bf701b", "indicator--28052656-1ac4-46f3-922c-28a813238520", "indicator--423d27ca-90f2-4365-a392-aa2a051dca47", "indicator--d975ec25-9224-4261-99fe-003620466208", "indicator--b5c8f402-3b9e-4a04-a8fb-09c477a53cf5", "indicator--01f3b363-2612-4f7a-95ce-a09504828492", "indicator--db6123b7-1af9-43ca-9d08-67137c8b5995", "indicator--9a84a96e-f97c-4e3b-ab38-781455fc0a1f", "indicator--3f279dae-d39b-4932-94cd-9bd964a50c51", "indicator--46376e09-03e9-48a8-a88f-a766bd996146", "indicator--ac00b767-77f1-43e3-9e3f-5602762f23e5", "indicator--20dbcfda-7dab-41cb-9703-b8aa26fc7721", "indicator--fa5d8550-47ab-400d-a259-d2932bdf8ea2", "indicator--f1307713-6ec8-44be-b25d-40f7a39412d8", "indicator--f7af380f-e456-4709-ba8e-5b0e6f5dce4d", "indicator--a8c6cdc8-55f7-44ac-ac58-c3b118564d98", "indicator--37e3a1e5-c6e0-468d-81fd-c2944d9993e1", "indicator--2c925ad7-d728-4c72-8b84-5b8e35e4e63b", "indicator--6de2c175-25c5-4cab-82c9-fe0d5a1b17e8", "indicator--4fef4969-178b-457e-9186-7bfb374fd0f2", "indicator--9c86fac2-87e1-4958-9a8a-05109e3af3ba", "indicator--d0e704ec-6130-4735-bb45-fa684693934c", "indicator--85514a4b-125d-45ab-a818-15a445a09d47", "indicator--be2e6558-d4cd-4da8-8a4e-fc71a66c34ea", "indicator--9b9f8cae-7738-4775-9ad7-a4cb0a80ba24", "indicator--89e5c806-662a-4e44-be5d-10883d1ff051", "indicator--ef826369-bff3-44ca-96f3-8d16c0aa50a4", "indicator--371e0e56-1287-4981-8462-b08fdee89ec0", "indicator--55b04b06-2f77-496f-9384-26c966bb10b2", "indicator--bae5c66d-8740-4e75-a310-ded173971f71", "indicator--dbae5095-68a8-48bc-acb4-526709e4e5c6", "indicator--c0f8b345-b76a-4b01-812f-f46735f6b56d", "indicator--2a090531-81b8-40cf-bfb8-8902540bb83a", "indicator--a6c4244b-8354-4cbb-902f-b91d85cb1167", "indicator--2730b544-3ebf-4102-9fe2-46e85c9f95f8", "indicator--7f91f589-4ad7-4fcc-b1ad-8033028a1d51", "indicator--ca84e477-2698-409d-a857-59c93671e498", "indicator--85a8aa38-e500-4f79-9ec1-4f41aa78e0d7", "indicator--56752d41-6d5b-426d-a1ca-ffe2450e01b1", "indicator--53cf13b2-0271-42ee-9914-206dbef82670", "indicator--5811774d-bcbd-4104-92d4-d02a9905b831", "indicator--282e8a53-7a9c-41f8-b46a-8aff171c7f82", "indicator--d06ca8d4-6d71-4353-b8c6-ed1a0f5650dd", "indicator--3ad8cfdd-6069-4bb6-a400-c3024a4e3fe6", "indicator--80c548ba-dfbd-40f2-963a-d7e3640c68c7", "indicator--72339dca-db78-47bc-9ab4-d5cd207eb2db", "indicator--bc6179a6-6b88-4264-992a-f68f2689a6bc", "indicator--6e3bb636-b0e3-47de-b543-73b81f98856a", "indicator--59c61a1c-6938-45c9-9278-e3971e1fb21f", "indicator--fe49cfbd-8d5c-4176-a2b5-68be61e96df0", "indicator--0ee68c2c-0fb9-435f-81ee-c500b92c7354", "indicator--c6d20a0e-82bb-4386-ac61-260c43bdfdaa", "indicator--94a7e8c2-4158-417b-b107-bb341ac9dc09", "indicator--5814bb36-d77d-4f84-8d50-02862407c879", "indicator--d48c98bd-fd74-4748-b41e-fffefd16064a", "indicator--42e9e78d-ec63-4ae0-8d50-4ab3740de003", "indicator--168c1b26-e1de-4a8d-85ca-d84dfdc1a840", "indicator--90b60c51-f7a6-4fe4-bbef-0a799fcc4397", "indicator--35d47203-bf7d-48e2-8825-39fabe1176ad", "indicator--f907a3b5-16ae-4e61-bc27-b9413b23e334", "indicator--8330e99f-0234-4e13-b63b-0646afcb8939", "indicator--822f8a5d-af65-4d19-9d38-d7477db84f89", "indicator--2119ffc2-ec26-40b6-abea-7c05a7169612", "indicator--cea7d869-9b7e-4146-92ca-12b3eb69a043", "indicator--ef782791-e1eb-46db-9a40-e4a8a6a0573a", "indicator--81708565-9608-42ee-8fc1-76a5591ac906", "indicator--51be558c-9f38-4357-a809-4e8b0204e00d", "indicator--14cc8582-8a41-4400-8532-6116d308c960", "indicator--a2ae7995-2931-45c3-9ef2-4ed11117872a", "indicator--097e20d6-fdee-457f-8242-fd160317afec", "indicator--92f3b7e1-05c0-4af5-8e8c-b9b81e8a3cc5", "indicator--5482fe9b-d706-4f5a-9282-3f79f54e788b", "indicator--2eed9a58-1c7e-4491-81a2-4402612c5411", "indicator--05979a5a-353f-4af0-bcf7-99bc222d5f6a", "indicator--b63d7099-b695-4eac-94ac-0ecaacc4b53e", "indicator--ef8a88e2-0868-4ce3-892a-3bf9a5ac81ee", "indicator--15d40b66-bd65-4c2b-a5e4-91845d5a702e", "indicator--b1ea700f-9d09-4ce0-bacf-34bf98038c52", "indicator--3f6e7de0-d0e3-41ec-b679-d8492f261ed5", "indicator--924df662-5098-4508-8d9a-31f72d2b0e59", "indicator--3c13c948-cbb8-44ae-8fc3-07e558c3f6f9", "indicator--ba10b396-0e51-4eeb-a66a-dda2d5cbd25c", "indicator--c472324f-b0d2-4e33-9cdf-9b5da083e575", "indicator--19daa64d-1108-4d8f-8c1a-fc8f7be51c0d", "indicator--66689be6-ad19-4fac-b8c8-bb5278ef0c19", "indicator--26b52f89-78a3-4ad1-ae97-82db5477250c", "indicator--8868859b-1382-4726-bde7-b1f3ac9c3bad", "indicator--7e261195-fff0-4a98-9853-a3c4f8623b8a", "indicator--1931cd0a-4e40-4ee7-91f0-574687b9cc96", "indicator--c0fe4caa-8c74-4fe7-bdb2-2cc7f998988a", "indicator--e96f2b62-bd25-4f49-b86f-567a842abc2e", "indicator--530c6ad3-24dd-4dc8-906a-8f400eadae3f", "indicator--e0c3f789-b62d-4dbb-8871-a25d21dc0b10", "indicator--a4b4d134-2afa-4fe2-a8ea-1372bcb6dd2e", "indicator--02eb1df1-957e-4a60-ad17-7d5ef5897687", "indicator--c2cd962b-f279-4ab5-948a-a9ab2a5e365b", "indicator--1cd008ce-5e4a-4d57-8338-c308983dedbb", "indicator--caa3c736-f0d8-476e-9305-016616081380", "indicator--e0318597-4711-4ee6-8e85-e000c5b5b7fa", "indicator--92695514-e798-4c2b-b5d2-dc87c8742bc5", "indicator--2b7cca4d-4c08-4619-a81f-52ede8a9d7e3", "indicator--edac817d-57e3-43df-a64c-134f200bcec3", "indicator--282e5fbb-8bbf-44c6-82da-d9c3ad694cd6", "indicator--c679df31-a492-400f-a29f-f4d6fd7715e3", "indicator--14517e31-d23d-4333-ae63-eb3d6076a0e6", "indicator--d74db98f-635c-4dd3-a17f-b975026965fd", "indicator--1b738475-2f0f-4e97-9803-abcca88bf843", "indicator--90014f3e-0838-4fdb-ac26-56347e45eb42", "indicator--ebb82183-f941-4b24-a5a5-23d10ae8f477", "indicator--1109e309-2663-4906-aad0-869130f10ee0", "indicator--0cb42a42-3084-4d68-bcdb-b92c37b69fbd", "indicator--09ad3e1a-5833-4c9b-bd08-7643da21e5ee", "indicator--9d6f5c3c-662c-45e9-b4b6-6cc7907ed8a7", "indicator--7da04362-29e1-4b8a-bac8-afe7f87d3eb3", "indicator--e2913811-066a-46ec-bd3f-971d6de863cf", "indicator--27e8ac53-9759-4bc7-83c3-2c5e95f248ec", "indicator--8c0dba3c-f5a6-4127-96a8-c2b4fc1a1091", "indicator--949c7f05-4697-438c-af7c-c18002743bae", "indicator--8c39cab6-3884-4881-b7b0-8a905a4eeaa8", "indicator--d481b7fa-e785-455a-802a-54bcc567db33", "indicator--95e30906-d29e-4a0e-bacf-7f995f7b4c40", "indicator--1ef2ee1d-462b-49a7-8cb5-e526741da182", "indicator--5946a455-21d5-43c2-884b-5277c8fe7de2", "indicator--f0347ad5-ddba-4e5a-8ea3-08f2c83310f1", "indicator--e05fc40c-a1b1-4fef-ab24-769cb8767e3c", "indicator--22ae8155-0885-4bee-9e59-18c88af26bd1", "indicator--98c43d8c-7587-4a19-a56f-b0bec5b8fd93", "indicator--a73c363e-2127-4b28-a5bd-6f2505a14a71", "indicator--a8b9f0ec-cb0b-4b12-88b1-bfc3002c9b04", "indicator--b88754a1-734d-4946-b441-6033f3f762f9", "indicator--3dee4c57-3263-420f-9574-b53df6ff65d3", "indicator--f8059670-24c9-478d-b06d-11094e3fe150", "indicator--d0c40226-6b54-4f07-9f89-2c3f15d765c0", "indicator--ffff65a6-5296-4704-8f8b-c45fae1b060b", "indicator--c3cea895-88dc-419d-8275-e051eeda1366", "indicator--4b6d2952-64d6-4e90-aa7b-8425dfad623a", "indicator--c66b398a-a24b-40d4-bf95-85050dbd8cd5", "indicator--f50a1fac-0b87-44a9-8ec8-5eabd5641f6f", "indicator--4ac69c05-9205-4eda-94b1-2f2db33a4da3", "indicator--3da67fb1-3446-4821-9427-0e24766e46fc", "indicator--1c1828e2-d153-403b-9d3f-ba93457859ca", "indicator--040069ea-f5b2-4d3e-969b-cad0152eca3a", "indicator--8f8cf486-8d56-4587-9916-1fe2991c40ac", "indicator--4dfea04b-9dcd-432f-94ba-626db7869ef8", "indicator--afd66128-3925-48da-99c2-2c9e8e7da06f", "indicator--dcf6d496-8f2d-4d4b-9733-19c56c0f5302", "indicator--2b5b6fcd-3944-49b4-9915-24cf84aebabb", "indicator--f2296059-8365-4e76-af85-f83367fa4367", "indicator--70060145-1297-4e30-8881-11008780115c", "indicator--799ffbda-51ad-43a9-9b13-981ef14e4ba1", "indicator--911e1455-4609-42cd-bd3f-acf3d63319df", "indicator--91c9b8a8-e246-4e41-833a-5869b339f947", "indicator--54043726-1317-443e-abc5-10b96b30674f", "indicator--7cc61e11-f39a-47c7-abcb-af570c748353", "indicator--88e4947f-8312-413e-8892-54579aff41a9", "indicator--27ea3cb5-b018-42a8-902e-8cc52a5637aa", "indicator--28ee998e-be65-450e-a4f9-7706455a6197", "indicator--7ec6cf66-6345-4d70-bfc5-5671f4449839", "indicator--ad015269-e3c6-4ee6-8fa8-5dd39507fb7a", "indicator--88916d39-9374-424f-9f1e-055319a059f0", "indicator--2cc9b1c3-815b-4781-ae74-b9c906bcaca6", "indicator--4829021d-9efa-496e-a47a-6e2fc0b42087", "indicator--eb04189a-3b64-47c5-b412-c173bd86fab3", "indicator--af79abcc-9e33-4146-ab01-f4523334a92d", "indicator--420eb0e4-181a-4699-bab6-7dacd8e19e6a", "indicator--3b20e29d-2fd9-4b88-b1aa-98e179979881", "indicator--bc9ef361-4448-4c1f-ad46-9f6ece1ff10e", "indicator--c1f97597-d17d-4259-9498-8416b5c101d6", "indicator--2db4acd0-89dd-480a-83f1-8907ffe41306", "indicator--baba5194-9435-43dd-ae2a-59302886f2e6", "indicator--db823444-5966-4544-8154-c6b25489756c", "indicator--a8c12b9a-688b-4733-8bb3-a663cf4ca8c9", "indicator--c55b4906-ddbb-4d6f-b484-d408aa50b2b2", "indicator--efc14f47-dd2e-4dc5-a999-058fa8bf2b56", "indicator--33cdc35d-2157-4ac8-8542-e50c5110522f", "indicator--0bc19283-5fc5-4ed9-93b5-49140c3ea76f", "indicator--11df45f3-55d8-4074-89b2-708f20ebd78f", "indicator--400c139f-c2ce-49f0-8721-28e2d3389de6", "indicator--93947275-4dcb-4c07-92cb-2ff83f865299", "indicator--c466226f-a2e4-46b6-8ea5-6cf8536beb18", "indicator--078a2169-de4b-4d27-8f2a-a6694a1c10d6", "indicator--e5a8ce5d-8c1a-4285-92d5-25c7e3117096", "indicator--f7626707-8581-4e03-8c33-1837686b0b59", "indicator--a3b988b4-f8fa-453a-b9bf-96039386672b", "indicator--962e83c7-28e6-4d85-bd42-8de7206dfb21", "indicator--34445589-d5ce-44d8-8667-0990c1cf6389", "indicator--baeba5de-fb18-40d3-bf44-a74abe9a83cf", "indicator--ddaf6281-47cb-47fe-8ea9-bc43134eac9e", "indicator--292b3aeb-fc0f-487f-83e8-9d866cced8c4", "indicator--3be47d5f-9345-4449-9e06-2490fb80cd22", "indicator--dd093d83-5c69-4a8e-8d67-3183bd22b62d", "indicator--dd9fdf6d-a710-47a5-8628-b993b1b65f58", "indicator--c8720b1c-e9a7-41fa-b7da-a5c5f171cc5b", "indicator--d18a80c6-4037-413c-911e-d715773abf5b", "indicator--712b5772-f9ef-451e-b126-2916f66ceab0", "indicator--6b637e38-80aa-4324-bdf8-a18d2ca914a3", "indicator--875d1151-bd95-4737-9d1c-7eca72835571", "indicator--fcb9a17d-926d-400f-be93-1d5e01c2a946", "indicator--19e80ed1-8f40-4a8e-9d11-e215decf0da8", "indicator--5007ebbb-56e9-4ca7-b3b6-6a4402952c7b", "indicator--f1f395af-dee2-4436-9d1e-1c7504f4e1b2", "indicator--0122c3fb-2309-4fda-b460-0516bc00a3bf", "indicator--5048c45f-a9f6-4ed0-8da7-133ef3192294", "indicator--e3b2c564-635c-4bf0-abe1-f3372c5fa129", "indicator--d9484a11-f8eb-4d61-b1b8-2280f370c25c", "indicator--dfca52d7-c0f0-4367-b318-627df5fc693b", "indicator--40d4a01a-77ef-49a6-b2d1-2f3f94c2348c", "indicator--43c0c1eb-7272-453b-8363-d2fceec50082", "indicator--673ada47-c154-4424-85ff-7eccf0addddf", "indicator--61b667eb-cd42-4486-b1e7-a7595ff2f711", "indicator--17f333b1-f11b-4fdc-9020-c565ac72b1c5", "indicator--29e36fef-f5c0-46d9-8383-2fbe0eba5ce8", "indicator--6a8b9f07-7aef-40ba-99ce-ae14b8bcd8e5", "indicator--41d9a60f-587b-4f73-8da3-ad9297cd56f1", "indicator--4f1024e6-4dd9-432a-af80-6bf558339bca", "indicator--99bc783c-69ea-4720-ab0d-417d6bae3fc1", "indicator--c7b5e0ab-3ab0-4b55-96a6-75a002a6f39a", "indicator--785eabe2-1af7-41f1-ab1f-b3088f1b6972", "indicator--521bdbdb-5c8e-49d7-a434-1ff9771591a2", "indicator--6232c151-89e0-41f4-80be-aa182bc5f63a", "indicator--96fa6178-38e6-474b-8504-23115193c5c0", "indicator--877c2425-f4f6-4874-b985-6fa08bbc37e8", "indicator--2bea6e8a-e58a-4bec-8f6c-2407f92148a7", "indicator--62cedc43-1d22-4aa8-a300-b5101903c08b", "indicator--c1dd8fb2-1350-43ab-b0e4-2a0c1289a3e3", "indicator--89cd56e4-bb98-4118-a1fd-cf757080f964", "indicator--7cd0570e-575c-40d9-86f0-cab91564b37e", "indicator--625c3df6-97c7-4933-a94b-01df4d94c397", "indicator--72d3c4da-fc5a-48e4-98b8-b626712cae1b", "indicator--ba3d79a4-8e6c-4457-83a0-a15aacf91b57", "indicator--209bdbd6-bc95-412c-895f-21d391ceb490", "indicator--b49ba6e0-aed2-44b6-a6c6-7024279d7476", "indicator--736c7584-0a64-4850-8bb0-3a5e20c7fa34", "indicator--fed3409c-3464-4000-98c7-5f6f48b1473d", "indicator--56971d21-cdb8-43e6-8043-67901d60fa3a", "indicator--5368f1e2-b78b-4409-8a39-e92ef019a6e2", "indicator--8473efcb-033f-449d-9be3-bbda346b89fc", "indicator--389b231a-5cd0-4cc0-a82f-5878d4dbfa4b", "indicator--a13182e7-bef1-4ed3-bb4e-3848887fbda0", "indicator--0dcec47c-1d48-49de-8be4-43dd5300d151", "indicator--46ea9f0c-597f-46a1-aa46-8e39f90a09ff", "indicator--8e1b907f-fea8-404b-bd0c-52fa75e0f386", "indicator--5df7d0af-6cee-45d5-92a3-fd4a78834ce2", "indicator--8a7dec72-5fa1-4696-852e-43846170b8dd", "indicator--ac17d8a1-68d4-4cb3-9416-7b55ff3dfef5", "indicator--168428c1-7796-4930-baab-b28a8f43b0df", "indicator--33f3bc8e-f3e4-453a-a2f9-230325d0f062", "indicator--3859b636-61ca-4461-bd62-e6cbe61fa47c", "indicator--7aaa5ca6-da44-4a2c-a1ee-31a83db61f5c", "indicator--b7aa7e89-39da-4739-ae86-76f02b9fe9e5", "indicator--a76f54fc-b491-403f-bbdd-a34209383c70", "relationship--8e14689d-31c0-4e10-9e6b-4966b267c40a", "indicator--2ff6006a-ae7d-4c92-853d-e808c3432127", "indicator--780a5d09-85ff-488a-8e2c-5c19816bb097", "indicator--9b566de6-ffbc-4718-a208-422e72ccbf54", "indicator--9c9809d4-4874-4e2e-aa68-9882e2381a63", "indicator--66a493dc-942f-422a-99d3-4b33f6f40394", "indicator--ade55e4b-8d56-4d45-8dd1-9abb5652c4d4", "indicator--820d8f43-56bf-4c57-9122-8b2890b1b434", "indicator--c0004a49-12e7-4f7a-b589-3e5e5f771c49", "indicator--496d6241-ab6e-4946-bd1f-0a7fe9b3a3f7", "indicator--8139e5de-a306-47c5-9d4c-8d3a63cea2af", "indicator--a3947ed2-3321-4123-8a9c-bfa1c35b1347", "indicator--e9be5d87-ced0-48e0-b51a-2590a2c944be", "indicator--54d03b6c-6700-47ba-bb45-cf053170fc8b", "indicator--3348c11a-f61c-4116-9056-ade84942d3ca", "indicator--dba4395a-ce8b-46f2-9a0d-1f28186b8228", "indicator--73ab498c-e6b2-4f90-ad66-9948fc499ff1", "indicator--83a0b3fa-cdcf-4843-85ce-7c33737d702e", "indicator--1bd906dd-cedd-4e68-a82a-054501f42a5f", "indicator--2ca99b42-d1e0-4b6b-9f2d-daa6e2ebd851", "indicator--6c141356-da4b-475e-91d2-694d3152c8cd", "indicator--5692fd4f-9bd9-4670-a9f2-fe70f8754f0f", "indicator--d2705b22-9e39-45c4-84b5-5f6ba2e0a32c", "indicator--9bb65cbe-ab73-4299-8dc6-659255634d31", "indicator--e7209df2-f921-4a04-8e1b-9404a42506b1", "indicator--acc9a955-4924-4866-86d5-29e7e8b0192c", "indicator--a4f31cc8-cfeb-4cad-ba6f-195b3145c944", "indicator--7b2b82c3-a422-4dd2-9c63-076f92275310", "indicator--551a7315-1967-4720-868e-900c03ee933a", "indicator--4b0c5367-bd51-4aeb-9d60-93772a0454e5", "indicator--8c71024b-7c3f-4281-a455-c6efd8a1df54", "indicator--53b5cf5c-bc9a-40bf-9613-fb721a16de53", "indicator--afe16a1a-0918-47b1-9cd3-c4c510d8ea65", "indicator--c8c9614a-1c5b-4308-a750-54d8d7ac9ad1", "indicator--e748c3cf-4ac9-438e-9bf7-7816b83addeb", "indicator--36c672b6-d99e-471e-91ef-1944ffaa61e4", "indicator--fa8da125-f9ce-4b05-9fdb-d65627ed04f9", "indicator--94b9c2ea-0e61-4963-a17d-68a8e7e931b7", "indicator--b8c0eba9-589b-4791-b3e9-8229be26e389", "indicator--d9411f59-7df6-4617-bc2e-95cea5b74cd3", "indicator--16b57535-7cc1-4666-8876-00df62120541", "indicator--fe4556a1-70b3-42d3-8562-7ea2e6ada9ec", "indicator--8a5d09fb-ed29-41a8-99f9-9c95ae922594", "indicator--34826c2e-7fa0-416d-abb4-06fef488605e", "indicator--ec77a980-def8-45f0-825b-9f57b02ff15c", "indicator--748088c5-8bdb-4e1c-bc9c-8c2d11507dae", "indicator--89ddec98-a0e9-4d1d-9cc6-cb591d97d51d", "indicator--47939b94-bced-48af-b58d-e3e20f95669e", "indicator--e3276205-ed0c-49d3-9be1-98cf3cd2730a", "indicator--7f31e550-e67e-4959-a258-67c0d6225572", "indicator--dfa6f319-7a6d-487c-b044-4f3c6b7ebfd7", "indicator--a3663c37-1b88-421f-8138-34a512d3bb25", "indicator--c414e04b-eab7-420e-8e57-1a07386c8fd5", "indicator--80793286-8da9-4f19-910c-f604500baa8a", "indicator--8a7ca859-6024-4958-adc3-b6c5eac9a5f5", "indicator--7c984d20-8dc3-41dc-8d01-10452b7fec1e", "indicator--0fae45c8-980c-4c1b-960f-564156846708", "indicator--10d9de03-700e-4d1e-bdfa-3bda9b75a6f1", "indicator--90086d2d-c405-4895-b6af-41ab1c7f4a73", "indicator--eaa8f68e-421b-4294-abe1-a13e0eed7b41", "indicator--18182321-f3d6-47b3-a24b-1994eb4a1d75", "indicator--48490de1-9ebe-4126-a989-aa9f77f4237c", "indicator--af5584ef-28ea-4fa9-ba50-c776cc574897", "indicator--3dc13ed5-290b-4aef-bd69-c380f9b9820d", "indicator--482ad5df-e425-460c-bc5a-0b69d83ff315", "indicator--6f7f0b3a-51c6-41f7-926d-8a2d727bb477", "indicator--6dab903b-bbed-409e-a9ef-61b51c1020e2", "indicator--f680b09a-e77a-4e6f-afb5-18c2c669cd7f", "indicator--a61da758-b59c-4c74-8c02-7d3e08aef9b6", "indicator--8485dff1-cffd-462f-a095-6427de039817", "indicator--a021eb48-7b69-436b-9b93-a7bd8a8a208f", "indicator--491ed1c7-313e-4003-a1f5-8c93c21184fa", "indicator--580fc3ef-d1ee-4a40-8884-d0b7a81beb52", "indicator--c12b8d8c-274c-4d2a-ae5b-e9b4dbc6c6dc", "indicator--89f90f58-c818-4309-8e5a-56fe46e1d0ce", "indicator--309a906b-52f2-40fb-82ac-a3b3c0d702e2", "indicator--28f7e181-24a5-4d0e-86dd-fd539551135f", "indicator--10e41ad1-ba1b-4478-85cb-5e14b531a279", "indicator--d1d2af77-e37f-4418-9c53-82cfdd35eb0d", "indicator--225625d2-3011-4902-a6da-3c93d57d84b5", "indicator--c401b5a6-0414-430d-b0ee-ac3ee8310c32", "indicator--407bcdfa-4df2-4854-bd72-3350ba4c52dc", "indicator--05ab759e-a829-4d0f-a4fa-98b65181c0b2", "indicator--97d2cfa3-a661-413d-b126-a521279ef9b8", "indicator--2359edd7-8509-47fe-a0a8-db35a4c34710", "indicator--064ad19c-12b7-4029-a253-35d813cc097e", "indicator--9d72437a-4858-42d3-a2bb-e938ec688f72", "indicator--1d920d2a-f93a-4ef3-a57b-800227104638", "indicator--789ef89b-8cc7-4bbf-b8c1-bc16a4a844ab", "indicator--6fb7c557-ae97-4f9f-9776-727afb524001", "indicator--d6d4b43d-a8e1-4abb-97cd-88a6db780faa", "indicator--b6c025c7-7696-4171-abc2-3e297fee48db", "indicator--9bdf8476-b469-45e5-8cbd-bf448187aa15", "indicator--db2d76f9-1882-4a19-aa62-198cd647a754", "indicator--75bb0e25-737a-4be7-9206-eefd5dcd5a9f", "indicator--7032b772-dd33-437c-aa90-c9f6ec1f6cce", "indicator--942d0a6f-a306-4ee3-a9fb-1668ce2aa166", "indicator--25be9273-4968-4cc1-9fcf-73e643d40b96", "indicator--66f84d14-4786-48b6-a31a-45af770524c0", "indicator--14236f47-66d6-4480-9556-234e57ab48f5", "indicator--c41abcbd-287c-455b-9486-271697663008", "indicator--db702473-b9ee-4133-bebc-19b1ed15e99d", "indicator--8438a265-e521-4cc8-a1d8-8f85fd765c62", "indicator--82b1393a-c58d-454f-90de-e2be19077f94", "indicator--59ae8b50-c57f-433c-907b-cefd924fac3c", "indicator--a78e0646-b032-4c98-ba3d-0e61b2c7e932", "indicator--77398b6a-6917-4df3-823d-02a143a58e7b", "indicator--1481c7f6-6c1d-4cc7-9d47-7d5b49ac434b", "indicator--483fb61f-6727-42c4-98c5-51ae7955437f", "indicator--00af43e2-2861-41d1-a3a8-e6bb6f1cba58", "indicator--1af346e2-b0ab-44be-b426-109f06ecfca8", "indicator--6590d8c6-4c1e-4f43-bd9f-b5ce408d6b15", "indicator--9d80569a-16c6-42a7-9ae9-672ff6bbc86f", "indicator--d6d608f4-4634-4f33-80a9-50aac9a9bccf", "indicator--6d2c33ce-1c71-4aff-bee6-8821eb4d4e3f", "indicator--76deb6ad-7713-4341-b736-ba67914079e1", "indicator--31474467-7575-427e-a49a-1617fc16d6bd", "indicator--d756aaa8-610d-4e2b-b8ac-8b365a7c8ac0", "indicator--0153f05a-4813-489b-8f63-63f1f0f53419", "indicator--aa1150ba-f223-4d84-830f-7925018accab", "indicator--93e17408-ea9b-45d9-b4e4-955c4a95806f", "indicator--e89fc2be-583c-4338-a0f7-f77c2f71559e", "indicator--3ddfd618-907e-4c54-b56b-b470564b8ee0", "indicator--00d9b80b-3b59-4b38-aca8-c4355ea9014a", "indicator--7f44e2ab-b572-4710-a05e-170bf5de317d", "indicator--422ed697-fdbf-4747-9746-26109fb587bc", "indicator--d30de378-f592-445a-a250-07d6fddec1a1", "indicator--138bd8c2-2267-486c-9719-a99df5cd0758", "indicator--ffda48cd-9a3a-421c-9c7c-2b0e3998e616", "indicator--b0b2f9b3-be17-4573-a99b-65d1d1700374", "indicator--beb00c16-9cd7-46e9-bc23-f9697e008381", "indicator--7a033ebc-1f37-4818-8d2b-d19ab0daddd3", "indicator--09191da5-1266-45f1-b2c1-2e45ff089abe", "indicator--d856dca3-caa0-4bcd-abfc-62a74a84194b", "indicator--738eb2f0-d140-4000-af75-27b6b5a364d8", "indicator--63201a26-ee46-435a-98d5-d560d66087d3", "indicator--882cdf3e-0abe-4ae2-801f-14272b5228af", "indicator--4ae81507-8606-45a3-8aaf-c3710efd8b11", "indicator--2840c69f-180d-4771-afbd-fca814885799", "indicator--b91b1327-94d7-4b83-aa51-1336bc4b3efd", "indicator--ca4b227e-9fd3-44ff-9533-f6a9578881ef", "indicator--494ecf78-bed2-4668-88cc-38cae347d41e", "indicator--5cec3175-efe1-4487-bbde-f5a96434f3ca", "indicator--a98878e4-6409-4b14-ad10-9d5a19054bf8", "indicator--7b5cafbc-594c-4961-9037-e729a9c02fa8", "indicator--1f00d57b-1738-4ed6-be16-35d4894b9765", "indicator--5d0a457d-f2ee-4b42-a1d9-8112b4f34b08", "indicator--3fa4455d-032d-4005-99a7-8b6dcb1aae17", "indicator--af65ac99-490c-4f82-943c-9fc4ef698a77", "indicator--85c8bced-2f10-4b3b-a634-003937d78323", "indicator--4615906b-6ad5-4ff7-a80d-c415f595debe", "indicator--537e987f-77bf-4904-a9cd-c902534cbdd7", "indicator--aa1457d3-9ea0-4f16-9ae9-7921b9411368", "indicator--f038feba-746a-4231-b61e-5e607566925e", "indicator--9d8b6132-2f6b-4c83-913e-b7810a693d02", "indicator--36aba620-0342-4843-a29b-335223af910c", "indicator--48093d2a-bf19-42f6-b5ae-3c9a0d056e62", "indicator--2f1f9c65-d4dc-4942-b3c0-ed7b3af0a247", "indicator--257993a9-992a-478e-8c8e-d6f8e0e44183", "indicator--e84e87a2-2d16-4ae0-8e2c-36c1c7fcb178", "indicator--516b291f-36b6-4d70-93c4-05567f57f2c7", "indicator--e029283b-1f2c-4d2c-9646-8b8c9b57eac8", "indicator--9ecb4b21-1f29-4227-a88a-96d491b16468", "indicator--1dec82d6-27a8-4b84-b828-e51c771aa6ee", "indicator--7b49eded-b716-41a8-991f-90762492e509", "indicator--13512c04-ccfa-42fa-bf09-f240eb761dad", "indicator--1fabb9b1-858d-4af4-ae5d-3cc0f81129b4", "indicator--9db0f33c-7416-48c3-ac98-4315150b32cd", "indicator--f5176777-5afa-4e26-a99a-33a60f850b3f", "indicator--4fb59fc6-dc88-40e4-8098-3689c2bf6a40", "indicator--e9257c1c-8475-4bf4-9b42-02ec18d4d4b9", "indicator--065923c6-a02c-42ba-b6ce-3c562b46706e", "indicator--6234cc56-3a3c-4d04-95a9-41afd013654c", "indicator--fb362a15-717e-4d21-a519-d175b74eaf47", "indicator--edeb17b4-010c-4a84-ad3e-250b5a01b7ce", "indicator--5deadf70-62c5-4af2-bbfa-ba73a4599e8e", "indicator--e68ed0ab-dbd9-42e6-9eff-b107ac9ae932", "indicator--866f9544-9334-4f81-966f-3093198447a9", "indicator--2fa5ff54-85bb-4c1d-ad3f-ae55d7c2707b", "indicator--0d7f9695-424f-4002-9909-eacfe4a5b3ee", "indicator--52d77063-b4c6-4e17-b6c4-5b9bc6c1bde5", "indicator--5a7dc600-0380-4664-a0a6-113bd6654731", "indicator--f9737666-cfe1-47b4-a472-d6e2b927ac2f", "indicator--54d03edc-99fb-4730-afa3-526af475d69b", "indicator--7c14f7ec-508a-43b9-a080-d70f4f771517", "indicator--672825fe-5bf7-41f1-98f7-6fc503512b1f", "indicator--7dc834d8-4e2a-47c3-a6ef-bf901f634873", "indicator--99c99a01-af45-49cd-bf9f-6c8cda112cd8", "indicator--50a2aeab-e66d-409f-8a42-1eb10b718dd4", "indicator--81bab201-8c5b-4338-aa2c-d9cbde3888ed", "indicator--4d6740da-cdbd-4103-b0ea-7f6084d29082", "indicator--39aa7187-fba1-45fd-b776-5b8919bb322d", "indicator--2c7e121f-7f6b-49a9-a070-33bc2e25921d", "indicator--1eb73175-8a75-463d-ac82-318e153ddab7", "indicator--2394d2ee-6b83-4025-94e6-d9bdb06eeed6", "indicator--bfd65fb7-90bc-4876-be25-13875a4b2edf", "indicator--4eeb22d1-9732-4d08-804d-4bdf740d3574", "indicator--36c4b76c-6c44-4765-a7f0-6f0559501cd3", "indicator--e2e000df-d497-4d95-8491-0e23f60c1e40", "indicator--e1142226-a193-4d16-9518-b711ead327ef", "indicator--ec9e99d9-6a36-48f4-bab0-b3ecd03bacdd", "indicator--9a98726a-931b-4faf-b002-c16d0103fbb1", "indicator--a30075d3-9bd6-4542-86f3-f2c362d76b8a", "indicator--078bdd1f-8edb-4317-9c62-8f6fe01d566b", "indicator--9a7e354c-f875-4c9c-ac15-c95f90aa303d", "indicator--d20f29c0-534e-45ef-a8dc-635a55673e71", "indicator--0331a2a4-17cf-4741-a1b2-cdf59495657e", "indicator--277c9a1e-6aa8-4d8c-8fa7-8f7b2b0d9b4f", "indicator--5fe2af4b-6867-4886-b17c-621d08a3acea", "indicator--aab5906b-01d6-4b65-9dbc-57f02875b3c1", "indicator--6386fc75-a54c-448d-a84a-b12a9bfedd13", "indicator--848d0e3c-ac8b-4c8a-bb96-5e4cc6804b47", "indicator--671fa09f-d200-407d-b60b-4eea1d0d750d", "indicator--024268cb-2d51-4f69-bd8a-99ece13de4e6", "indicator--80c2d657-90b9-4d56-a836-3834ede1fa8d", "indicator--e6ae847a-9702-46f0-9c15-d5616d966ee1", "indicator--8baa313d-cfb1-48d1-913b-2fbb429d7680", "indicator--f16f4937-fc66-4904-ae54-0405cd330535", "indicator--b2b4f8e5-b958-42dc-ac6c-48ca3489cf25", "indicator--229649e9-0ad4-4480-81e5-839b41af92bb", "indicator--a18078ee-8d1d-4176-be3e-7e8d65b9ec06", "indicator--cdeadea2-fbc1-4c95-82d1-0379e1775dce", "indicator--07dbd28b-2beb-4649-9635-b21facebde9d", "indicator--ba49602b-3c13-44c2-937b-4496efed29a1", "indicator--df8ea776-7a04-4924-b7d9-3cf9f379e818", "indicator--48dd22f1-1488-4675-bc8a-62f4eecd0227", "indicator--b59d0558-9389-4d0d-91d5-e8e002baed74", "indicator--7cee1d42-159c-4024-b942-9bed3b0a2b03", "indicator--058b81de-729f-4adc-98d8-882f265f4b24", "indicator--b398f02d-817e-45ff-8af5-bff28b08ef7b", "indicator--2c6dcfbb-664b-4612-aa0b-69062c7f7801", "indicator--e47f6a9a-599b-4513-a4f0-95f6d287cb31", "indicator--cdb47a7e-d4f0-44fd-baea-35f7fccbadae", "indicator--3b1aba2f-4014-4487-ad36-8e85220753b6", "indicator--d27b1e9e-5060-4bb0-9eaf-1e3202a7feca", "indicator--86c81464-d252-4b3f-a319-73449f4db794", "indicator--8f67bba2-c1fb-40bd-a017-e203424c51ac", "indicator--9033841b-a17a-4a60-b0b5-85ee1349ff55", "indicator--1e2d109f-5f7b-498b-be7b-7cd5fe965d2f", "indicator--b85448a9-1562-46bd-93d1-f5f45d9635fc", "indicator--82e298cf-6f8c-4a76-ad1c-745481cd5079", "indicator--5cf996e4-e1ff-4552-8fd5-2198ea9583f7", "indicator--aaa46e4e-7f90-42c9-ac2c-11d752121969", "indicator--0f78a702-0f96-48dc-920f-56b5da7b58e1", "indicator--43e80da9-edb3-4376-81ba-a2865fd96570", "indicator--e0e23164-8404-4467-a7f8-4576bbf366c9", "indicator--2b3fc0c4-9715-4493-9c1f-47fb04550816", "indicator--442b777f-55bd-4137-81ea-42df5d71549f", "indicator--c3f306a3-b380-4a36-bb77-40ea1448f1b0", "indicator--ee79e519-03df-456e-bb25-4b8a54de8092", "indicator--86627570-7ff8-471b-b278-76c12aa4f1f6", "indicator--accb45a0-1101-491f-89cc-2a1d83e64c76", "indicator--0d6b8def-097d-4f3c-a54d-40f5dca93b2f", "indicator--ea668567-44ac-4ea7-a4e4-3cfd2b7680b0", "indicator--8cbed472-437a-4e0d-90f6-f7aa45f4da48", "indicator--1325d9ad-237d-42dd-ae93-cc70820adfc4", "indicator--507a52d1-cacc-4a9a-acdb-c07af9c87f45", "indicator--82522c60-61fb-4662-9d3f-f7353fe9a73f", "indicator--173b7144-6af0-4102-97a5-d6c13034ebf2", "indicator--51a798fb-c4c0-465f-a97f-ffbe73a26b08", "indicator--c9d65dc3-c071-49ba-b765-1ca251d0d89c", "indicator--e16caaae-021b-4b5a-b50c-208574e926f8", "indicator--575b85aa-4c1e-4774-a940-6af864e8ef14", "indicator--f6322ef2-a3d9-4a8f-8cd4-4310bb98312c", "indicator--c2848532-c26f-4d07-a086-b733377a3d79", "indicator--ee60b0c0-9c7b-4532-bc7d-ec4f072a6a43", "indicator--63999955-b8a4-41cd-b19b-f46da00182cb", "indicator--51926f02-a7b9-4061-aaaa-690d79ee0700", "indicator--1ba70b50-a9aa-453e-a894-48cb5cde8a47", "indicator--bf65c7ba-9957-460f-bb2f-f8754f2b0db0", "indicator--d1c1b847-976d-4956-bbde-4d64f98f4ce4", "indicator--5c1b35e6-78e8-4ae6-999a-37d41aa8a137", "indicator--b481ea2a-0016-448b-9a55-9958190daf2c", "indicator--882321e9-de6a-4488-8867-706ebbcc5757", "indicator--97a1253d-241d-4622-99c0-61056da7dd47", "indicator--269eb532-dd57-448c-9a22-512f69ec322e", "indicator--4772a110-9f6e-4108-94d3-a88ed62b22ef", "indicator--7bf10be1-ca7d-497a-85d5-f1de667f84d9", "indicator--dbe4c582-9c25-4b5e-96f2-adbfea7b174f", "indicator--00473cc4-b013-42f9-8ab8-ccd10de1742d", "indicator--a261157d-c1ab-431f-a735-9c2dff25af7b", "indicator--8af06559-ea01-4865-9308-b4f334a38b88", "indicator--c9a50474-7253-4c08-87f3-2f819dc48cab", "indicator--fe9662d6-198c-4632-9373-2bce8cfae442", "indicator--93fbe39c-3308-42d6-add1-c05d94ca0fa8", "indicator--b7147e62-be35-433c-95c2-3aa9a3196e1c", "indicator--ba358135-ed14-4950-ad60-f34674aeb09b", "indicator--ef8d5ef5-e09f-4067-be26-9f7c1fee3bca", "indicator--b03d10a8-7bff-4897-8618-a00b28068329", "indicator--c0830a78-d4b6-40ee-813f-86431c0d2893", "indicator--96ce2e17-ecfc-4688-8eb7-29e4dc6f6455", "indicator--1d843b89-70ed-473d-a23b-f53009705fb1", "indicator--189fea1f-27e8-4411-b6d7-1d52d2bce0b4", "indicator--63c7744b-3d0e-4eae-8e3f-1bef1bb7dbdb", "indicator--fdddfc34-e627-4581-97eb-72246aed4ddd", "indicator--83e0e98b-8a2c-47ed-8057-9b914842e7a7", "indicator--47e51a96-68d4-4cae-adc2-dc75d52b6504", "indicator--9d19dea4-88e0-451a-81dc-026522ff36b8", "indicator--ee0903ec-9880-46cf-a807-651174cc14c3", "indicator--30dedc67-32a6-4d53-88a6-9a8e7c6973b2", "indicator--472f4f9f-30a0-412e-9c26-cd52369b48b0", "indicator--51023f23-7549-46f4-8555-9d1b5d58b1d6", "indicator--3c4afa44-baee-438e-8ab5-baf604e08427", "indicator--72eb143d-0608-4157-bdd7-ce7cabfbd9c5", "indicator--6f8de285-4830-40aa-a27b-bb1a1e0cc59a", "indicator--8c82a007-d1e2-43e5-ae73-e1bc85fdfc33", "indicator--70ab7e58-abf0-49fa-9acc-fa3acfb81c31", "indicator--1cf13e37-50c5-4af9-983c-a018ed0c4830", "indicator--4b6f3951-139c-4e81-b0f0-f855530186f1", "indicator--fa7ad11e-7ed9-46c0-9a80-508d7e916155", "indicator--edae4f53-7055-4c5e-9ca3-59484003fea8", "indicator--87b215da-fa7b-42a4-96a3-eec638eeaafc", "indicator--d0c0503e-4fc4-4614-b7f8-d730c00e4b6e", "indicator--16c677a3-cafa-463b-a251-7b884533c6cc", "indicator--95e776cb-7a34-4165-9f96-6cb5a0b722c8", "indicator--356ef249-bde8-4300-91cc-cdeaafeec87d", "indicator--8b1327cf-6d02-4818-b014-d28a171e4a85", "indicator--d3acdbfb-8c39-4494-bd4e-d846f615ccd0", "indicator--5b345724-f850-4e5a-872d-25ce3f35f579", "indicator--be2acc65-871c-450d-a236-729379ee3c67", "indicator--40657a6e-916e-4396-92c7-e67b81977353", "indicator--e612ee94-26c7-4514-94d8-290d1c1cc252", "indicator--efbd47f7-d651-4646-bc6d-7ed689b0bb8e", "indicator--68b4255d-3c30-47ae-9d7f-262dd72a94ce", "indicator--a04eb0ec-8e3b-47ae-8c07-3dcdae302e14", "indicator--10e7e914-3e76-426c-a2df-9ff33a43ebf2", "indicator--69b3ae3e-1d34-4a3d-b64e-d9fa39ae9ed6", "indicator--a1eb76ca-c1a4-4996-b535-be0118aef068", "indicator--80c291e6-1ff0-43f6-8983-075e800d7451", "indicator--bf969b35-9106-4b1d-aea2-36f55835784c", "indicator--d1c28777-46ce-4b02-89fa-a411963c5f91", "indicator--c616bb67-7901-4c75-a516-6c83b48e8037", "indicator--9bd04f97-d5f0-460c-95eb-db6cef69bb91", "indicator--d44ece95-44b9-4149-87f6-52b5e7b90412", "indicator--63bea027-aa56-4210-94db-707183fcc293", "indicator--53dcf824-346b-49c2-944b-963defaed9ab", "indicator--129f5789-11d9-4b95-8ca5-fdcdf4ce3c06", "indicator--9ad7ea70-b2c4-4ae1-b414-c9074cd3b9a9", "indicator--f055a605-734d-4e04-837e-8ecee32d0773", "indicator--e0db63a0-c9ce-404d-9bf6-289188eb6ad8", "indicator--1964af1a-552a-495f-b82f-21ed1925ed97", "indicator--46e14c68-eb35-4eea-a532-5b7d7ea72563", "indicator--9a7e2d2d-2de0-4af1-83e5-582a39df4a7f", "indicator--5b1484d3-7ffb-4877-8c89-bf4bab0e8164", "indicator--773dfdeb-feab-4fac-987f-c452b156482c", "indicator--5f35f490-015c-495c-9883-b1d7676730b0", "indicator--0942d012-28a5-4200-9212-a10828f6a204", "indicator--edc0fe7e-4b68-4f63-ba62-71189dbed3de", "indicator--ecc4211a-57be-41a4-93ba-937eaffe920c", "indicator--33addd2d-35db-4b80-b600-8c7f1caa6624", "indicator--582aa067-c70e-44c8-a8eb-1aaca8225ec7", "indicator--dc8bc98c-8c26-4e52-8156-7c3dc5452a3a", "indicator--f105d142-bd9b-453e-b1f2-5ab150396a00", "indicator--1570c1a8-f31e-4d89-8f7d-49542ab8d053", "indicator--aee62324-3347-40ff-9326-2ecb790c6c68", "indicator--4376c24a-17c0-48ed-9526-4a1651b5fbf3", "indicator--8c1b7f9c-ab0a-4f58-8371-34ff3b964c15", "indicator--00c3a2c7-d396-44a5-9163-12c1bb168e31", "indicator--58167fb8-7aa1-4546-9750-0ed2b5d438e2", "indicator--f58341fc-fb26-4389-8dc3-5fb37b5c2a38", "indicator--a8ebfccc-2028-4d96-a5e0-0b94f83c7d2a", "indicator--a393c76a-2e22-4576-a3db-508704d83b54", "indicator--b8ec85b6-fa9b-49da-805b-e5b4bb3ce686", "indicator--0d7857ed-241d-4622-bc87-5504b3279e87", "indicator--d8e4c44a-7133-4d0d-a214-910330e0445a", "indicator--b044d83f-7c01-4754-85b5-08d6e96c125a", "indicator--514e6cb3-c706-4ada-86e9-149b964685a7", "indicator--dba7e688-6557-41aa-a532-9b78bc09e51f", "indicator--8979dcad-d183-4f70-a113-2ee4399924da", "indicator--49a7e50e-35e1-4896-9e55-6d1a4f3a084a", "indicator--339bd3ac-7e59-4e5d-b45d-8f017fa40679", "indicator--acf5b0b8-e024-4dfe-891d-a6be883ac0dc", "indicator--1dbd1c53-017d-4b41-b78f-da3c945e82b7", "indicator--2cedcee0-58d0-447d-a9a1-2e09dd16a639", "indicator--6a77f2a7-74ca-4a0e-ad18-078ec2328e04", "indicator--ab55ce3d-dc41-423b-a336-45d0a7266197", "indicator--48a588fc-fd44-4fbf-87f3-c8336e44006c", "indicator--642fd107-c536-4a8c-801d-3ed9d0e0cc84", "indicator--1b089778-2d2a-47a1-be0b-df48eb27db3f", "indicator--5016cfb3-82de-4145-ada3-e900ae20c2d0", "indicator--47a29860-7d81-4f30-8f23-8ee6b7e924fd", "indicator--d9513cd9-69e4-4644-8d23-c57fbbb9891d", "indicator--b65188e5-3fd5-4e65-b63e-ef27c5112992", "indicator--f79a9dc1-4729-4e8f-a65c-d022fe3bcda5", "indicator--8d359d21-4c8d-442b-9a38-82cd29582c23", "indicator--3b2ed35a-cba5-46b6-9a62-a8c3261b948d", "indicator--b6e06c83-b297-4bf9-a923-0469bc481f43", "indicator--192848a4-4c53-450a-8034-b922eaa65302", "indicator--8a1eca17-ffdb-4d51-9657-09eb60588a4e", "indicator--d7d8965a-0938-4b03-862b-1b0cb03828c0", "indicator--254499ac-668e-4bf0-b777-c2a4458352d1", "indicator--b0acec9b-ab04-426c-93e9-2a2d53760e8c", "indicator--99d8334d-373d-4aa3-9394-a56e9b57a3e7", "indicator--1b25dcec-9b7f-4147-951d-4f4de18a8196", "indicator--8495373c-74de-47f5-919a-50219c0a5890", "indicator--54078fcb-9445-4661-bea6-4da4e577c6b8", "indicator--fa23ee59-15b8-4556-941c-09d862fe5ce2", "indicator--26383d5f-4e3a-4e63-ab1a-e3653116d7aa", "indicator--ab0115b9-f6b3-4096-9e64-93e58946ef78", "indicator--a2ad18ab-85fb-46df-b43b-577109b04ec9", "indicator--8b5b4cdf-e343-408a-a060-d3aafeed89c8", "indicator--654585be-0773-4fcd-88c4-b780ecd8cb69", "indicator--9add64b6-7e8d-4f21-ad29-df8d9edaa824", "indicator--12a35a2e-2ecb-4ee9-bd10-52e18fb51ce9", "indicator--357d8cb1-e42c-4169-941b-1cf1b1934118", "indicator--31a1a882-0f82-47a6-82ba-d337ff4ddb49", "indicator--b18a7a55-8eff-4d54-87f2-0016f164ee8d", "indicator--778bc66d-d41b-48bc-8146-54c23dbc157a", "indicator--416b36a7-32c6-40a4-ac11-48c372406a1c", "indicator--8938abcc-eb56-45dd-a863-85eb4fc92a1a", "indicator--0495f770-9b2a-4a6c-81bc-b03f7f531d68", "indicator--e62ddce7-3c96-48f5-87ad-f5d3a9266663", "indicator--edfb5530-179e-4a84-8716-57cfffeb8710", "indicator--82474084-ec45-4484-8ee2-2147d2768237", "indicator--258159f3-5dc6-44e4-8973-c2a329f01e2b", "indicator--ddd3a44d-3dfb-4770-adf4-306fb82cc8e9", "indicator--2d3b82d8-29c2-4e21-a123-3e1113987e56", "indicator--4da6bc29-e962-485a-bb94-afab8c1f5b64", "indicator--f37f084d-74a9-49f5-97d6-1f58e0404bcd", "indicator--5e1e91e4-ffd9-4843-898e-8d5bce38ed19", "indicator--b79037f5-71d4-4b08-b31f-4a4b419611d9", "indicator--20bf947b-80e6-4571-bcf5-3152bc9bbf78", "indicator--7ad78812-24df-49dc-b7b4-e131558b3a0a", "indicator--8e00929b-2060-453f-806e-e9befade8575", "indicator--0fa07b5e-e93a-473b-ad08-c5a57c7ae566", "indicator--f068d149-4a54-4572-901a-6a0898b15d42", "indicator--fe791dd8-d33b-4956-af04-e8ebdf23f129", "indicator--ead9d574-8485-48a9-9439-ac3b8c5a623a", "indicator--7f7db883-da2c-44d2-bf03-4e9962fa5f19", "indicator--4cfc6e4e-f893-4ce5-89f1-ad14e42c9c04", "indicator--a5039937-b59f-47dc-b24d-1433f59c5a15", "indicator--287fe404-3d7b-4164-9b40-d2bceb20c68f", "indicator--77c68f77-817d-4922-8479-e03a547c2c45", "indicator--1fdbfeff-81a9-42b6-bd95-4c6bed2f4a00", "indicator--08110048-f477-410a-8f87-2999a576429d", "indicator--2d7b8a27-0d0e-4fcc-a692-f8d5ec58f4c5", "indicator--07aea0f4-85c6-4f4f-8269-cb4be34241f7", "indicator--ff38c387-5114-45b4-847e-1b62266c2258", "indicator--4159c939-3f71-4f3f-a9dd-39b29fa1157b", "indicator--74cc3c14-8a07-44bc-b004-e371cebcde2e", "indicator--7001068a-84e2-4235-aad9-8ef42520e2ca", "indicator--82c290f0-5c71-484e-971b-cfbd81016060", "indicator--f4ba0d47-2a27-4bd1-af1e-feeb00873418", "indicator--b51a6bc3-ebb5-4a02-a739-aaac5c4f2569", "indicator--d69465ea-6340-417e-83ea-cb706a5c6be3", "indicator--740f7496-3d99-4bff-a2fa-87cf8ca47c60", "indicator--e5de1d6b-ecd8-4224-ab60-0e17c35e7089", "indicator--df936031-7033-42a0-868a-147d31f6d9a4", "indicator--ff9f4041-5830-4898-8043-bf73f6af1cfe", "indicator--dc8cc5fa-e6dc-4b9f-a0ce-2dc5ac6bdd68", "indicator--a9ea9434-5e6c-49a0-a43f-3076f7958591", "indicator--4b8fd8ca-5f3c-4824-8a1b-e530e8a9302c", "indicator--1cfa2aa2-ecc6-4d38-96c2-1a166de2883a", "indicator--6d182e5b-5f42-4bc4-878b-3048f5dd6e92", "indicator--fa106fbc-58e5-4afe-8468-031c67c4a74b", "indicator--b9bf3e3d-106b-4a3d-b28e-4a23c180812e", "indicator--60109cbe-36de-441a-9467-ab0a200c44bb", "indicator--06b05352-34a9-42cc-94d7-38c537121fc5", "indicator--e255106c-5c15-47e6-b576-6af37341e2ad", "indicator--8e001ee7-c568-491e-94fc-991dd0ba51e1", "indicator--4568a1c5-717b-445c-a295-28a2986d424e", "indicator--22fcd516-02e7-4301-8bbe-14398a8e852b", "indicator--f5c342e6-0a1a-4c9a-bc69-5782107fc183", "indicator--39b36d87-db3e-43f2-829a-440e070e5f40", "indicator--9b95ab4e-24bd-4306-8783-e7dac286edf2", "indicator--04d6ebe7-0461-4a4a-8bf9-c813f38aa0ed", "indicator--1e55950d-3810-4c70-bc81-d3178e923e0a", "indicator--08ef299e-607a-4bb3-8c2f-07aa2f9a2d53", "indicator--c610dd49-ad69-44c3-9fe4-e3401171a0f3", "indicator--78f22173-584b-4c56-a678-e8f6ab1fb4af", "indicator--ffc77503-3ba2-42fb-93d7-46a351e95ec5", "indicator--76a2fea3-d46b-4aa5-910a-0d2c8c94f122", "indicator--690ec5b5-e50f-47fb-88b3-5fe4de35388a", "indicator--0530a7df-9448-4faf-9faf-252211a37b48", "indicator--e8c7d443-ab5b-4919-b076-b441b39b5463", "indicator--a7a66d60-a2ed-445a-a940-4d08bee6d283", "indicator--0d7d98d1-d18f-44ae-bf6a-5c4b820e611d", "indicator--b51db354-86ab-4e8f-a916-059dbeae1304", "indicator--6e333729-802d-4849-967b-dfc5d5ef9352", "indicator--2445bd7d-cb13-4273-b756-866e04a4393b", "indicator--6464d222-5ea1-44c4-9729-1d40a89ba2d9", "indicator--819c3c1e-f37b-477b-a23f-6a03061fd31f", "indicator--0f08d9bc-8d88-402d-9a2e-614f93e0e94d", "indicator--23c51474-e962-47c7-a14e-1dd40e109be6", "indicator--d86d86cf-e5dc-4098-8a2c-cd9105a44ec4", "indicator--b412d031-f636-41b2-b0d1-27fb4e4dabc9", "indicator--f6d24a31-c638-4846-bfe9-59aee08bde9e", "indicator--baf6f7c9-a995-43b6-b373-c846af2cbaed", "indicator--d83f7cea-3f0c-49d2-8a88-cab21c0b023b", "indicator--955f8e30-cbef-4389-ab3f-73a7382e3258", "indicator--da5a7bb0-e6b6-47cc-983c-f92901e331e3", "indicator--11841e88-a7ed-47f2-8183-824480f3c4c6", "indicator--732a4871-80d2-4b34-9932-7502bd6eda2e", "indicator--3c139a4d-e32d-47c2-8598-8d33702cedab", "indicator--a9464573-37ec-4a66-8412-86d65d8f14df", "indicator--58befedb-d230-4c3e-ba76-ba64f230b7a1", "indicator--c755effa-d44f-4a3a-80ab-61924a255c35", "indicator--39fcbc8a-57aa-4f31-80a7-9754ae256662", "indicator--ff8bbf5d-a517-4c75-a80b-f0b2f161d7ce", "indicator--a052e132-a10c-4f52-827d-7e777bb70a96", "indicator--d21ff0ee-6d92-4fb6-98e9-125b12c2ccb9", "indicator--d6301f63-ef19-4a1a-8b7b-ad8f0343c750", "indicator--582f12a3-12e5-4721-bfea-ebab75789df2", "indicator--157eb524-6f42-4beb-a0a6-51b2e11fe6a5", "indicator--056fd635-da2a-49f0-9358-4c4f28a305d8", "indicator--2f5b992d-81ed-4c2a-b649-37d217bb4a8b", "indicator--74d0e539-1c5f-40eb-b39f-9cec5737da82", "indicator--07e452b4-e66c-4901-8b34-8732761ef126", "indicator--c128daf2-75f8-4bf3-90ae-f7357705f83c", "indicator--ff7bf118-3cd1-4f4e-88b5-3cf8e6b02ddc", "indicator--193e889b-f98e-4764-a963-ef29728c603f", "indicator--d7a0d60a-001f-44bc-86e7-530e65ff40c9", "indicator--29299289-abf2-4fb9-a1b3-08cc3e7f40a8", "indicator--1f0fb6ea-0ca5-47ff-a579-a136e3337b1e", "indicator--1d2f0ff9-4f3c-4a75-a4ca-5a1d3ab88fb2", "indicator--671c5311-e4c5-426c-b774-9a5cd4a95d54", "indicator--c9d14d98-9917-4ab7-9ff3-937aa0bad138", "indicator--4ec63860-86d1-4db3-9816-c13cad148e58", "indicator--1e88554f-f50f-44b7-b2e4-16b8fe538e87", "indicator--e6262f79-4099-49be-a06f-6f5ca6b9d5a2", "indicator--f890b722-095b-4844-87a3-abee830396e2", "indicator--4cc57cbc-a620-4cf0-b388-5c1f108c9496", "indicator--4c4c2d20-d5e6-4679-aba6-a8729fcec3fe", "indicator--96c6ff44-21f9-4435-945a-4b995a438627", "indicator--2e77f401-b419-4fac-ab03-c47172c0ad4a", "indicator--20d2ce7c-bef4-47f7-93fc-349609b8cf9c", "indicator--a26bd85f-af55-4672-b492-ed35a2ad1ff8", "indicator--5892c873-4aca-4a64-aa4a-60fa647bb9cb", "indicator--c3ad58cc-5fa4-4e77-bc44-37aba0c4de70", "indicator--d3076a26-5d87-43d4-a9bc-cfe284547960", "indicator--d96f175d-4a54-4323-9923-9e2345e5982c", "indicator--ead5c424-41d6-4224-8a82-e79e08c0b728", "indicator--22b8b0f0-3db5-4f59-be13-003748c91b8c", "indicator--a11558a4-30a0-44f6-9625-f46354d7a282", "indicator--5e8234f6-2fda-4386-997b-b22d87355d0b", "indicator--53b792c8-086f-4849-8ba8-c22845da1475", "indicator--7bf03c07-d55a-4268-8ae2-eee5e05801fd", "indicator--31de6431-277e-4cae-a06a-dd7819fdf666", "indicator--c393b792-40c0-4f07-9589-ef96608a5b14", "indicator--79ca49ca-2b4c-4441-a86e-5462aba43d02", "indicator--8b790f4e-4d77-467c-b037-c4db14a3ec76", "indicator--fc2b716b-c989-4e52-9b4c-f42f24057281", "indicator--a7b05684-aeb5-4d08-bcef-005fd665053f", "indicator--1b597956-a222-432c-9642-0727836088fb", "indicator--efde8c96-33d4-4fd4-9d3c-f63baef77708", "indicator--6c237758-9572-4adc-8dfc-3cd2a3b923fe", "indicator--6e323446-3c15-43d4-adf1-5f30ffcdc5d8", "indicator--9bcd5fc8-2e4c-447e-b452-37268d7f81fa", "indicator--32156fef-2bca-4762-9d67-887d37f379ad", "indicator--96b93e5b-b973-4b19-96f1-3b6fd8da4142", "indicator--41e1a1fc-7205-4041-9d7e-7165e6bd5ed5", "indicator--1c96127f-598f-424f-b76e-1a68cebc3561", "indicator--41fa3c1a-4418-4c53-83c1-8c26bbbbcc79", "indicator--ac35e619-59a7-4c11-9e13-9f19f949d771", "indicator--308f5351-94d0-4fcc-b884-96def62df2b3", "indicator--2af6da8b-eba5-4d10-a795-77dce375299c", "indicator--2715da06-7c6d-417b-8116-5e33a63f146c", "indicator--5be9355f-f2c8-4a74-a90f-fa1fe868e6b4", "indicator--37c1747e-981f-4eae-90ac-b3aeb1f73edb", "indicator--42174a24-05e2-4cb1-adfd-a66a7eb4c2c6", "indicator--1308edad-d890-475d-bac9-5022b4cd7f01", "indicator--e972f5d8-7fe9-45e7-ab9c-1f9e87c9bf92", "indicator--cdbfa711-3954-4e80-9e62-5c77e4779719", "indicator--79d86595-2301-4a52-9ef1-7eac757bb23c", "indicator--0d6f66f6-eaa1-409b-bb41-894fccc27b2e", "indicator--61e01852-3e32-438c-820d-5ecc7c60f2cb", "indicator--d6443bfc-c83a-4c8c-947d-10a673a50f35", "indicator--aa8c0350-7d0e-410d-a7ac-4d7b6425ecd4", "indicator--7d8810bc-90ae-4ac1-aa54-ee7f522a5563", "indicator--67d2c4fa-70ba-4066-9e91-31aeba3d2994", "indicator--2a342afa-9925-4c0d-a60f-4302f98d689d", "indicator--3d1f2619-d868-4a03-a11e-f61bacdc99d5", "indicator--b5bdd85e-fd76-49e6-b4c3-b934a48257dc", "indicator--899f959c-f8c6-4830-b9b4-f063479abb58", "indicator--c4044905-6390-49d5-bc6e-b952eb9263c8", "indicator--31fdaaa1-d85a-4d3a-918b-dc65e4f25f12", "indicator--5e005593-b353-49a5-b2c5-513fb8dc46d0", "indicator--6ae6fe94-508b-492a-be47-854c8083c8cd", "indicator--9f90e982-b636-471c-aaca-46b2232471f6", "indicator--202bf79e-5e48-428b-aee0-ec241a0a3c73", "indicator--64c5a273-bf3a-4b1e-b8c2-6bf88cd271ae", "indicator--aa2bab34-99de-4d95-a3f9-866a481298d9", "indicator--9e905030-58ae-4ed1-90e9-a672de722f32", "indicator--bfd473ce-f46d-4487-828e-c901b2f4e2b3", "indicator--cafdec61-925e-4f51-abff-41f457da453e", "indicator--cf754064-ee10-4b86-9905-ed09525a3409", "indicator--8976d8b5-2abf-4bbe-98a6-d76523711b9c", "indicator--b6f944d3-1521-46f6-bd6c-bd155a7abe8f", "indicator--ea6392bd-6ad7-48d0-9488-690c8f355698", "indicator--5589ebbe-8a57-4311-9c1e-4c6754264310", "indicator--5e49ba4e-e7fc-4365-af5e-44b308151138", "indicator--b2aef6f8-085d-46d5-9ade-c81e5110bdb6", "indicator--e863bf6a-a1c2-4d04-b3c5-0db843c125b9", "indicator--13a5b575-b17c-4512-8411-0f4fe526f863", "indicator--c74c5e00-5005-423f-817f-7df0b453a7de", "indicator--70ba420a-a9f8-4583-917a-28d936103a08", "indicator--adea3e39-51b8-49d0-b1a4-79ede020f8e9", "indicator--ecdead00-cc25-4f23-9718-559cdf83cf73", "indicator--e506d313-04e8-4fc6-baad-3a1502d6af86", "indicator--197bfdc0-2482-468e-bbe8-db1fbd6d870e", "indicator--c2e95f15-1d64-41ec-89f6-d510e57e54ce", "indicator--744a173f-41f6-468a-84db-ee7e512a5bbe", "indicator--7f14146c-8f6c-4478-9c2b-4d9301d43228", "indicator--49148d5c-b311-4a62-be6b-45007c5c6ef9", "indicator--385d4bf3-cd42-4500-b55e-bf1bd7a869ea", "indicator--0e43aad0-dabe-4fe2-9497-cfc48eb69f0f", "indicator--ea62b5dc-f662-4ea6-b7dd-2ad28c6aea72", "indicator--00f21374-094e-43c7-b9a0-5f43d482fb11", "indicator--606eea74-77f6-4423-98a5-2271f724cfde", "indicator--2baffa69-3089-42e3-bcd7-ef19777c008b", "indicator--3ea1ec13-a0dc-4537-a4b1-bd834141e958", "indicator--f29da613-34d9-4ebd-b743-e6f78dabddc2", "indicator--6870246a-38d8-4751-aa46-06a40c17cdd6", "indicator--8e8c15d0-edb2-4f23-8eb3-20bb12bb2702", "indicator--80a35a3a-8469-4dde-9195-a280726851a7", "indicator--1b8d7f52-f193-4349-b1b2-5bade3dffe75", "indicator--5a343117-f569-4f92-bffa-754de43392ea", "indicator--b8bc6a36-707c-489f-9434-f94c3b728b8e", "indicator--60dfd46f-8804-449b-8a13-66a9e95d1673", "indicator--130fe905-55d8-4c00-9fe3-fdc18843c650", "indicator--f79bbe92-9f16-4185-98fb-26fbe88c2f9c", "indicator--f49e8449-e0fc-4b09-8992-c7860c8ccf64", "indicator--f562e8b7-50cd-43e4-9e3e-a6fe12503dbf", "indicator--ebfd8e64-0d95-4304-a61f-b0b3f4563d7c", "indicator--0a062626-9d69-4b0a-9ca5-f42aaa2d2716", "indicator--03f3c396-cd3a-403e-a4a9-fd3441b3303b", "indicator--92ac17d6-11df-4f1d-aad0-4c3e4505b41e", "indicator--6a7070b2-77dc-4d7e-9249-88e497b17620", "indicator--1a88734c-9315-458e-a990-a67dec054fd3", "indicator--76bd4fc2-48ff-48b8-9d81-0d17399256e1", "indicator--73416d20-74e5-4776-92c4-e5b8727a82d8", "indicator--1b32c891-19b9-4703-8056-4b8934a3934d", "indicator--26a88e8b-d295-4443-b276-307d20836a47", "indicator--045dce9e-b281-4cd4-a5ea-07ceadbf8898", "indicator--a3c7016f-7b78-4815-b1fb-b7cf62745531", "indicator--547c8f24-4330-4931-beea-6388fe1890c2", "indicator--7f97d626-14e6-40b0-86be-d88407bf03ce", "indicator--a4c9a116-da34-4d53-b595-5abd7428f283", "indicator--2dd10ab0-9afd-4851-87d2-d36b5bf5b0c3", "indicator--fdea05b4-de25-44da-b7e7-471e8d79b59d", "indicator--a3ca2531-1e03-4d6f-982d-41b5ac5e1237", "indicator--dad9dfd5-861c-4aba-bb80-21546e2081cb", "indicator--a3132ce5-d141-4399-ad73-b15eca393a60", "indicator--1ed3d7b1-7990-4153-a59c-9215462c1fa6", "indicator--90d02314-14c1-42e7-9742-3cb56c0092d9", "indicator--8aba008f-f5dd-4415-a970-80d1a9a8fd7b", "indicator--7cb47c99-02ef-491b-a4ae-40074097af25", "indicator--7bed4796-cf58-4a93-a40c-5efdb4280e60", "indicator--eaedd405-08d4-49b0-95ef-adb087a7748a", "indicator--54749a68-0de5-4b87-9ea8-2bc556517df9", "indicator--d720e625-b5c0-49a2-a307-ee14c7c7f7aa", "indicator--8b00670b-2e7b-4b16-ac2c-1bde4e74e2dc", "indicator--fc967e3b-047a-4aff-9e53-0093dd3fbcac", "indicator--dca87105-7840-47d3-8a25-275598ea23dc", "indicator--f4d7d638-b80c-4e5c-9051-92596b1edfc5", "indicator--f65ca87c-3168-43ca-935f-42d6e47c2e30", "indicator--7ef5f05c-fb96-45e2-a475-5ccb8d0fdddd", "indicator--a1c8187a-eace-4b20-ad58-49aef7f586c1", "indicator--5779bfd2-a286-4df8-bc0f-ff5a761917e3", "indicator--f9170a36-cb00-4493-842d-fcf449dcb3d7", "indicator--af404e73-385b-4189-9b46-079b55372feb", "indicator--3b5c44ac-4f26-452e-ab22-166640ed0ab0", "indicator--561e299f-a0ef-4f42-8268-4fb673e5bab7", "indicator--1470f650-9ee7-475a-ab54-dbb0a2c459f5", "indicator--6164ab16-dc67-4228-9045-307d15d8a9d5", "indicator--b8c56e4f-832f-4ea8-95d9-18015e5c3bc9", "indicator--5a40ee96-8986-4722-909d-25a5eb007a68", "indicator--de1c1705-dfe1-41a4-9fda-9102fdc7eff8", "indicator--b271422a-9c66-4b30-b56d-855c97664130", "indicator--ca648b5e-5cea-40d3-a497-8d8fcf31b123", "indicator--b97b7db5-224b-47e2-8d14-24aaab48ec2e", "indicator--e2dc2d83-5775-4b02-bbeb-505ffa450625", "indicator--91e6850c-cbb5-4044-ba25-7a493f2cfd49", "indicator--181a60cd-555f-490f-b734-8c29d5d24506", "indicator--db1cf4e4-2e11-4c61-b49d-44c4ee93d864", "indicator--7920213d-e92e-47e1-93f3-03e5fca146ce", "indicator--168970f0-3bfa-4b7e-a4e1-af067ade70fc", "indicator--8171d785-05c9-4116-a74f-b7259eb48f64", "indicator--5941a3e4-d9c2-4aa4-8a7c-a0270b690c7e", "indicator--0d6e90f0-d5eb-43b4-a34e-0bcb7938cc37", "indicator--f31d669d-d221-4ea2-9150-632b5a05188e", "indicator--b58e00f1-30d3-45b8-83c2-d4d96ca07589", "indicator--b99c2b4d-0cda-4456-a9ef-2f8e30a0b1ab", "indicator--24de978a-84f2-4098-8334-9e30701fc2d6", "indicator--36fb4c9e-9827-4806-9510-33566970f46f", "indicator--c0ed0526-344e-48c4-9d21-f2547d227d8d", "indicator--eed8a6ca-a5f0-4789-a713-97c8ad369ed8", "indicator--350f045f-f9a1-4cb8-8f9d-c08815c51bfa", "indicator--188e3ef7-3b16-41ef-9a4b-da54f94edce3", "indicator--2689ac14-94f0-4099-a2f0-e0955c064685", "indicator--ecf7c8f2-f417-49a6-b959-3eeaad8603eb", "indicator--263941c3-c5c1-4d54-bae9-16b542440010", "indicator--c413909e-f051-4134-9099-68fad549ce70", "indicator--5eb719c1-75a4-470f-9df7-d1bdfa4742f2", "indicator--20e645d3-e12f-4794-9eef-6434183210e8", "indicator--67dc87a7-1b59-425f-a369-8885efe4ffa0", "indicator--2d7d2edf-3a7e-42b0-80d5-c488ca260c70", "indicator--d23e4031-4369-43b8-aa2c-383c506d57af", "indicator--05edf198-7aa3-402e-ab9a-92cc7ad6cc28", "indicator--5a8a0f50-169a-460a-805f-944f98a5ab0d", "indicator--3e675f11-173e-47e3-83be-159bab1eedf7", "indicator--2e46a695-bf85-4605-b6ad-ef617174fa91", "indicator--c27d36c4-775d-436d-84d7-cbd77a1897ab", "indicator--2f80f4ee-410d-4469-bf3b-550a2f985469", "indicator--172e0eec-1d74-4a6e-99fb-aac9907d01a0", "indicator--f13fa0ff-c108-42a4-a0eb-d9bdf313363f", "indicator--f28e2361-d96a-4f0d-a06f-fc196b56c0b5", "indicator--95d751ee-f9d1-47de-a3da-cf4186f2561b", "indicator--e4ace771-c81c-458f-8958-077e6ed7b5e1", "indicator--5c54f7ae-092f-4b36-8e83-a52c8a1be079", "indicator--ce560472-8539-463f-8418-21d7b78dbb8b", "indicator--f67eb1fa-9e7f-4531-b9a3-738e1b29c017", "indicator--df129667-9192-49f6-bce1-b8ca1eb57c0a", "indicator--c0543db3-b8ab-4340-bfed-16e5d77fd7c9", "indicator--658c63df-883d-41a5-bcdd-90f1d73631c8", "indicator--f3981ff2-9793-461f-9265-86d8153c3716", "indicator--4eb8808c-516f-4ed2-a2ef-0646a4fb46b1", "indicator--34fe3376-fe96-48b8-9a9b-70a17af30702", "indicator--0fb2f65c-ef35-4657-baa2-4d62f2843fbe", "indicator--bec17cf2-6a3c-4455-a8c6-965541131745", "indicator--d93c970e-e4d1-4a54-af90-b58934f6cbd9", "indicator--062e01bc-ecd9-47d2-aaa6-5462993079be", "indicator--a5ab92a9-a5bf-4896-95e6-749b703af2f4", "indicator--e9f7a8c2-aae2-4b18-92a8-fbb9d38ffa9d", "indicator--e6b0d2eb-5d78-4463-8fcc-9a52a40a3e75", "indicator--f02efc28-65dc-4f22-9713-2b6b24e9a33f", "indicator--7cfad26a-4535-4f8b-8755-02f55c81251a", "indicator--bb710e2d-21c8-4689-a5b2-8415651231e4", "indicator--9811ffd5-e45a-46bd-b904-fbf1b8039b50", "indicator--7550c746-17cd-42b3-9d28-d342b8a25ef0", "indicator--ae23adcc-c963-472b-a851-e306184cdc2e", "indicator--a91b4d32-1c3b-435a-aa90-cd8e8e890994", "indicator--d5a735d4-9020-4319-a83f-b51cefd15750", "indicator--ac44de69-c161-4c4a-bb2b-94d4d5069a12", "indicator--b729a38d-0e27-4bfe-81ed-25193c2e4be6", "indicator--bd23bca9-b67b-4be1-bb93-c287820cb429", "indicator--81b99089-32c3-4a55-9808-a484bd539022", "indicator--c086f9c6-76a6-425c-b57e-984b46a5de0e", "indicator--78990f65-9dc7-4899-8525-21fdef7eca74", "indicator--dc3ce167-a90c-4779-8c04-d22394b3576b", "indicator--0289a874-7267-4e95-9008-7e090725795e", "indicator--ae726e06-7d1a-42cd-8b76-086ee5f1860d", "indicator--bae5fc3c-0dea-417a-a262-82f0c080b958", "indicator--eb3e457d-0e79-4512-a6d0-6855bce13e01", "indicator--9089c155-b6ba-4f7c-abaf-1cedea46461a", "indicator--558c95e9-75fa-46de-aeee-2ef26af48dce", "indicator--645c79ee-2b8a-4354-a520-5eaa41a5f935", "indicator--65fd99d1-0721-48ab-ac56-ea39b73c2bc6", "indicator--8b9948a5-f2d6-48e8-8e67-91e81c804c8e", "indicator--b15f9281-89f7-4843-8786-2144eb4c31e0", "indicator--7db82a41-4a87-437f-a499-4855e1d71510", "indicator--bf6fa16e-a886-4de2-aacc-1655434c6956", "indicator--cf6ff127-aacd-4244-b3a6-66f3adcae20d", "indicator--a42150c1-74f9-4127-8e74-cabb391dad69", "indicator--daac0dab-da9a-4680-98ea-f62bb24d95e3", "indicator--8bbec3f4-d46e-4a47-a274-d03fe24ff541", "indicator--1a93957c-e3c9-4ab8-8877-4d35442bbca8", "indicator--80a1bb8c-873f-4c6c-9fa1-d8d3f29b0ea7", "indicator--dbb81323-aa22-436d-80a1-dc5dc212023f", "indicator--6fe188d6-d8db-416a-aa55-b7caa568f5ed", "indicator--019f4297-014b-4b10-a0bd-211e2f38861b", "indicator--918154a2-242c-47f9-8d4b-3752539c54ff", "indicator--eebb20db-de74-43c5-abcc-4725b8914028", "indicator--27bb0b05-82ff-4d93-889c-bedb95d3af58", "indicator--142b0215-878a-466c-bd6a-1fae15e11dce", "indicator--10ed82be-0e49-4980-a011-39fef800509d", "indicator--f90ebcb7-3e43-4671-b67b-783bc864cfa6", "indicator--3f2db2fb-68eb-4a38-aba5-1497268e9334", "indicator--51b5995f-8cab-4b6b-b6f7-129268f8ba91", "indicator--7ba73f2d-748f-4ee8-bf0b-870f64d28b57", "indicator--0f255016-8a88-4fb0-9c6b-7384aa23b4b2", "indicator--c356f9ab-17f1-4371-9ad7-279d4cda631f", "indicator--22d0b5ac-798e-4d67-8391-60556b614d28", "indicator--28269f60-9583-4dd1-bbd7-b82b924564f0", "indicator--82bca353-d89d-480f-875b-204df7f1b435", "indicator--44921d46-381e-4e8e-8d62-e2fc6196dd87", "indicator--4667dfe7-febf-4d51-88c4-85792db6027c", "indicator--298768ff-52eb-4038-bb30-b6f3a33280a4", "indicator--efedf643-d911-4eaf-aee5-78b2d72471f6", "indicator--b7cdf22a-ef66-4f0d-992c-ea574ddf9a75", "indicator--5aea33a0-4d3b-4e31-9fe5-b93fd277e334", "indicator--bc7a6db8-6824-4d86-9a86-4930df5fec2b", "indicator--d99f5fd3-1fcb-4a6e-b11f-7a804e7a85c8", "indicator--e6ff2a92-11db-4e51-8d86-892705d57a50", "indicator--92b2e7d8-eaa4-4bc5-a3b3-97b6629d77af", "indicator--d1e70e03-4b33-42a3-a742-b18079d039c4", "indicator--369fe4ca-171e-4f8e-bc9a-13f5d28ddd25", "indicator--af3a28f9-253d-495f-bf93-cb8426e815bd", "indicator--9109dfe2-0673-4b16-bf76-03bdc2dab89e", "indicator--494cdb20-a21c-474f-a658-59d4e46621a9", "indicator--9e3c14b2-41e1-47a0-9939-7d409b28592e", "indicator--caa5cf92-5f4c-4a13-8ab9-69d9e2a9b434", "indicator--4a943ce6-f10c-4a4e-8152-ddf9ebbca7e1", "indicator--5fc7198a-423d-4635-87e5-645ee95a0c32", "indicator--c415c857-41e1-452c-9656-fed1ad98dbfc", "indicator--ae03cbe4-a16e-45d2-b646-e77670ded019", "indicator--31e4d3db-3b13-4cdf-8190-579e103ac978", "indicator--52691135-e8b6-4d8e-8703-2c74dfa41cd2", "indicator--f4cf0ed2-e12d-4d03-827c-c065b1590a5c", "indicator--de912293-f1da-4b14-9b54-a01ed6f66dcc", "indicator--c598189e-40f3-4a16-85ac-b77091f7b7cd", "indicator--b8f7e424-0003-454d-9fb2-9322c5b2d8e1", "indicator--8fba03c0-ada2-4a9c-afc7-2c98b89380ab", "indicator--337828c7-06b0-45b8-ac72-37c74aae5a46", "indicator--9b0a4377-1812-4f96-98a2-279ef37320d6", "indicator--e86a7ebb-e424-47a0-a237-719868882176", "indicator--930e9dbd-a891-4f23-aedf-86b750f649e2", "indicator--a952276d-b11e-4ff7-a1b0-52b16760bf0c", "indicator--61df1d80-35b7-44d8-b16c-6408df5e6175", "indicator--aa0e43e2-53c8-4e41-b3fc-4828819fa8c4", "indicator--ed1fc3e3-e40a-4a02-872a-9e73a5c38b2f", "indicator--1261ff2b-34cf-49c1-9e7e-0f87188f4488", "indicator--ab2b0b1e-94bb-4b6f-98b8-abead8398542", "indicator--daffa19a-c5fb-4b4c-8ab4-a23a8f3313f1", "indicator--60ac5a20-3c19-4c19-9309-9ea0746f1857", "indicator--2ec55df2-b2b2-4c10-a5ba-b4bb71c62989", "indicator--80584896-313c-4c61-8e17-d68cfc71af31", "indicator--e4bb5c1e-fb2d-410c-8548-f5ce97dd70cb", "indicator--4f7e98aa-ba78-4fed-a464-850a138a305d", "indicator--7e0e20aa-a71c-4f94-922c-57487ac47a1d", "indicator--fa5c219b-dd71-42d0-ae72-21acae4fd510", "indicator--9e24c981-72b9-434f-878b-6a32313450ca", "indicator--d27dff4f-c5c6-482f-bdd9-fc9ea6b089a5", "indicator--74776e73-2169-4c44-af0a-c55d649be6ab", "indicator--a02bf3a4-25c5-4578-abb8-7bdc132fb740", "indicator--82bad397-7efa-43a4-aa0e-1a1a76ae91d8", "indicator--cf541db8-fafe-4642-afd5-d99646e182c6", "indicator--3dfc6f59-6837-4e04-9ceb-32811c6e4479", "indicator--df5c9f73-dd9f-49a4-9b99-4a98161a495e", "indicator--77e7d30d-8ba9-4ad2-928b-022725572ead", "indicator--ad465f13-1bef-4b0d-8a59-6d754a6d53cf", "indicator--358642db-1fa6-42c0-ab15-137801d52268", "indicator--64c68ae4-5707-4b65-8165-8344cad110c3", "indicator--dd5b9bb8-0109-44d7-9aa1-b2dd81c802ba", "indicator--238c2678-423a-4391-8817-2faa22302490", "indicator--8cd868d2-6a27-4b8b-8099-33d871d9bbf7", "indicator--3f84b725-99b8-4592-9e5c-88c710f1f875", "indicator--21a03e39-aba9-4b92-9b67-defc34ef99cb", "indicator--a3d2ad66-3d93-4695-b308-629ad8ee7331", "indicator--6e73db8a-3602-4dea-bc35-45ac88513a38", "indicator--14d3bc72-4ab8-4413-961a-0f95412d232a", "indicator--c85b3c6b-fdf4-4a3d-adcc-79ed64f5416f", "indicator--511f2638-476a-4a42-9ea5-892df440c88f", "indicator--eff6595c-85e7-448d-b908-377683a91d10", "indicator--ea0afe73-29db-4d40-9c17-cd31a36b123f", "indicator--66347d41-e034-45cc-8da1-27d7cc8b8e16", "indicator--529b93d7-1987-4699-82b4-389b0dda5297", "indicator--93ad8da1-1ab4-4ca9-8221-14189d49595a", "indicator--ed79632b-56b4-4ea6-9304-28ed4924b8dc", "indicator--47fe1f03-4cbc-4080-ac38-b312be7bad60", "indicator--db06ebe5-942b-48b5-90e3-d0a1a7b0701d", "indicator--565245bb-fc98-4a97-9c38-f6519408e06d", "indicator--536ac58a-739d-4a55-a12c-a7475b81e3cc", "indicator--ab0d8108-472d-4506-b026-10fd14c06373", "indicator--9d1b597a-9c59-46fd-a53e-2e4f2f9e23b0", "indicator--3ff6a6c3-d851-4562-bb36-e157a0db232f", "indicator--d2e41626-977a-45f6-997c-b0e83ae486a8", "indicator--f1ce80af-a7ee-440f-a634-aee1a6ffc38b", "indicator--559c10b6-282e-4efa-9f25-d1112f0e3087", "indicator--9b0d8103-8cab-4e07-930d-e48cff8289c9", "indicator--7befd4e2-6263-4f1c-9f50-da8de20d7239", "indicator--9c570fbf-e335-42bf-893e-bc6774caf5ac", "indicator--f30dc180-92a9-49b7-9654-245045eb8c46", "indicator--354cfa1a-1632-48b3-b1ad-59e2cf35d6b0", "indicator--6fae6661-28f9-4914-8d65-cc69f4608b89", "indicator--eb7f8dd7-9cb1-4a1b-8da1-5539194eb1f5", "indicator--6c3d5997-0180-4b34-86c6-d258ec3a049e", "indicator--0133df71-c198-4d03-bf5c-2fdb65ed39df", "indicator--41e4cef1-ec16-45de-b6f3-4bafc45351fe", "indicator--f0090278-a942-4bb9-9bbc-bdfa9406c7a5", "indicator--f1abb047-eb40-4c54-82c9-ce15bec13947", "indicator--230c7c5b-d561-4788-9cf9-6aaf50009fd8", "indicator--e1b5e1c6-a781-4c96-b6f7-3294326deef2", "indicator--c92df231-d101-4868-9326-414a0ed94b4e", "indicator--b19d4783-482f-435c-918c-f773663acacd", "indicator--033b6453-662d-45aa-a0fc-94fa811a271e", "indicator--3cfd759f-619e-496a-801e-231b3e812f5a", "indicator--92a2a4ec-2257-486d-b7f4-5e1ca6773272", "indicator--1c507962-1443-4d8d-8c0f-b64ed76db154", "indicator--fd652365-c261-4d76-9863-14cc7b7b325a", "indicator--15e17a6b-eea9-493b-9345-2fb1b5d17e0d", "indicator--f7dcbd73-d086-4e8b-b0e0-a22749f64543", "indicator--e4f40f8b-92e0-4775-801d-4195bafc7de8", "indicator--8dbf3142-b09e-4433-b103-3ade21363b3a", "indicator--3619fe8a-d384-46be-a30d-283c80060f18", "indicator--8a7bb0b8-0aef-4b81-9f3c-22e17e16a8d1", "indicator--a7803e0e-4106-4500-849b-d7b3c542ffed", "indicator--f0e4e525-855a-416e-8f45-ed1d100c2f6a", "indicator--6fd907e1-1386-4a4b-82c8-458e51b8a9b6", "indicator--281cce84-3bf0-4051-b607-096b438c5ed9", "indicator--01890a8a-551e-4dc7-91b0-f20fb0cf47c0", "indicator--143be3f1-45fd-4114-a9d8-3269f5456f1c", "indicator--ca3e8a80-5768-4007-95d0-7682db9e25d4", "indicator--f2519ae6-e7db-4494-ad6a-191444255d0b", "indicator--e02aa481-d6f8-4698-9c82-d141f2004a2c", "indicator--282a605c-47c8-4150-9cbd-79a80d39c920", "indicator--619048a2-34a3-4e1e-9b3a-181dbb0a803a", "indicator--b8f683aa-06eb-49a4-bfb5-c22497cefa91", "indicator--707ba541-618d-44bf-9131-c742a5642bef", "indicator--6b8537a5-c26f-4720-807a-80c1e2e4d55d", "indicator--652792bf-2fa8-4537-b550-913f9f35ef6b", "indicator--2da14706-7236-463d-b8b0-df59501a47d3", "indicator--73a2393b-15b8-4bee-b622-941ab78bef13", "indicator--41f67cdd-8a92-40cc-858a-d5535673e67e", "indicator--307f3efa-cd4f-4cd5-a9f9-93d1f6dc71a4", "indicator--46630790-2597-4178-86e3-2bf87e77e833", "indicator--ddf4d88e-7bd1-43a4-b015-3b22dbffb0bd", "indicator--385eaa90-df17-4776-8520-d0fada2de106", "indicator--a9072222-d17e-4afb-a6ee-bf3a6fa5abc5", "indicator--ef9d0f8a-da69-477f-9a2a-c126b2641fcf", "indicator--a8476b84-2065-4aac-b867-0ed75bd8875d", "indicator--5a1b39ae-1bfa-456f-ae7f-b635917a755e", "indicator--b0778241-ae63-4383-adb6-7abef1294ca8", "indicator--d38a3a06-c341-41a5-ac36-c9d6f91d6071", "indicator--7baa42e6-54a4-4f23-9b14-4f89b7f0564f", "indicator--fc943d2b-af6f-4a0a-880f-7ec283aa15bf", "indicator--9c712417-e786-4aa3-a6bd-e6cf40c2fcc5", "indicator--2ddee4a3-8d94-4dba-9a39-722e08c0c343", "indicator--dfea175c-1254-4f16-9c9b-f503bed0ce98", "indicator--fc2de688-d3d4-4a15-8450-d023f8b0b538", "indicator--21ee9c6f-2afe-4888-a9fe-4f5f68bfb4e0", "indicator--496c3bbc-6cf8-4bb5-958e-f2c8ec442b10", "indicator--db52e0e1-2d66-452d-9dac-44b283e90e44", "indicator--241c6d28-c09c-472b-ad6c-17145488fcff", "indicator--6fccc931-1623-4749-b76d-666bbbd78dcd", "indicator--374aa6a4-6e1c-460f-99c8-4092233cbf3e", "indicator--0748b956-6df0-4738-969f-206df4d97ef8", "indicator--839ed4f1-f37b-47b6-92e5-7ee7ed1fd585", "indicator--9a865782-0803-4170-8948-f25cdf19b1d0", "indicator--a8fbe05b-53cc-4f6a-bab9-f4d2015e5d46", "indicator--b44dc1ff-7b7d-471d-89e4-40e23db0a387", "indicator--ebe95040-67bc-43ed-8c51-d58ebb6fed56", "indicator--03484565-8888-4c60-884e-dfb3a9ea75d8", "indicator--7b5fde7d-b496-47b1-a0cc-62e6c5f56a2d", "indicator--7079efa1-fcd7-448a-9227-9af7f2a30567", "indicator--cfa75592-41d1-46f0-b7e4-7dde9803822b", "indicator--620e5b87-0733-4a6a-b811-306b513487f7", "indicator--5b770a4c-e8eb-41c9-a2a6-6e3789948c8a", "indicator--2c9109e0-3389-45d6-ae0b-d7f184748010", "indicator--985fcbff-3dcd-4209-a50b-9dc30a52d1a7", "indicator--da777f60-fea5-4fb3-950b-40acdd2de559", "indicator--0a99ccdd-4c26-4f7f-a593-9aa8f07ec8f8", "indicator--b156573e-5dbd-4e3d-a208-6b4c1f06bdf9", "indicator--52b0910f-4f8a-46e2-96ba-c32d910b1988", "indicator--0978e748-3d11-4ac4-91f1-e82e11641680", "indicator--bd59dc99-2f5f-415f-962e-064c63a59b3e", "indicator--b017e4d9-c324-4242-8f0e-77eb03f77ef2", "indicator--baa7df2d-2030-4d70-8aa7-a447b9b44951", "indicator--a7b97c55-1edf-4ebb-b6c8-124a458df436", "indicator--385ec501-f6ac-42d9-afeb-8787f133f5b2", "indicator--d64596a1-e973-485f-b386-430fba247f12", "indicator--b1791e81-02fc-45f4-a79f-4bb2a2f650f8", "indicator--85509412-c996-4346-8965-941546b7f96c", "indicator--941644f4-08f4-4361-af9e-cb8c72dc3ff9", "indicator--063d6e75-8840-46f3-80e4-1031d88cb6c3", "indicator--5f19a7a3-abc6-45e7-b221-51d5c53c3e44", "indicator--b5d49a21-6858-482d-bc6a-727694272bfd", "indicator--f8b0ec87-5b81-4929-8816-defe434879e8", "indicator--2fdf258b-1a30-4dbb-9e93-702a2be6db07", "indicator--cd5ab9c7-a816-4ecf-b07d-6d5cd1622e10", "indicator--2f6a1047-53d0-4d03-a0a3-8a6bdb753923", "indicator--19fb19a6-f6df-4078-9a37-9d92e8930a93", "indicator--a5aedf8b-3312-4332-bd60-86dc0d6635fc", "indicator--7c76901a-dd37-4049-a556-e07499472a10", "indicator--b0301367-41c1-4bb2-b97e-c64198ea3a13", "indicator--3b0d3f37-6ea6-4cde-a48d-14a517cf4b8b", "indicator--3c69fe8f-1fa3-4b76-8800-a9aeb331b08b", "indicator--c5844640-5c8e-4c15-94d0-b694c51e666f", "indicator--76e65a54-c3ce-4ecb-8dc9-ac0902861ddd", "indicator--37cb7e4c-c07e-4cf7-9a67-032e1f1495df", "indicator--930192c5-89fe-480d-9cd7-21947bb9ac13", "indicator--fd24ae99-3482-46bc-8dd8-1b6e6d969528", "indicator--d7a4a774-bb80-4ece-9b82-b71f8e8cbaaa", "indicator--8553c6d7-c467-44a8-918e-9fdd40f9b3db", "indicator--e892c151-dd63-481b-9ece-f933ffd2027e", "indicator--38a0d882-7990-4493-8d9b-db4f32b5fa07", "indicator--13783ff9-84b3-41bf-b68f-c681a08fc36f", "indicator--08fbdd10-eb09-4687-bc99-b5b03ce0bd36", "indicator--5af51779-6efa-4c6a-817c-4e82ee84d8eb", "indicator--b7568c16-d980-4c40-8f8f-7fb2b176b1b7", "indicator--e9c5eea3-3756-46ca-907b-72d105e62dc6", "indicator--002be210-a7ca-4396-b0a1-50feb023be14", "indicator--6ae4d272-987d-41e3-bdeb-c5c8542f2121", "indicator--eeb10480-cf3d-4136-b01d-5345fdad38c7", "indicator--1cc54ca2-81de-4038-9dbf-5c11c5e15b51", "indicator--2d99bfa8-021f-4588-a249-fe3014958cd0", "indicator--c6e25be8-0b98-4606-9224-2838f87d36fb", "indicator--d8f63242-ebcd-4718-9913-a2af6a4dd73d", "indicator--9797076a-7081-4dae-8325-b42ac0547ccd", "indicator--614cd3ac-0507-42f1-8939-3e13de5a3c84", "indicator--489a1764-c326-48f9-844f-c7ca01c97b74", "indicator--86683f28-e08a-4d78-8fd5-ff3984893c9a", "indicator--b88cc30c-1de4-4b86-8f3e-11615ed45855", "indicator--0b352adc-d7fc-41ee-98ee-2279ca9137a2", "indicator--59ee7273-8ba1-4be8-bd6c-0d6e915ca744", "indicator--bbdecd79-cf67-4db1-b41f-8f8799e68817", "indicator--5ab0f4bf-3859-44d0-ae2d-c93c712b93ee", "indicator--8c8a3e6e-3d9c-4d3a-9922-719489c0c31a", "indicator--8380e76b-2610-420d-9779-692906d7b372", "indicator--6155d9ad-55bc-452d-9fbe-fc482955b027", "indicator--9aabb188-369a-4830-b4cd-8f66ee6f3d81", "indicator--47902ec0-729d-47bd-8545-48214ad4c8c7", "indicator--487fab6c-97b5-4c30-ad29-322cf974a8a3", "indicator--521cc2c3-be03-48c1-be15-151aa1c2afa1", "indicator--60066f0f-a570-4917-a258-71bbea68ee2b", "indicator--4a630ada-5733-40bc-b428-dd8287bf3671", "indicator--9c990e47-58e7-40df-9b51-5313392d12e2", "indicator--c96bfb53-e152-4f46-8e68-1c8a1b155cf7", "indicator--66e560af-ba1f-4f07-93ef-7e7d7f289eac", "indicator--070b3fa2-a889-4e8a-8f26-9b483467c8bf", "indicator--f89ff36e-b04a-483f-a85b-40953ee7e608", "indicator--88709e8b-924f-4c4a-a42a-454816e61519", "indicator--7ea1e777-f0b1-43ec-947a-553d2cb497e9", "indicator--6fefdaee-b99d-4d31-b762-b66d38665850", "indicator--dfe369d4-352b-4df7-be2c-a350833878a7", "indicator--74885290-ceb1-4ae2-b17a-49add5133428", "indicator--f2964587-b868-4194-8de8-c47be643a7c7", "indicator--5eefa6d8-a573-4382-808b-551d154b6c64", "indicator--7e21b349-1f78-4958-bef6-b3cd02010031", "indicator--b763f521-8614-4432-bafb-aa35de4ebff7", "indicator--2b0d1c8a-220d-477f-80e7-4ef3536bc1ab", "indicator--11cc09d9-8100-4594-a091-12d748f8b4fe", "indicator--89dbb182-9f71-4406-8a8f-59253229ceca", "indicator--f4ef166a-dc57-47da-84c5-6b972cb484b6", "indicator--a4bfd3fd-b687-4f8f-811c-2d8e06cab714", "indicator--47bd6284-6cb2-40c6-856d-95c687cda76c", "indicator--3f2d2dec-fc0a-4761-94f7-4786d4ff14e1", "indicator--b6ac48ee-c1ba-4249-a180-5c6f8aceac4b", "indicator--cd0f79d0-3059-4900-9af4-48c23c2811b3", "indicator--737d06b6-9fce-4557-8b5c-545ddbd98725", "indicator--711ee24a-f0da-428c-9c9f-0640ff663c0b", "indicator--09cc1afa-4506-4065-b189-a0ffdde25044", "indicator--e004515b-1d8b-46c6-8d0b-a9d718e1d3a9", "indicator--e8cfe1df-8cf9-4725-a549-5c3e4fa28086", "indicator--e4b7629e-ebf3-4227-bb3f-af4cdba63219", "indicator--9a88ca26-4d8d-489b-9174-c8b96a391ca4", "indicator--db5c642b-f2b4-4329-b2c0-3a55ab0a8eff", "indicator--1b7dcdd1-513f-450d-af76-026a11fe1ca7", "indicator--3cfbbec4-a23e-4672-a010-3e36ad6c8a85", "indicator--2d1943f6-7ab0-4087-9c7c-6026bda67b34", "indicator--e16a836d-4a0f-478f-9402-eaf500d9a5ee", "indicator--678fae0e-85c0-4591-bd63-e1542418bae0", "indicator--09c47098-5e98-4caa-97f4-33efe6e32173", "indicator--5b1d463f-76ad-4982-849f-ae36a08f3770", "indicator--79cd3c3e-a2ce-4c99-9c0c-065808bc8df6", "indicator--ba46d5d6-b35c-4a65-b032-da75b5aacb62", "indicator--3d8f862e-78dc-4a81-9415-5eb0d8706e75", "indicator--d9d4fa60-8d1b-4206-9c20-06935d07154b", "indicator--5dcb4d9c-1b83-4556-a8ad-5b9925664144", "indicator--d0fe0789-0cd0-49c6-b0c5-68fc7f7b7e5f", "indicator--6d2ddf86-0588-4a26-89e0-f963be9dc1e4", "indicator--ff34f1f4-8311-4744-bf37-6bbaab88d416", "indicator--6e90765f-9bc6-48b2-901e-4bd3457e19d9", "indicator--bc2b4ce4-fec9-412b-862a-932fe67d50b6", "indicator--5808cb1c-f2ee-44cb-bb72-fad134997202", "indicator--c4492c5d-c7c9-4004-8971-8002caf13315", "indicator--51786ad6-3cee-40ba-8c9b-4dfbd59566e1", "indicator--d0234889-f58f-4554-852b-49e9b6380583", "indicator--776c7cda-992f-4191-a5b5-274a2b6a439d", "indicator--30ea3e3e-d03f-46ad-96ab-628fd226841d", "indicator--ece483a0-b746-48ea-b2ef-697c9b9adf27", "indicator--ae0d7bf5-7b76-4586-a862-949487e3a4e7", "indicator--c716d366-c0fd-47fd-9073-b56e83fe7019", "indicator--41a13c83-474c-4018-8112-f249cfc458ba", "indicator--56bcbbb1-db06-4915-abab-5a835b63ad98", "indicator--8b51044b-24ae-48ad-a908-daa305abae16", "indicator--1e19425a-1105-4508-bcb9-db6760304fb0", "indicator--d272439b-bb88-4655-b936-a7a4e6b83b57", "indicator--ff277831-64ac-4a48-8372-34d8d24d24e0", "indicator--b0279116-036a-4f8a-9b4a-a9be38594e67", "indicator--e05d77f7-f565-403e-a95d-52cb6c2ddaab", "indicator--db4ea5da-6c73-4a29-99c0-a028cbb7750b", "indicator--83549d80-30cd-40da-9039-bc60347bbe9b", "indicator--d59738dd-6679-4376-9423-3740fb6f9d6e", "indicator--8d714b14-513c-46cd-8ba6-873528781553", "indicator--7c83d657-17a5-45f5-9bfe-266b76c2b55e", "indicator--048a2442-0079-4901-8537-5102aaf4d1e1", "indicator--c88a583c-32ef-4ea5-a80d-46bba9076167", "indicator--0724e28d-b997-45db-833a-a3ac79c0b7b2", "indicator--8d2ebb4b-21b2-4178-a7b3-a42aaddde89c", "indicator--b27b491f-9153-4496-ac99-0b5a8dfd1590", "indicator--0a2dedd1-c140-4935-b84d-16c1bd707268", "indicator--8da054ff-b2f9-4bad-80eb-0d744e83ca53", "indicator--8277e4db-c8bf-4773-bd83-5a99e3ffd332", "indicator--bc63c3b4-4675-4f21-a7c1-ac79847ce9bf", "indicator--a0782e81-90cd-4e90-b1b2-f5350c0520fc", "indicator--0e5a752e-00f6-4892-8d86-186eda93cb56", "indicator--4650f297-50d1-44b7-b4e5-0c144b155dd4", "indicator--d94b23b9-0f63-4488-946c-b7debe150e89", "indicator--3ef5bb6b-1122-464a-a87e-4974d4ec2e87", "indicator--b9af66a0-05b3-4896-a6ab-f6b5b31d62dc", "indicator--2a36c1ff-c98d-4102-b170-088801bdad31", "indicator--cefa8126-21a6-474a-b2c9-c3942f0bc0e0", "indicator--cd978eea-02de-4578-81e5-d6d137da76c2", "indicator--91490fad-d5b4-4135-99b8-4e6aff9231c7", "indicator--9197a9c8-246b-4ece-8f0b-8e53a1862710", "indicator--235e2a73-7189-4fa7-bc05-c7abf6389991", "indicator--166a91b8-5a74-496c-b926-881117be21a5", "indicator--e65f8e9e-2906-421f-bcb4-4598db19f2be", "indicator--dc3f0788-0a47-40c5-89d2-2965ae2259c5", "indicator--132f1acf-c525-49a1-b982-e8bd3b669951", "indicator--a73b5f57-8bdc-46dd-8134-c2d2429b8f32", "indicator--07eb7733-8555-4642-899e-b4e580598311", "indicator--a3132c6c-3898-47f3-985e-98f830f0117d", "indicator--68087840-2eda-4f04-ab37-fd9fff80da58", "indicator--ff9e345e-5cdf-42b2-9eea-13d960ea8390", "indicator--a53b1d91-4796-49ef-a094-f13802a54e6c", "indicator--56abf054-ec38-4de7-af5c-bba5f3345c30", "indicator--9fad81cd-cd90-417e-8277-73f1024ebf41", "indicator--da08923c-22d8-446f-9e8d-fe24ed54986e", "indicator--01c41a16-fdd0-4286-959f-adcf59d81064", "indicator--b029cae7-2de7-48dd-b4e6-9736c55da141", "indicator--433c25e6-3142-48cc-8d7f-076a344a2655", "indicator--652e8526-21de-4729-b85c-e154bddac1d8", "indicator--9bdfc900-8c66-45fd-a836-f13c0e85c342", "indicator--ed83b897-6c79-47a2-bb03-ef0f45907191", "indicator--82853cf4-aa27-4f5e-b334-539e20265b49", "indicator--72bc4e90-3596-4dd2-b25b-eea794bba8b1", "indicator--823fda64-1982-4dfe-b833-1d3c57ddba03", "indicator--080560d5-6939-4e66-bd59-e5e6c634b326", "indicator--a0471af5-d234-4776-8bc1-02e79bb84c19", "indicator--0b90724e-a0c1-44b8-b02f-1126666fe601", "indicator--4fa96b00-8d9a-4582-8e85-1e7ab9f9a2cf", "indicator--e75749f6-5aaf-499a-b036-de5a483cb387", "indicator--c9e20603-2e9e-43cf-8ce7-647692d8f49e", "indicator--341dc24a-281f-49a9-93c4-a6fc6b97ceb6", "indicator--5618f400-bef6-40ce-ab8c-6467198d7908", "indicator--33d3087f-beb3-44bf-8f10-18f8a15f0f8f", "indicator--472c34a2-eb53-492b-b976-c71b5c0afda7", "indicator--c1db56e3-34c1-4fa1-9169-49bcce964740", "indicator--1458d728-92cf-4e4b-a3e3-e143988da5d1", "indicator--849cd845-e6ba-4e26-9783-1b6d66e4e144", "indicator--69129e5e-b648-48ef-87ff-b723688f82bc", "indicator--f8e3b7d4-3771-47c2-9e85-2f6ad313ad82", "indicator--3b66a83f-3d06-4c24-9a4b-ecf8ce32bae0", "indicator--8818dff6-a63e-4c93-b0b1-77bc50f7300d", "indicator--a480a545-b4e3-4f08-95f3-462820c130e2", "indicator--ec7a2908-7ab9-4d10-a184-c4ba9e9f33f1", "indicator--ad25fd97-85bf-4c1a-9aaf-7eeb52affa36", "indicator--ca9858df-832f-4a5e-89dd-1b79cbc55c96", "indicator--43288992-f21a-42ef-a94c-135cff19c25f", "indicator--d8438afe-3ee5-475d-9f58-98d539428ae0", "indicator--c0c2a7b6-b79d-4683-9d5c-78f4a3cc9f97", "indicator--fa018da6-d61a-4fdd-8c0d-2c15fc00f52a", "indicator--0e498882-7c86-46f0-baf7-cdb3f16886ac", "indicator--e936fb27-8aa8-47df-b733-fb2cc94c7754", "indicator--4cab5a9e-f8a7-4890-9fb7-e8f65cd15c2d", "indicator--48e6f6c3-b896-42b9-aebf-d3bb5a958247", "indicator--689fe434-c303-4629-8678-60b12dd4db49", "indicator--f88770da-500e-462f-b686-fb67b4708e5e", "indicator--40bb45ba-1f5c-4fa0-806e-df0dfc951a41", "indicator--88953823-f56b-4912-9c3e-8123cb11dae7", "indicator--3cdaa2be-cc13-41d9-96b9-5f733f56cddb", "indicator--ffcbed88-1554-4157-a68a-ea672ca59621", "indicator--83433657-e5b9-4104-a8e1-b1ab402241af", "indicator--77b38c04-8ffb-4922-b6cf-d47d3d8b77ba", "indicator--9ccf1666-68fd-4d11-95c0-db79ab40cbbc", "indicator--83a19ef3-f21e-4625-83d9-4bbdfce2997e", "indicator--31ef3192-a307-4b98-8090-36c500a7dcb7", "indicator--26e2b6ab-b7c4-4aa8-bda6-077065cc6bd6", "indicator--103d4da9-9941-4373-b501-3fecea300ba2", "indicator--9183f395-4d22-480f-9660-904a40f1857e", "indicator--7be9c7ce-7d35-4dd3-9233-38ec874c527f", "indicator--a6ab5e2e-b6b9-459c-8153-9a1f8c4eb657", "indicator--768d03b7-0e0d-4137-ac83-b772596339b7", "indicator--486f01fd-74d3-43b9-aebb-545c1cff4eee", "indicator--42affa3c-b30d-462c-8e18-464eec5ed952", "indicator--df496118-b5b2-4f25-ace2-bab9bb48fd64", "indicator--a661cda8-8aac-45ac-8dce-a48e23efd1e4", "indicator--24a0dc65-f777-4906-bd9f-4654e7875a4f", "indicator--652bc48c-6a1d-4eb0-8567-fba2fa6f9482", "indicator--f88ea7b2-0808-484d-b5f8-458f1b24d70d", "indicator--7d7a6da9-ea24-4837-8cba-c48ddf6de098", "indicator--6c28bae4-89b6-45cb-87ac-2a69afbe0047", "indicator--e963e58b-d5f5-4cf7-9207-9eba92ad4a4f", "indicator--be67d830-ec91-4b68-9d05-5f54c6b520af", "indicator--a770d2f6-f0f3-43ac-8c9c-58e408eab8eb", "indicator--965cfbfb-542c-43e2-ac82-fd06c24c93df", "indicator--6af4d196-111a-4546-8fcb-6f296e29a062", "indicator--f2720729-3803-408d-80a5-a9bd4b0c8392", "indicator--b0531c64-094a-4a28-b108-4cb9b1512998", "indicator--cf852065-11c1-45c3-a017-9df8b371bc07", "indicator--f0d9b60b-f9dc-43e5-85b4-6f5841c2b38a", "indicator--2ed01a6c-8daf-47df-8d1a-aa7785d53081", "indicator--6c2451e1-c0bd-40a8-ae3b-9ce6172e3e88", "indicator--e3173e9b-7efa-4900-961a-1508a6e3165c", "indicator--592b6290-533e-4a33-8fb2-6ef5a4782d34", "indicator--2d37d0f7-963b-44b2-a6af-bcf35521c438", "indicator--920e9c3b-8395-47d8-831b-8b80d8b7ab89", "indicator--246e91a1-7651-41b5-aa56-46989f18af22", "indicator--58855923-f412-4342-b314-d2535da22d85", "indicator--59d3a91f-2e68-4587-bba2-fd57aad8f838", "indicator--563acf67-d3e6-4479-8b70-4c84b4c837e4", "indicator--7cadb991-33ff-4967-ba39-31afd323e2fb", "indicator--6fd0137a-ab11-4b8b-986e-13e43bdfd81a", "indicator--1cf691d3-14e2-4179-a61e-3c170f9b502a", "indicator--688bb833-9c17-4ab1-b947-7feaa310ccaf", "indicator--0b1ab3fd-4ec8-4e43-ab31-dcaa5cf1b071", "indicator--ea3d3e57-18ba-438c-86f4-e6de0352a6e9", "indicator--87e2295e-fa2f-4d2e-a63a-220bd795cf67", "indicator--6421379a-c9e1-4743-9762-6487efe3e9ad", "indicator--b01e2a15-e7e0-4d3f-be24-8958138cb5c0", "indicator--15ca9136-dc90-4225-8c56-cef39c05b318", "indicator--b52107ef-af87-45c4-b2f6-38bcc2103bca", "indicator--fd8c9f7e-a3e2-475f-9249-00d5bc7d15e3", "indicator--259108de-c930-41c5-a382-e108c63f615a", "indicator--d48e6755-af68-4bed-b375-003831500c95", "indicator--85863ea0-1a67-4928-8750-7796b65fd277", "indicator--e461766f-2715-485c-85e8-87eb27a1273a", "indicator--265d06b0-6253-4c1d-b329-57fba6440cec", "indicator--94d03ebd-3e61-4022-921a-42f99980ec72", "indicator--1b54bdb4-df30-4df9-a2f1-3f1cd5930798", "indicator--2740eacb-5a21-48d3-9bd8-df8eb2d02aed", "indicator--27169f48-1d13-4e99-8bd7-ab0063b7d238", "indicator--30c4b9de-79fa-4386-97bf-ff53fadc7a75", "indicator--50c247f9-8938-4513-a5c6-55b78d93efcc", "indicator--610af9f2-2236-4884-95df-dae867e99e8d", "indicator--d358dfd2-59f4-4639-9505-d005b911ead0", "indicator--d53163b6-fd54-4739-8b70-4fc916c98522", "indicator--583f26cd-dd46-4093-aae5-d3aee4a9b869", "indicator--e19a0270-d15d-4924-97f3-1145aff3caf5", "indicator--e989182d-b66e-4be0-92e8-258e4918998f", "indicator--95cb0703-02e1-4284-9413-9c2c0bd8caed", "indicator--caa0f598-5fcb-49ac-a1ec-81863da24e16", "indicator--1e8cb37e-5b20-48f7-aeff-134e5df93a8c", "indicator--48d85367-8dc1-4e94-b5e5-7dd227080544", "indicator--b5025a24-83d6-493c-b27d-f7640104461b", "indicator--8ed52d6a-b448-4e06-ba67-4148a43c6330", "indicator--d32c7dee-d8a0-44b1-aa21-57c64763083a", "indicator--32107bef-1eb3-421e-a5a8-ee8aa9e7b26d", "indicator--2473ed7b-ca9c-495c-b752-bab0900ea22f", "indicator--17817a3c-f7a7-4dc8-a3ac-35dbcef8199e", "indicator--1ea03466-c015-4b0a-8e4e-a4c98b2345f6", "indicator--80e593d4-1e54-4eb1-ba99-33c387735189", "indicator--69edb109-6b9d-4a13-88cc-740a386c431f", "indicator--d31d0fbc-be60-46c4-a94f-ab328f7f6c81", "indicator--8e3fab9d-c3a7-4b49-8fee-12721f44313b", "indicator--7db2451b-8b81-4bea-8444-4ab0b0f26212", "indicator--6cd845b4-6961-4303-86b2-c2213d58c33d", "indicator--bb93e6aa-70f2-48b0-877d-346d910e6ef5", "indicator--a0f3cbf0-6597-4ce5-a1fe-34267c25f1bd", "indicator--43467d34-ecc3-4b54-9bdd-8deade14ac4a", "indicator--2d6c426e-ac30-467b-b48d-8c5c063b8475", "indicator--4841d766-8045-40b4-abe0-be44e5b28a60", "indicator--cb9071d1-a395-47c7-ae00-d65d9bffc521", "indicator--b2463053-3a86-4004-858f-77f2a1cbb97e", "indicator--72db6fd1-c29b-477c-b30e-1dc68b23d769", "indicator--c6b68146-10de-4b5d-814f-84599e4c265c", "indicator--00cbdddf-7966-4dbb-8dea-928a1681f304", "indicator--96cb6958-8690-48ca-ad93-57f53516aeec", "indicator--956142af-c748-4c04-a45a-bc9fb3d8c409", "indicator--7d06ad40-a020-433d-b7b5-b457a7405ac1", "indicator--400ce8c1-992e-426f-afb8-2e9303e0c34f", "indicator--b8389f70-d421-483f-b4cd-b7ede4b319cc", "indicator--489eae9e-63d0-440e-8edb-93ef877a7e25", "indicator--ee98baa5-79af-4b24-ada4-4743347a461d", "indicator--9ce3f7b4-7ed2-4603-882a-cbdca4c6e6be", "indicator--10f63841-def5-407b-9ddd-baed7d30dca6", "indicator--eefe9ee5-e5d6-4166-aa0e-26f8e2b94d60", "indicator--4a9178ae-6865-410f-87ba-900393313b31", "indicator--78a8682a-5e41-44ec-9a54-58d8f85991cf", "indicator--f728f609-092b-4b71-84e7-ac9eae0b0502", "indicator--2d759e35-9bf5-40c8-9942-93c6a71d9f73", "indicator--2acd792c-6fc6-4c53-b70c-cdc1bce10843", "indicator--913ec81a-944c-4feb-924d-5b3fc2697ec8", "indicator--74d143d5-6322-41d0-a88e-b8add44581e5", "indicator--7740bfc5-6f87-474b-90af-f797f4250d83", "indicator--6dad6fbb-f77f-40e4-8799-801b1827f155", "indicator--04f03b41-3039-4cc0-881d-9e8f339e8c21", "indicator--07c31aa8-8554-4992-81c5-38eda0f0908f", "indicator--8d22af61-59dd-4fbb-97d3-63e081c4b331", "indicator--5fde013b-22d6-47db-9b96-9a77ace465b4", "indicator--3846a148-fdd0-403e-a781-3827e4140c9e", "indicator--baa4bb03-e8a0-4601-a722-b977127204d8", "indicator--540da561-bc9f-49a2-86a7-31ee09c5296b", "indicator--c91d98e6-09d3-49c2-85ae-ba530d891f8d", "indicator--33d179a1-73ac-4e08-ab87-174dddcf89c8", "indicator--8f46ce94-da94-4432-895f-ada27aa5f624", "indicator--6a6d3469-3a0e-4fc0-8576-12355799fa65", "indicator--66da04a6-9847-4e81-b385-1d4a1d195f64", "indicator--fa4afde9-9aa8-4a99-a71b-29ea5c269e11", "indicator--9b932a1d-7d0c-416f-9e0e-9d7d0878052f", "indicator--7f89ad9e-6819-4ddc-8830-c47a352bd24b", "indicator--f68f48fc-0e01-456b-b412-e60eea054da7", "indicator--679d354e-2ee3-46ad-924a-3aa72293cce5", "indicator--23a38782-161f-4b03-b0f6-350ca76b3276", "indicator--e40ba9c8-aa18-4f47-859e-121aa20e102b", "indicator--a8316c36-375a-4491-b16c-2ddf910ad8a3", "indicator--50200631-f960-42ae-93ee-92da549bea56", "indicator--70826838-bbd3-435b-a610-2e00339b0e68", "indicator--a3248d41-73f3-48f4-8e74-ce7f693f6227", "indicator--7708e27b-a818-40b9-ad78-a710a2a4e683", "indicator--c20b5d0a-dc27-4cd1-bda2-48ce696a0c55", "indicator--de7295b2-7690-44dc-b42c-4b71cb536034", "indicator--0d198956-4f92-44c9-b5f4-9217be53a34a", "indicator--865158ef-29bf-4c58-877b-d27479940b55", "indicator--2df1edf0-863e-4f8c-b9b4-e6c88026d3c7", "indicator--348b8e2a-30e3-4286-bd29-11a64323a22c", "indicator--de195f8b-376f-4ef5-aec4-4103d7e1f159", "indicator--c71d0bbe-33de-4b93-8d67-d2ca206fd110", "indicator--e6681b26-5741-45bb-9dac-c6fa09889405", "indicator--ddfa24d0-c8f0-49c2-b3d3-0b415c7b5942", "indicator--4724b6af-a2c2-4f81-8b95-9fb52c1eaead", "indicator--dac7dd04-555c-4e69-95f7-59afc3d470f9", "indicator--9a97613a-12b3-401d-8b9b-9d42848edecf", "indicator--5463b5d5-d91a-498f-97b9-19a9c391cbd6", "indicator--04ab1618-d0cb-4b24-9766-89e2cbc62123", "indicator--37355929-94df-4d52-95b3-2e631f4bff52", "indicator--9bcbc279-2855-4a84-aa59-28d0e62e8c7b", "indicator--3a77eaeb-6190-45f1-ae21-03d3f6206a37", "indicator--c317c504-846d-43ce-af5a-6bbab57b211f", "indicator--247b8081-8ea4-4a30-954a-d14dafec94ec", "indicator--be0d591f-d954-4f37-9eca-eb79161e5641", "indicator--f71aa9bc-31b1-4b62-aa68-41a71cc14a03", "indicator--9f5dba4f-081d-4845-9be7-3f3dd61aa15b", "indicator--8dde707f-15be-4050-965f-8d817a908ca4", "indicator--6ddbb817-ad33-4781-b0b1-3fca547b77e3", "indicator--17d1c447-0918-46c2-851c-7ec62a712bcb", "indicator--503f399f-347a-4cb3-904a-98f847bce183", "indicator--bcc5dfbd-0586-41e2-b979-1bdbf9adcf67", "indicator--11bfc565-00c5-47c1-b7f4-fb640ca49387", "indicator--e4d10d22-d40c-4988-bc96-b54f63d3f6af", "indicator--914b05b4-9711-472d-a732-847d641a3d34", "indicator--49e34e18-c2f8-42d5-af31-8eb4411dffce", "indicator--6b90b06b-c3ec-469a-9408-b1df373f949d", "indicator--421cf8ae-89ba-4dab-8f13-3bb3c85a05f5", "indicator--dab15fa7-a434-49d3-b273-92cbcb8bc90b", "indicator--0907230f-4ea0-47ef-a77c-6a52a2b9e529", "indicator--1ae61aff-268b-4ae1-b8e7-3dd13d4ca850", "indicator--901688c8-fb76-40ec-8b14-60f94c5a2f47", "indicator--4601dff6-2fde-493e-9b62-27f50c01b4cf", "indicator--c07cfe5b-1e92-4c60-abc8-289326cd4e57", "indicator--73d1503c-020b-4460-a8c5-ebd24767c2f5", "indicator--256e4a9f-6b28-402c-893d-9f997bb0ee0b", "indicator--a492a15e-6f93-49e0-9fdf-3a99a89e5579", "indicator--c17c0ff8-8ec5-4ce9-969b-11989fde612d", "indicator--68436190-1bee-49c3-b9bd-d9b97e32f8f2", "indicator--11731c36-6a3f-489b-80bc-4189594d7a4a", "indicator--0b4ac486-807e-4f04-97ec-85eebeea742a", "indicator--4db754a6-0613-4d5b-be6c-953363453f1d", "indicator--bc1a203f-2b75-42ce-a7b5-4f2fa2453e41", "indicator--e6fda080-7203-4d07-8e76-e69fc554333a", "indicator--b5734071-0a67-44ab-bf97-2de1e9a3ac87", "indicator--80cc2413-abde-4451-bc98-febe1eba4a8e", "indicator--3bdbc217-ac4f-4a29-bf11-578d4dc8551a", "indicator--f258b0c6-6a53-4ae1-8036-6e1bce7d4e0b", "indicator--3e22bdca-be2c-4c07-8422-a124483a02c6", "indicator--79cbf4e9-eab2-46a1-9025-a7d02087e844", "indicator--02c3482c-5fad-4bab-a2a5-7ff47078ca87", "indicator--2eafc680-53e5-4921-b83e-decac1ebef6d", "indicator--6e6835ca-372b-4270-9501-75a291d306fb", "indicator--321a2841-820e-454c-a3fc-bebca75f6e4f", "indicator--fa56e07a-db93-4a1b-956d-10a496739558", "indicator--459b5b8c-8601-4cd6-9a00-ad6a26c3d620", "indicator--c4ab30b8-674a-4bf6-9334-1d47f4a29357", "indicator--dd173590-2460-49d0-bdeb-bede100ca6b9", "indicator--7306b03d-b4a8-4440-bba6-6a3ad2bb1d52", "indicator--76dc9e76-b43d-4da6-8cf0-75c2a6866661", "indicator--c2dbdf03-e2a7-4229-9ca1-f5c13c9a3945", "indicator--057581f6-7a57-4c17-a1d5-919e8e580863", "indicator--72c3b7c2-47a9-4c16-94c8-b1bd90d1f2bf", "indicator--f85dbdc4-7ca0-402b-a455-57dd4841bfb3", "indicator--08b82249-07e9-4d96-bf2f-f8c2e4285c79", "indicator--2dfbb647-68be-446a-8fa5-79fc79c00c85", "indicator--f872aec3-5926-4fd4-b734-66c697a9d7f8", "indicator--d94757a9-071f-46b9-82c6-785505fd6446", "indicator--ac57673d-1c3d-4b23-a410-8b4dd1ac1810", "indicator--71e84552-1df7-4bc7-9bbc-122a53abd606", "indicator--b75da907-6a1e-4d09-84f2-a9aa87b92fee", "indicator--91ede994-336c-4506-b925-d6d60c8163ce", "indicator--294a28bd-b6c0-4c6c-83a5-a70bde183f4b", "indicator--1e116313-1031-4322-bcf3-5876000a6646", "indicator--e33e2f29-c81b-4d23-8a89-8d19477aa5df", "indicator--7db7105d-a13d-44e9-bf57-57cfe8d5a6ff", "indicator--43e65eae-2c99-4491-811c-a3eac1884990", "indicator--42776a47-1334-42bc-a49d-e2ee09aabd2a", "indicator--eafce416-8c2d-4401-9e14-bce7feb0263d", "indicator--4d831d13-20be-47af-acfb-31cddf32d4a1", "indicator--6ad1c068-821f-46f2-a65e-edc5d102fb4e", "indicator--affdec39-2a9d-472b-adaa-2691b5581e80", "indicator--2da79e2f-58ad-4267-8c2a-2d61553499da", "indicator--3eda3376-c0fa-491b-bfcb-a7aa56e26e56", "indicator--140e992a-5568-4107-ac5b-91295fa9c293", "indicator--73d3d916-e01a-417c-bce7-8ddc2fffd93e", "indicator--9c1c1da9-3f14-4260-9564-6e547cfa1e29", "indicator--c249884c-3995-479b-b11d-18f705b89390", "indicator--cd074828-ffc5-45f2-84d2-eea518838c02", "indicator--e45cba21-e5a1-4909-81f3-75c29b271fc6", "indicator--7ce3c95f-abb8-4625-a0b0-794963029a31", "indicator--02b7b502-8285-45d0-b10b-5a6980a90da8", "indicator--ec3c815e-cd27-448d-b1b3-62afabaf1781", "indicator--30a3a1b3-ab8b-4563-92a1-f6d374f64e76", "indicator--da69fd53-43db-4c01-ac04-6f909384e74b", "indicator--3206db78-2d4f-425a-9431-52227a67e00a", "indicator--f29607ba-ec92-4f0a-9e51-443a13eeec27", "indicator--0cf1774c-1aae-4af5-b565-4c6ce9a9d163", "indicator--d0ec3cfe-f597-4fe5-b62d-1d1cf8f8b21d", "indicator--5683df7e-0607-47ba-b67e-eeabf25cb9b6", "indicator--c6553e31-bcd1-4650-b7ec-7b2509b542eb", "indicator--b83ea79c-25e9-4a72-91f8-930b2197e625", "indicator--65b90c28-6fb2-471b-ae27-30ba950f69f5", "indicator--afff9ef0-a10c-4ae5-b41a-3c114580b148", "indicator--43d05898-3f16-4fba-8d21-a75af922c71c", "indicator--40572dae-8871-4433-866b-00ef8a507ca6", "indicator--a0a80220-3904-45bb-9dcf-9337a749dc58", "indicator--2af53557-5847-47be-8fbb-573f1fdc6c7d", "indicator--81648ca9-512c-4c55-bfc9-895a4fd48ae8", "indicator--fe053fd3-461e-410f-bde7-3834211a7cd6", "indicator--bd89ec4d-18da-4cb0-8127-4890191af8df", "indicator--4c83cee1-f706-499f-8bb6-834b0c47e516", "indicator--c505c58f-8969-435d-b3d3-b16fc2e84126", "indicator--18e33b55-d9d0-44de-8e62-ca5c89a8c048", "indicator--d021258e-066e-415e-a9be-27ba3cf07cbb", "indicator--e396370f-2ebf-48fd-ab35-5ec28fd41b68", "indicator--186fc2a0-e9e2-4f6d-aede-68c5e962b6a8", "indicator--f05433f8-8849-47f3-a64b-2ffc972b57cc", "indicator--0a030862-cec4-46d6-9d95-7b5d988484cd", "indicator--0731e1c1-4387-44c5-812c-ca3bf56e5214", "indicator--690b1739-bcb5-4dfe-9853-f9c1805fcd13", "indicator--ede384cd-a4d4-4879-8704-4f097abbe472", "indicator--02888d6b-6c98-4199-b6a8-f2cabd015435", "indicator--833b0b53-9ef5-4a8d-8f76-42762618d644", "indicator--2ccef552-6c9c-499e-8b53-92264364cdba", "indicator--9ea5808d-cbe9-4ba4-abb5-8428ce395f3c", "indicator--14382334-c9ff-4828-bde4-5b81fc9ff3d9", "indicator--893cf551-1aad-44f1-896c-11ca167484ab", "indicator--cbf8859f-d0fd-4769-b63c-3e098ec38a4c", "indicator--67a6d6e7-2384-49fb-bb69-4a99fd7ee070", "indicator--f8af81e8-9470-4e2b-adf2-7b4d7180883c", "indicator--64a34a2f-66f6-4088-a3b8-ea45fb0ec3ba", "indicator--35704670-dcb7-4ea3-97ae-9a687400793d", "indicator--2e7d54e9-5ea9-42a0-b12f-c4330b9d28cf", "indicator--3c7a5e30-f5ca-44a6-acee-9124361b0854", "indicator--e89e48a6-9c66-468a-9137-8e0168e42643", "indicator--5e9ef3d3-29cb-4e02-8a5c-b77af22d4e15", "indicator--5e6729da-c518-4e72-9e4b-ce17b01adec2", "indicator--5a71fda4-85bb-4bb7-8b5e-1686e2ad92b9", "indicator--629fe9cf-6838-4218-bde8-cfad8d9bddc1", "indicator--084a21e2-84c3-489b-8ea1-5c06482c2ddd", "indicator--b05f8edd-15ba-4b17-8038-3bfd61d417f2", "indicator--fcf0979a-a734-4d0c-8d92-b0c6e6ca43a8", "indicator--5b954b43-179d-420f-a210-3a59524fb851", "indicator--947a1b57-c48c-4f51-9f9f-93915c08919c", "indicator--2b885087-bbe6-4669-b916-e70b589ffb33", "indicator--c9ef8de4-3b13-493e-9809-11d8c3a2a9cf", "indicator--61bc5ab0-d927-4109-bae1-16c142b12e9d", "indicator--1df3a263-b385-4ec3-b2dd-4af39836e505", "indicator--c6c7b12a-55bf-490a-97d3-e785b84911ec", "indicator--c3b58e46-e17d-49b0-89be-b68548ff987d", "indicator--b4ff4f81-1a10-46dd-bf00-515c9b5d31fc", "indicator--2846e343-93f4-456a-ade2-351b7cf06689", "indicator--836857f0-1c32-401c-8195-7a33cb5ae55a", "indicator--be694e53-2f53-4711-b6b5-e53fa82f34f7", "indicator--322fbafc-e7ed-49ec-924b-ba9c0052b2ad", "indicator--b40a3b55-9e03-4807-957f-fa750a84816b", "indicator--c257a784-dbf9-4e80-92b3-0db7808c5e3d", "indicator--58b466fd-61b3-4cda-a9d4-cd01ea5bd031", "indicator--1252f724-bd7c-4656-990b-560f9324d969", "indicator--91554c0f-3003-4040-8d51-1473f217547a", "indicator--4dbb6e8b-f5b9-4112-8948-06ba88be1495", "indicator--9d39a1ec-9e54-4a58-a720-d2909f99fa60", "indicator--fce04b3e-0110-4e3e-9b6b-08f8ca866d6a", "indicator--d8cab6b2-17ea-413f-a218-8ef1aa0a947e", "indicator--f6bb33a4-568f-41d3-b436-a2470fe3b2e8", "indicator--f5fc2873-aa0f-4d31-a89c-097b36762eb0", "indicator--29ac1897-da99-4200-8265-b33b0aec5c4f", "indicator--4ca979d1-4fce-4aca-a53d-0313d74cadc3", "indicator--59adad58-3d20-4390-8b97-4bb7951faf92", "indicator--5460ac20-7821-44cd-b960-1d85d9d4d064", "indicator--b75edcdb-6cd4-4987-b8e8-d4502c624429", "indicator--e2231cc7-f39b-451a-913c-7bcecd550359", "indicator--1ddea052-a530-4dae-aa06-490e180c35e2", "indicator--fca4c6d0-6d11-4206-af4a-f49f58ae860b", "indicator--581d5be2-d391-4294-8819-028055fc3d89", "indicator--bd3d058e-2bff-48d5-a5fd-24716b3447bf", "indicator--ac99c280-f339-4b76-80d5-3317f7c2ee46", "indicator--c19d8b12-31a5-4c7c-81c0-80d9fa5a93c4", "indicator--c26bf769-5423-4857-bccf-a37dd64ea024", "indicator--7a902eea-f0e4-400e-9855-473c31e00902", "indicator--625b9d8e-80e1-49e1-8bab-bf49e3372c68", "indicator--d699ac69-6346-46db-91ba-f0d48ec0078f", "indicator--df4e9c1c-7c60-4900-8bff-af56f7aefb93", "indicator--85cb1932-20c9-49f7-8d27-1a6f4011c069", "indicator--598915b1-fc1d-4e04-95dd-e99d9ab1284d", "indicator--d569af63-15c0-42c5-981d-f30751f4fb14", "indicator--15ac81a3-1a2a-441f-abff-5d9fa8dbfccb", "indicator--63190ff9-9003-4551-a4e6-aaf89cd66627", "indicator--0805841d-7edd-4399-a3db-a5d22b63642b", "indicator--96c8f7e9-d49b-4d63-a951-abc3fe1f78b2", "indicator--e4f51964-ea27-42a3-9793-d851758d721c", "indicator--43a0f54e-75bd-4302-a6be-0bcf5ac431c0", "indicator--a0de49f7-4bad-459a-8a8e-fcf2dfb55adb", "indicator--e4eb6de3-f065-4970-9a9d-c1534ef5734e", "indicator--ea1e7cd7-5de7-4df2-bcdd-2beebc484018", "indicator--aee8044d-79cc-4331-a5e7-169aea377b5e", "indicator--14f2ce80-5d14-4799-ab05-45205f05cb7b", "indicator--199dcf3c-e828-4f99-adbb-b7c6e69bc948", "indicator--1a2971ad-52de-48e2-b0af-177058246bea", "indicator--a5cbb506-aabb-40bc-8307-f0bd31f3118d", "indicator--d5df2e15-a85a-4c30-9fbd-db7682f7062e", "indicator--7c07acab-8e28-40fd-85c8-8fafea7a3e75", "indicator--366f7e55-a15e-46aa-8e2d-943fe4d1adca", "indicator--87ec5e87-5971-4f44-9013-a9b5169c92b1", "indicator--e08ba9ef-ec54-447c-9480-3fab852c80cf", "indicator--131e7220-a78f-427d-bd9f-6409adb92b91", "indicator--16fb6cc8-e482-443d-9cd7-385a61d1c0b5", "indicator--3e3f712a-4510-44a5-8c32-25f6a1c70020", "indicator--8c43ceec-b79b-4d08-a1de-2af07076b2c4", "indicator--3660686f-8bdf-4b81-a13c-3f8914e38a74", "indicator--a6e20c72-68dc-4f1f-ab29-c0cc354eee3c", "indicator--ea314936-bcd1-4cb3-88a6-6e08b196ec04", "indicator--293fa372-f087-478c-b2d0-0fa31fb8cdee", "indicator--dbbf3c07-f4cf-4933-a9c7-2ef561cd1ac6", "indicator--7170ada9-205c-42f4-b6e7-244aa0a52c27", "indicator--4a0d438b-103e-4564-a8df-28f0dfcfb9db", "indicator--cf52b35a-1e7c-41c6-a690-9237734e534e", "indicator--f5238e08-0f8c-44fd-893f-d2f65d7a8c32", "indicator--69479640-95e7-4815-969f-e90e1e9cfd90", "indicator--5f858db8-512a-45ce-b9e2-1c0f3b416088", "indicator--5786c88c-b258-4b4c-8c39-23ef68ede381", "indicator--89915d88-5e66-4b66-a2c4-6573911572fb", "indicator--4b8f92f7-59be-4eda-b16e-76c025211c04", "indicator--e7612550-e8fc-4157-b947-176b06765b73", "indicator--8f9eee96-fd41-4d5a-97b3-6249739ae69e", "indicator--5e43629e-2277-4746-8dfa-aa3f1027772d", "indicator--593e715c-492c-413d-a888-63f3736ddf53", "indicator--f8113f97-08f8-42d3-b586-86a6cc4a8de6", "indicator--b965b445-522b-4cc6-b09a-6f94d3fa46b3", "indicator--9ed9a7da-bcb3-4387-b31e-756b7c2c6b11", "indicator--3bbc6462-9f10-4aac-9a63-ea09042316b2", "indicator--8f5935e1-b37b-4c77-a12c-05cc565b7ee7", "indicator--7faaf7d5-9b5c-4b48-964d-e0f49e8f5d97", "indicator--673de82e-e272-45c0-b0ee-4fd1bdcbfc59", "indicator--cee60735-5e88-41f3-b340-e0fdf4022a4a", "indicator--41595fe4-bebb-4882-aadb-9164c4385898", "indicator--9331746f-041d-4025-93fd-c0633c132aad", "indicator--8a89ffb4-e03f-4167-ac82-eea2f2c6609c", "indicator--607eee20-f417-4d32-9f30-f339dc5e8194", "indicator--8cfaa3ef-8a6b-4a0b-878a-d7cb45cba594", "indicator--42b86971-ed46-48cc-ba3b-b981d0ae308c", "indicator--fc824761-a466-43df-b1c3-dc03c6d6b0d1", "indicator--12216b9b-84c9-4a01-ba06-8c97bcd279dd", "indicator--79245bfe-d383-4e35-965d-e2948be65fc3", "indicator--3272cff1-3f55-42a5-8e27-a3eafc5410ba", "indicator--e013f832-7d8b-44d7-87bb-8d07a1a98ee7", "indicator--cff29ad1-126d-4599-b136-d2ca74635cf3", "indicator--e5704ac2-ed0e-4b94-bd7b-5a2926831fff", "indicator--4108a9b2-87b4-4299-bd2a-f5e387023789", "indicator--fd6538d0-cc8a-4ae6-8d5e-2bc923d2955f", "indicator--9ee586e0-cc33-4186-95da-692f1fb8c186", "indicator--ef1aea4e-c7fc-41e5-8174-6f79decba3dd", "indicator--c70d5d97-56b5-4e08-964d-5b4983e0413a", "indicator--ceef7eb3-c7ef-441b-b14c-0b9806da77eb", "indicator--1d5512c7-e419-47d2-a584-a9b6cc2fc8ec", "indicator--bcbeb7b3-2cd8-400d-8622-e1fb546ea51c", "indicator--8bf5ae1d-c59d-42c8-84e2-212e09bb210f", "indicator--10321154-01fc-4fb6-a97f-b15e1c9b0e38", "indicator--e562d9a6-f1b8-4243-a34f-d29796d1286b", "indicator--0b6a69b7-3a9c-4084-bd5e-dcb5261f3fb3", "indicator--818df662-ffcb-4739-bc3c-efd85566b0d1", "indicator--6076e848-b5fd-456a-9c92-1aa260926d28", "indicator--88cb34f2-e077-4376-91d9-444220f97038", "indicator--265419a0-f617-4a73-8c6f-438b49c1b0e6", "indicator--a5ff79ce-bf81-4e68-9c71-a9e500827e1a", "indicator--fdc01f6a-a144-4ef8-bbe1-75cc827a2968", "indicator--ac7595f9-30a8-4c2d-9cf1-059819e48f33", "indicator--4b70b785-01b5-43ef-9f73-d35762ad9ec9", "indicator--553623cd-55e2-4ee7-816a-6f681725463c", "indicator--90f0a8aa-ce63-4b62-b894-3a51a9c2590b", "indicator--cf12a416-44df-4f20-8dee-01ba02d48974", "indicator--94eeea51-0916-4e63-9c73-495a900fb186", "indicator--9568d16c-64e5-447b-82ed-8a5d38c7400b", "indicator--1f158786-d9dc-4b0f-932e-c70280d7e2d1", "indicator--44bc2206-e3a4-43d5-9df2-8a1e0ca40177", "indicator--d9a3b7ce-100d-4452-b541-890d0f7f4dac", "indicator--29f4907d-9cae-4c1c-a05f-5d3fc1392034", "indicator--3dd4d75f-3b03-4d11-8695-639e4cb0718d", "indicator--beb2be32-0337-4ec5-beb3-1d89fa46f362", "indicator--9befbd82-390d-4918-9434-18089007d742", "indicator--100a56c6-1e9c-4cf6-ab49-e3196159f47a", "indicator--a879348e-5d20-4a38-a1e7-3823a9667fff", "indicator--b8571388-a813-46ab-8b4e-d3b81615b6db", "indicator--07b27f5e-2514-46b2-bd1b-57fb26c44a6f", "indicator--af4c119b-610c-40ab-9758-df1cb258703b", "indicator--b30cfde0-7591-41a5-927c-d14f9caf92a8", "indicator--8154e3e8-a1da-4d14-9e0d-6b2453b93af8", "indicator--e0f6b73c-6d7a-4525-98fd-a6b7acce15ab", "indicator--a536371f-2cfd-48a8-8ad5-75e656c1d38f", "indicator--96bba6b1-ecf9-4b21-b376-949b18684b03", "indicator--1a0852d6-71b7-458a-b40c-0f180ba66d2c", "indicator--02988116-a942-481d-beed-46edd0c85d4c", "indicator--a5ef793d-eb71-494f-8e7c-cc7f6cc22b4a", "indicator--34685c10-8f2a-421b-aae4-2002f723f833", "indicator--29326a19-3d24-42f1-ab17-50208543782d", "indicator--45e25e08-dd6f-4da4-bb56-2da01cf8947d", "indicator--f57227fc-68f0-4afa-b061-26fed141236a", "indicator--afe6fbe0-b495-4be2-a361-2dd2fd467649", "indicator--403af9f5-fb28-433f-b400-df7b77a944d9", "indicator--71257c29-0158-403a-9a06-fd165f6e92af", "indicator--f1ccd469-758e-451c-8136-6d06c888bbca", "indicator--e060b208-04e2-4dd1-9db6-127babfdc2ca", "indicator--38d50f13-56c4-4273-bd58-652672a18145", "indicator--5e8a3155-580f-43d8-b1b2-8de7f3b88a07", "indicator--90daa9c5-b818-4cce-b6f0-ccd98409e5f3", "indicator--aee145d0-e226-4c27-be22-d282f2bd1a81", "indicator--82c0bfa3-8d72-43f2-81a6-d047025dec80", "indicator--0f7927ea-c93e-4d2a-85ae-4216133db9a2", "indicator--4eb680a0-a8a3-4ee6-a01e-81b8bc2d86d5", "indicator--04857a4d-d526-4eab-8e61-cf788f916392", "indicator--7bd9df27-0936-4c9a-a359-f6086d2d6947", "indicator--cdcda54e-5426-460b-b3f7-325490d01c1c", "indicator--8a8046e6-d854-45ba-b9b3-3c0155d32e1f", "indicator--46ab0053-4189-4966-9ffd-a8d1b963eb1d", "indicator--a75994d2-25df-4b8a-90fa-c040190c2594", "indicator--758b8b2b-30ef-49d7-86ce-42a4f49dd3e3", "indicator--f3bdfbec-8366-4036-94ad-4c3c41824e67", "indicator--84886230-c97b-4972-8ea1-62a45b1212ff", "indicator--ae0a1e73-86d6-4f35-abff-561ed79163d2", "indicator--88625693-c1b5-4231-a41c-286099959aa7", "indicator--e364136e-efdd-4805-9888-f35f84954940", "indicator--b75ed59b-e3a0-4d34-a93f-3324e017efff", "indicator--f59c5f31-5cf9-4446-a21a-7f297bef81d8", "indicator--375308c5-c977-413a-a157-c7cd82e7b4e6", "indicator--e93bb9e0-b821-4a90-bd31-5c76ba105385", "indicator--eefbeca7-16bc-4576-8a59-997e93ae923d", "indicator--00123454-3b1b-47f2-bcca-029d2c7b5645", "indicator--699f921e-ce6f-489d-a80d-44191c0c4ed9", "indicator--8901b957-0255-4b7f-b3ee-e6512b68eb58", "indicator--a69866ff-03f1-4fcd-85c2-996de3f873ff", "indicator--c2597a88-3807-4cb4-ba99-80ffa3407d62", "indicator--78cb30fd-7a7f-4358-9f45-fa9cffc6c2e7", "indicator--7389aa2b-c084-48b9-8768-36700928da3c", "indicator--9dc91123-f79e-48ca-979b-bdf7003395ca", "indicator--eba8970b-07e0-4ce0-ae36-1ec83e7e0cad", "indicator--1fb750c3-31ff-47b1-9bac-3f3a09c94576", "indicator--941c00d3-9ef7-47e4-a89b-5d89e5552c2c", "indicator--b09320cb-8428-4747-b533-7d21bdd251b6", "indicator--7b73f092-ddc9-4271-b48f-8de5d467fbcf", "indicator--c89a11f1-7396-40ac-81d8-fd80c4402ddc", "indicator--194dfd22-69b1-4fdb-b462-2f093160e6b1", "indicator--834ad36c-2cc5-4fd6-b206-40ab1865e32e", "indicator--c6375b05-dbb9-4593-a99d-876496975e4f", "indicator--9dbaf387-097f-4989-baed-69ebb5a0cf34", "indicator--0c156c87-bfff-44a2-915c-0f8cb8983329", "indicator--664e71ae-58d8-45a4-8516-a4473314e1ac", "indicator--efd80a44-8d1a-4afe-9499-db366fb9be4c", "indicator--c4195840-87dd-4b1e-b483-1152f4d5ff82", "indicator--efd61d3c-704d-4aa0-b9ee-3d46787fcf55", "indicator--5a0c332f-68c8-429f-ba99-3924691e07f1", "indicator--16cb8677-624b-4f28-9bd5-1748340cf44e", "indicator--9ad9abc5-fa54-483e-a16c-050fba68a4e5", "indicator--f978d304-be9b-4602-8fb8-c354a9e9a561", "indicator--c6c1ac78-5aef-4e5c-9dd2-436cddeea68f", "indicator--ef3196b9-64b2-4766-bc12-6735eb9cef66", "indicator--5e0a98f6-88e4-4509-be09-0f48b6c5c384", "indicator--b88d75be-64c9-4818-8855-09f6b3c58493", "indicator--e1b6e3c2-f773-4406-8442-1dab014fa972", "indicator--1a5951dd-0970-442f-b50a-232ae6d370b6", "indicator--349a3493-bbf2-443a-aa80-2a41569888a7", "indicator--63a2acd1-d918-407e-b0e0-6fd47ed40b8d", "indicator--e391c1ef-db82-48d5-be45-225418122b78", "indicator--eb2f0979-1e05-48a6-b4aa-9858dbc96f29", "indicator--dd79fceb-81e7-4c6a-bfae-4f944f816b59", "indicator--33d7e491-5876-47ef-93fd-be0955e5d17e", "indicator--ed618554-2e6e-4c4f-bc36-97b040578e7e", "indicator--a4643c9d-8273-41da-a015-1343149447c5", "indicator--102beccd-56d4-4efd-a328-b4a8a4fcbcb9", "indicator--78b037cd-ad27-439d-996a-af09db65806c", "indicator--b8a62823-c062-4318-a4f0-3f3a2bfbded3", "indicator--85a49753-d233-4ffe-997f-49d93b7ca209", "indicator--1a234cd3-0161-47e0-af7d-fcbb2f49d4e0", "indicator--5ece70bf-1afd-4f06-955e-658427edbcf4", "indicator--52a7697e-85b3-4078-b616-c802897208bb", "indicator--ad9097a1-ea4b-44be-a345-b7ac6800ca7b", "indicator--4631020e-5a9a-458f-8050-a5e740711046", "indicator--ea64232b-cd83-428b-9e38-c8bf1b7cfdd8", "indicator--b32dc9e3-ac6e-46ee-9bcc-6f29d320d31c", "indicator--3d00a8ac-12c9-49e2-9f08-8a858c219014", "indicator--2314e2a2-b65c-44e9-bbd8-aabd71e83954", "indicator--e259d744-d769-4867-9a53-1eab94e1fffd", "indicator--67daca06-fe37-4e40-9293-76c28274ac53", "indicator--2558c395-4b4d-46c0-898c-d8a36375a0bb", "indicator--ab920a9b-17fe-4f32-925c-53bf98e8ee85", "indicator--5ba10fd9-b19a-4023-93ed-1212bff25b55", "indicator--0776dbc5-7839-4ed2-b685-6c7e8ff94eaa", "indicator--05af2bd1-5ecd-45c9-88a1-0bdc0309a32f", "indicator--4448b9d6-80dd-4944-8cd1-1c55bef0a222", "indicator--5ac02e36-776a-4875-8be7-f7681a8978e5", "indicator--8d0de90b-eb42-46ff-b96d-42675206fc16", "indicator--46972c3b-0b66-4f04-9592-1448453e06b0", "indicator--0a5eb85b-1644-4a8d-ac85-ec8b03e0feb0", "indicator--00392688-6d45-4cd3-b2eb-bd04d4d63f56", "indicator--6d06ae2d-1115-4e0d-a16d-c9d4d53bf703", "indicator--fc123c8a-3d67-465d-a0c3-21ca0e9ab339", "indicator--1eb97387-44ea-4b3f-9a45-b246b5109c41", "indicator--56d0c148-8abe-4fe5-a71b-274214c9d70e", "indicator--2846e13f-7005-4f43-8ab1-44d416d1d405", "indicator--fdec616a-1193-4581-8828-15745767379e", "indicator--1b36858b-31e9-412b-856f-96ec1ac3a9bb", "indicator--c684d5e8-bfb3-446e-862a-55c6cfaab64f", "indicator--28f12005-3346-468c-aa8b-0091f44891f8", "indicator--f4e0847c-1f69-41cc-9f1c-c06b4656e0d6", "indicator--b6ff6613-5fdf-4360-97f6-79bbfd02edc6", "indicator--c9fb8ad1-3323-4c46-8369-2dbc8b3cec7f", "indicator--4e8a62c3-af58-4cad-8fca-e375ab71211e", "indicator--463be211-8f83-401a-9b23-a7e8ba66fa74", "indicator--ee784d79-8045-426e-bbdf-fdf953868bd4", "indicator--dff3c328-81af-4d7e-ac60-65766cd0898e", "indicator--6ef2d9e9-23ad-48bf-ac17-068bdf18d1fd", "indicator--93d05ae4-5cc1-4cb7-ab72-a2e220444f02", "indicator--d09a9a0b-180a-4d14-b0ab-6891077cf1bd", "indicator--9b564bbf-d651-4385-9f4e-cb75a3531e7f", "indicator--45e30fb8-ed81-45b5-b697-2ab9bebe1ed2", "indicator--2c102c6d-ae8c-4b85-a0c6-b74f5f10f063", "indicator--c4b79361-bf8e-475f-a355-15e0e418361d", "indicator--77cae88e-4818-4dca-8e6e-0ac9c39d99e8", "indicator--bc22f2df-6208-4761-838b-7cb8414a5c6a", "indicator--64d02ee4-66bd-4ca8-989f-d4d582e19556", "indicator--3541d613-8bdd-4553-a958-bd896274a555", "indicator--1e448f27-5266-49f8-a6f1-e9c564f12979", "indicator--43dd813d-253c-4c24-899a-4a2e50935d1d", "indicator--01639248-6778-46a7-8551-9f251571b04f", "indicator--e158678a-b2e7-4be6-97eb-3cf3082e5802", "indicator--9483b61f-37a3-461a-beee-cd6d2580c2ba", "indicator--3ef5c200-d24b-4eb3-aa1f-2d16b154ba0c", "indicator--08d66171-3fe9-49f6-9050-7b02d2020788", "indicator--87ed4db1-b096-41dd-ab1b-19aaa2bb2e39", "indicator--faca9ab6-6f64-408c-9043-18498dcfa08b", "indicator--8c728dae-a885-457d-a683-4e5cb98aa838", "indicator--cbcd4678-1b43-4086-820e-fd101f69b9c9", "indicator--247478cc-5426-4106-a7ac-9896fff27288", "indicator--c7b5f20e-2842-4d7c-a90f-65fa15e9d356", "indicator--09f4653f-008f-49da-b058-b8135d1dda1f", "indicator--518d47f7-cd24-4030-a9ff-294fc2ac3692", "indicator--6e8c25a3-b952-478d-8d90-50a294747330", "indicator--171c9c97-02d6-4883-a01e-09f6a9a21b85", "indicator--0986a2e9-fc2f-44bc-9d53-d63707bcca88", "indicator--1e9aefbe-5a48-4f2d-a857-b53b664fbff8", "indicator--b3dfe421-4e0f-4ecb-85ea-efb059451678", "indicator--854551e6-f55a-434a-b40b-7bbc68a52dd7", "indicator--0ebbc850-242c-4dc0-9cab-c2583af99305", "indicator--aebf2b94-61c7-4773-ac78-790a92bf53bf", "indicator--55b72e05-3591-4707-9c9f-c8e335940db1", "indicator--20d8606a-679f-4bfa-8e91-bdd1d27e2817", "indicator--27fdc402-8c0d-4515-9561-1048fb006d66", "indicator--96551dd5-992f-4f6f-8612-fb7729d3b148", "indicator--00897efb-17fc-4dd7-98c1-9a0acc3f090b", "indicator--247436ca-9a0d-42db-b388-64b97bc25c84", "indicator--000f1579-852d-47df-9ff0-f2595658fb8f", "indicator--620cdd45-708a-4f32-99df-be0783b2851d", "indicator--cd2abad6-8904-4d28-9827-83c26f1e61e8", "indicator--29978461-4d2a-4e85-b665-996c64c14df8", "indicator--bbfc0ec7-6bf9-4450-94b1-0f0de44d0777", "indicator--e4dec4b1-098e-4365-910e-6951adb20556", "indicator--a1480cd0-e27c-45cc-a0e0-08cb25ce1449", "indicator--6b57f88b-8b1f-410d-a3fa-88f433f6838b", "indicator--37e9a581-4ea5-43ed-8fc6-8c7042abc4e2", "indicator--f6a95eeb-ecda-4f61-9e1c-33d5225a3265", "indicator--a81f8af6-5b15-46ed-9868-84b2d32b9467", "indicator--7017a2b7-3e92-429e-8a98-2f30775747a0", "indicator--de60b77b-0b5f-4ab6-81b0-161a7a415599", "indicator--7b699cb2-f469-44ac-a8ae-3e2a68577a33", "indicator--beb60ce1-2dfd-4601-a5ca-e7d793c8ce0d", "indicator--610485eb-0ef9-4b8d-a93e-9d4db9b5226c", "indicator--02295e72-eaa0-41d3-9065-ed1480b0e456", "indicator--a379e43f-22c1-4225-afa5-ce8e47fbcc3c", "indicator--df26d445-6d9b-4bbd-862d-de7fab979d25", "indicator--fa7c033a-6aa0-4d8c-ac1b-d3629bb64a14", "indicator--c7368c61-306c-4921-8888-92682f7925e6", "indicator--34b4f486-e168-4544-8f5f-93f09aefcfb3", "indicator--fa808ecd-fafa-4a73-aa97-9ac35b4a0d5d", "indicator--136491be-d714-4754-b297-b3cbf1100639", "indicator--99f6fca4-5613-4729-b2c7-b746c8c17908", "indicator--36fd5ce5-7418-42f3-8a54-6e0435ce3ff4", "indicator--32869f93-30e7-4d77-9783-73495be7ca08", "indicator--0d1e7c5b-3716-41b9-9b35-64832588a2b9", "indicator--9d11fd02-43bb-454a-95f5-cd7881d0fdbf", "indicator--343ef2e8-1a14-4030-86d2-e6f673d3dbc8", "indicator--8b778cbd-978a-4f6b-ab09-b561b20fbf8f", "indicator--efe68672-6c8a-4ecb-8e5f-b8cdd3d2c438", "indicator--0545d6ac-d866-4484-9acd-e8729030007d", "indicator--64ed0439-fb3f-4626-9340-5800d061dd6d", "indicator--1799b320-0998-4ab9-a993-0b1936364115", "indicator--93485f38-e28c-452c-99cd-dbcfd18b77df", "indicator--2fd3f534-6707-41cb-b800-e7f03a06a497", "indicator--61726493-4d15-467e-a868-95e358c73674", "indicator--6171799a-f8d5-47bb-a3ee-10578dc51706", "indicator--34268c34-2f9d-4b57-979d-9d5c9078d929", "indicator--863b3fab-70e9-40be-9822-a57f3a8c7b74", "indicator--7384c067-76c4-4c04-9844-36549e3fd99d", "indicator--9f146f9e-9d8c-4302-a1c0-1468c31ca402", "indicator--81cb73c9-38e6-41e9-abfb-6aab5d8d4a90", "indicator--5cd67df4-0fec-4b71-bc05-dc237da290f8", "indicator--6b8cb68a-2ac0-451a-95a4-b213cb1eaf6e", "indicator--f3120e5e-c753-44a3-9fba-221d2ff2d9f5", "indicator--b974474e-1ab0-4d92-92b7-644559e19d33", "indicator--da2a1d2b-34f1-4c44-a52c-7dc03b25d59e", "indicator--db352eaf-44b7-4eea-a98c-aa1cd79a701f", "indicator--e965db6e-206a-4d5c-bc16-f7a83c017d23", "indicator--ff7e003b-28e3-48cc-b23f-0470d77aa9c5", "indicator--8d2d05e3-32f9-4a56-9de4-9d352354ce18", "indicator--56405129-73f4-4114-8064-2c77b6f2b71f", "indicator--26618470-e197-409b-a68f-a4b6d4d0bbac", "indicator--2ab24ace-2034-403c-a450-8cb776fdc7e4", "indicator--90dd7b05-f5fe-42bd-9fd4-fcc32ff23595", "indicator--d26e3a40-04bb-4ddc-8936-0d920a93ab22", "indicator--7eddcb15-665b-44d0-94a4-9348823f4dde", "indicator--9384871a-bfad-4746-b79f-2fdbb6d4383a", "indicator--48926649-a131-486d-b774-1ddc4f5c3177", "indicator--4387f899-8bab-4294-9948-6ebcbdc904e2", "indicator--d9295d5c-859d-4861-923c-2c3b43c74f29", "indicator--153dd6e3-9563-4913-b545-fcc66cb87213", "indicator--a4884e03-a965-42b0-a1c7-c1e4b13b96b0", "indicator--89e368e3-0625-4bca-b77e-f7ec3e126e80", "indicator--33caf150-ed6f-436f-a1ac-0e38c5ad78d3", "indicator--64d68435-94b1-40f7-9885-5c539481aab0", "indicator--84491b1a-83ce-401b-95b8-cf12d8291afb", "indicator--9d4b98c9-f63b-4c7f-b378-4a773d391791", "indicator--ad3c9f3d-138b-46a8-9fd5-042123d04500", "indicator--efc8a8cc-d787-4728-8c78-6db55dfc6d48", "indicator--6d6ccbaf-d4de-4954-9fdd-0184874862a4", "indicator--a398bada-dc68-4a1d-8c14-f4f229809b34", "indicator--f2b1d218-39ef-41c5-b48f-6475c023daf2", "indicator--41278d85-348b-4f9b-aa88-f8330b068916", "indicator--4934087b-fc1f-4799-a3b3-bb8a4fcf71b3", "indicator--66752c16-4208-4606-bc19-40f9f753761c", "indicator--a82d7a01-53c1-4747-a107-82b10f07002d", "indicator--8085bdd0-365a-4ddc-a0f7-c82cd242d496", "indicator--7a493a23-0db6-4a92-bf82-4c716782edf8", "indicator--979c6800-e426-45e2-8dff-cbad798d00dd", "indicator--acd85935-6f6f-46af-978e-9ba4a0f2d55a", "indicator--99bdb915-3840-4dec-aa15-4fc0c1477866", "indicator--5453698c-8a3b-49bf-a108-8fb017bebe59", "indicator--39061e38-f0f5-4bc1-9787-f93cf5f65c33", "indicator--91d7f500-19ca-4057-8dd5-59619defa59e", "indicator--1125ac52-db00-4ebc-9d06-de044cf1d3df", "indicator--48bc039b-e817-45ea-9881-f09654b3ac91", "indicator--30fd4535-cd85-45ee-a03a-178b68fe14e9", "indicator--61f5963c-d185-40ca-9dba-23b8eb69e942", "indicator--65add945-9d54-4372-8e40-8d9ab0d46543", "indicator--26a52279-fae2-42b4-8b12-b6ebc60c29ef", "indicator--60c31ce8-d955-429d-8577-dfe4cbd7412a", "indicator--563da8ea-d892-44da-b6cd-dad2ba56bb35", "indicator--98b5fb2b-817e-426d-b171-8604ef33407a", "indicator--c2ae0c09-e5b5-47f2-97ee-4c9f67650710", "indicator--81ac3f67-1b47-4ef2-b86a-559c4e334940", "indicator--e6ca267a-0e3a-4755-81f5-955f1e3fb884", "indicator--6c7598c9-bb7f-451c-a000-78ba3550a505", "indicator--9d1e80e5-7a87-46e7-8516-9fad171371f5", "indicator--be76b750-c40e-4ccc-9df2-0acb14233965", "indicator--caf1b5ab-9147-4e72-a534-cb61b17f549b", "indicator--783f1a28-a028-48de-8e00-27c55e1eff7f", "indicator--f76c722e-e51d-4d10-bc09-911033fcab2d", "indicator--8d926516-d6fa-4544-8729-92db2f43e55a", "indicator--10aada7a-9e75-457e-864b-d2eef88955da", "indicator--f63a733a-14a5-4546-aed8-89147746d86e", "indicator--67b42611-e6eb-4b5d-a9b9-7feb7cdcccff", "indicator--7ddd0f25-39dc-4e99-a710-0dc80713dcaa", "indicator--de34f907-661e-44d1-a37d-75d3a80c8eb3", "indicator--d6942ec4-611d-47e0-b973-bdd134b4c3ff", "indicator--f8b8ee48-4a5a-47d2-b987-d7a5d5fc2c5b", "indicator--2d95027e-34e8-4fb1-b3b1-16f1960b00be", "indicator--901ae743-8113-4dc5-80b4-fb7a4716d81f", "indicator--fd77bf25-6195-4647-b198-33850d451cb2", "indicator--e62001b7-3345-4368-a212-67882176e99c", "indicator--8e1f79bd-4c6a-4344-bc56-28eebeab7378", "indicator--486dc322-b107-49e0-aab2-2b8eb487776e", "indicator--da5d2ce5-a1bc-45d4-8b44-d4c3d15565a7", "indicator--b5a9e65e-b012-4e5a-a09b-567a08ea0b80", "indicator--7df0722a-46da-45f9-aea4-65e17261c742", "indicator--fe71592d-a386-4142-89c9-f9b2a8851e12", "indicator--2405dba6-ecd2-431d-933d-3e58e39c2ea2", "indicator--320a2d4f-fd73-43a5-80f0-c196af59c019", "indicator--be891f98-442a-4e4b-9c1f-284d0820bc12", "indicator--969b9405-39ed-4d8b-a869-ed59d0f5ba23", "indicator--2b5e4256-61a4-4bb2-819a-842d1670e4be", "indicator--23d2ad22-a425-4499-8a3c-839e88c04249", "indicator--23764e34-7b56-4d3c-a457-ff0c7842d0c6", "indicator--214bee49-39b8-4bf8-8ac0-1125a69294cf", "indicator--b8472814-f60b-481b-8d98-992c62df5115", "indicator--e20fcc95-44a9-42b8-8c4a-9f2dd4f335b4", "indicator--d3c1c8ac-9326-45a4-870b-bb275b6c3426", "indicator--bedf941e-b1c4-4cec-a7b6-f7d4807185a3", "indicator--7a5fb71d-82c7-4b52-a00a-bb42d31f5977", "indicator--fde46749-4afb-4efb-9372-01ebe1940796", "indicator--2b479b6e-a405-4e22-9707-4f16e571de02", "indicator--86ca217c-fb3b-48d0-8859-8b96d76f61da", "indicator--b7a9f3aa-a5c2-4216-9704-b60310a72ed7", "indicator--da9d159a-8660-4793-820d-e039054a313d", "indicator--fb4431cd-e805-4ca7-abac-28c0acb41b9b", "indicator--0e4f7270-8f2e-4aa5-b4cd-af594702bbf1", "indicator--e43373b3-c24b-4915-bffb-20597c97202b", "indicator--a9239eab-d2b4-44d1-b8a8-fbb62a8da2e1", "indicator--d871ca06-8e32-40f6-913a-3af4814a6393", "indicator--a75f13ac-62ca-4cc7-8240-9eab3f547b6f", "indicator--5f5b0d66-95c8-40bd-8717-2c628849f800", "indicator--434e710e-938a-4e6d-b7a8-943d83d50718", "indicator--dfb30dc6-2736-4cc6-b0bb-df3ae3c9ff5e", "indicator--3b43ddfc-2e0d-4da6-978a-8ae106f79113", "indicator--4088da08-2ecb-43aa-a3ba-60f2c3664f59", "indicator--5ff6ba25-0a25-4791-b0c4-7001d18e938b", "indicator--e389cbb7-2951-403a-b7fc-7db75b86bea4", "indicator--65f618b7-e710-4be6-a487-067a257da543", "indicator--b22eaf5b-5e3d-4bc4-b871-ef1e6f2d8763", "indicator--2b4ea3f6-ec51-46be-9d7b-968265c9e31a", "indicator--39d129cf-51ba-4ad4-8227-3e4e4eca4f4a", "indicator--d0696088-bf11-43e8-b6cf-b69c6e60fb5a", "indicator--719f3727-ea34-4cd4-bd61-a22540882a06", "indicator--ea45979e-103f-42c9-a04a-4579b2f6c62d", "indicator--fbe5a72b-b2ed-4a20-8060-f1da6b9bf572", "indicator--39fdc319-a472-45b6-859c-af24f3490b0f", "indicator--211fa6d2-8bb0-4237-b9bf-6844bd93ed5c", "indicator--430ca9eb-bcd9-4bda-aad4-624da5f6d6a7", "indicator--27857ec4-f3b8-49d5-8926-0b4aa48b1ee4", "indicator--53bbe818-1595-46a5-bff7-5589af1cc63b", "indicator--9b5951f2-bb15-49eb-b75b-f25ca1c2c00d", "indicator--bcae7e2e-6e1d-4ba0-8958-76517a03bce9", "indicator--77ad31d1-0dd8-475d-88a5-a2bb03d81eca", "indicator--6f0fd4a8-380b-4f7c-9b4e-6915d3b62135", "indicator--9a81591d-f3bd-4953-a90e-1babeddd8f75", "indicator--84dffcde-c16a-469c-b8b2-683da2fa4962", "indicator--275d5fac-db2a-43a6-99e1-0e0805a12c51", "indicator--e968dbb5-5367-4133-be2e-38ee02fea70b", "indicator--a6d5073d-9457-402e-a6af-6ad1fae7586b", "indicator--22998ba7-f4e8-409d-947b-e86ec57aaca6", "indicator--fa4878cc-4b55-4e7a-bef0-69a541e55142", "indicator--c4274d7b-9a3f-44ef-9163-04a2abb503d6", "indicator--53a28c29-6f44-4d2c-a1ee-f1a4d45a7891", "indicator--cc1a2177-02ae-4c74-b486-f7b83c842a57", "indicator--23fbd2d4-3944-4e39-a52b-7dc0be8fa2c2", "indicator--874bf4b0-05ed-470a-81af-2f0b28ed38d2", "indicator--5028b0e5-5af2-4ff2-bb87-a58349b8cbb2", "indicator--8513c2f5-47eb-4a81-92a6-0ad5a5a30898", "indicator--8ca90669-9109-4de1-8b8b-0a90d438102c", "indicator--bf7e13ae-3608-4ceb-9c3c-c5c54c0bbedd", "indicator--946f16b0-9ba5-4430-819a-0dda8a1eb271", "indicator--f69b6451-6796-45b2-b517-cb40b0582065", "indicator--5055f519-3a1d-42fc-bdc9-1e6dbda9a4cb", "indicator--bacf999a-e039-4f04-9f26-80fa475c17e4", "indicator--1e1800e2-d12a-42a4-a203-d0e54c6f8373", "indicator--c0a084b8-3097-45d5-b7b8-13b230261263", "indicator--f2634918-a2bf-4e70-8ce7-5162fe0b646d", "indicator--5beb1088-bcd0-49aa-968d-997760f08b9b", "indicator--a6c5a5ab-e1b5-4dfd-94a6-252ba0157336", "indicator--09f8db26-1fc6-4fcb-9ec8-4fb4c465ca43", "indicator--2d1bd5c6-e613-43ff-8455-ac497e4b6579", "indicator--b6c8abd5-2bf2-40cc-a6ed-2e0788df4551", "indicator--20ed9ec6-d765-448c-b6e1-339f8657b6dd", "indicator--a0ba9f47-771a-47c9-96ef-846fde55741f", "indicator--d7777c64-99c2-48b3-af21-3d0c3d57c41e", "indicator--2592a093-6e34-4daa-8f68-83bde43c02e7", "indicator--2f83c580-c23e-474f-be2c-56cf4f59a1d0", "indicator--5afb3be2-ed5a-4560-8de0-573b11cee149", "indicator--d8ad44dc-940b-4be5-8bb1-43e8f147d6a2", "indicator--863153bd-36ea-4b15-9882-21aeb9440df9", "indicator--dbccaf0a-d97f-4cf9-9046-5a26cfe945eb", "indicator--85999562-0050-4ae8-ae9f-ea652d780574", "indicator--63b2b112-8d76-404c-8ebf-e75d83770c62", "indicator--e47b3048-3bb2-4cf2-9137-e4a9b42b6c85", "indicator--4a163790-f34e-443c-b5f8-d705d2e87bab", "indicator--c58130e8-4dc2-4e12-bfea-0a86795a4b09", "indicator--02e80861-cbd8-4d91-9083-bb6f00165565", "indicator--27317ca5-fb9d-4ac7-8f25-526472f48622", "indicator--702eb558-542f-4784-949f-464dc409721d", "indicator--d1e74221-2959-49f7-867a-18c7ff894c7d", "indicator--f386073b-65a1-4b07-9805-3fc9e50f1ce9", "indicator--e7bde680-2a05-44b7-96e3-7a100eca159d", "indicator--36db638c-438f-4183-87bc-967346413784", "indicator--7ba81413-d53f-4613-b37a-b58bb0e02b60", "indicator--51dac38c-09af-4c70-b67b-81bda1ec68cf", "indicator--33e9de8f-e489-4252-b126-7910d4304310", "indicator--3b9dea29-808a-49de-8e38-ce9b154e926d", "indicator--69ff5a60-d291-4184-a780-19e8efff40b6", "indicator--c692d34d-b35d-4ef4-a0e4-173f153eca4c", "indicator--5e6b3d7e-3196-4890-ab89-88cc95782676", "indicator--0fbbb477-a6ad-4716-8326-7adc22e1985e", "indicator--f70767c4-b6d3-4199-b010-8643baf4086d", "indicator--d9089706-5b44-4252-8d5a-d7cccd043963", "indicator--073a2edb-171e-46f2-a585-3fab5f5ac6fc", "indicator--30dfec1c-e89d-42b6-8ec4-85ab5661b3da", "indicator--1c4f5461-bde0-47a8-8c97-5837cd175f50", "indicator--36ad797d-116f-47b7-b889-7d3e66e48d16", "indicator--b4ea29b0-dae4-4c73-816c-052ff4c2f963", "indicator--8075fc23-3d56-4e55-84a7-5c4ed0974052", "indicator--090ce52d-02cf-41bf-85e8-83ce087c4b6b", "indicator--2bcaa115-61f8-4827-9925-e23be3f112c8", "indicator--318f2fcb-1e4f-409e-8644-9b43f4b3a7e8", "indicator--c331f7a3-7125-489e-a0ae-a17fc628db05", "indicator--1ad3b648-3d20-46e1-9035-297c3b7fcb05", "indicator--12c1582d-61f9-4db2-a8c4-e7df59aa77c9", "indicator--df22e13c-96cb-4af0-bd8f-1bafa3c53d73", "indicator--0de1295d-8199-4f61-92c3-f41dd4a9c964", "indicator--7213d71b-b744-4879-9e33-90caaa17926c", "indicator--662e8d15-6e0c-4f08-9c93-208a527a5647", "indicator--9717a8ba-21e9-4345-8c9b-f883a528384f", "indicator--e68d3b02-01ac-48d9-a09e-ffc97fd8c582", "indicator--fa54fdda-969c-45b9-8ae8-3b6fc36fded7", "indicator--fb4f0fb1-2fde-4a6a-9686-59a556388a29", "indicator--90487f0c-29c8-4b8d-ab2c-56a64fe6eda3", "indicator--8cb3f324-1b28-4189-bc37-eb17306ca4cd", "indicator--94df2c6e-b95b-4c3e-ba51-9bfc982ea1f5", "indicator--e1965aaf-3e11-4b75-a5e1-713e80dae125", "indicator--402b835a-74e1-4d6a-8ca9-1454e19d0285", "indicator--a067191b-91b8-4883-91bf-a7d41bac7dd4", "indicator--8c24b3dc-419a-4c6e-9b51-4f0e7e8ea65c", "indicator--36c7c9d3-6b3e-4323-94be-e314213c1cdf", "indicator--0e1fba43-2ef3-4a89-9f1a-e3bd550b87ec", "indicator--5139e78a-edec-4132-b5d2-2eba74bc019a", "indicator--36408565-450c-4932-9ca8-dda765624b61", "indicator--bdf83737-0a31-4f4a-a367-89b1f04d849e", "indicator--01c69094-00c4-4b37-8874-6be97f2e93b6", "indicator--b21a8e5e-0087-4255-9997-ad5824d930c6", "indicator--b705cda8-dae0-4e86-b02a-1082ac29bfd1", "indicator--8e9981b2-ae69-4800-88b3-b9521cca050a", "indicator--0f49ed40-ddec-48de-8e94-e987c35062ca", "indicator--efefd721-8d05-454a-989e-6ee387d95824", "indicator--0a558194-9486-4adf-8cfb-448ea98827ce", "indicator--9fe0222c-f3d0-4d76-921e-3619cfca7ca8", "indicator--4b95c636-8ecf-468f-bcca-c02a675ba899", "indicator--362ad921-bd81-465b-bb33-5bea1d5d8ddd", "indicator--459c1a18-e1e7-4ed0-8da5-1554302493c0", "indicator--2a5efd61-7155-479a-bc2c-76b59cd1950a", "indicator--25c43b13-d24f-4b65-abc8-a31d664269de", "indicator--65e03eda-8f0c-4a20-99bd-489878943281", "indicator--a2e04dbc-402b-4c92-9eac-3ddeab6fcc96", "indicator--cd4d8bba-f4a9-4117-8b55-e88e2af4d868", "indicator--2d415738-b411-4112-8edc-4283a845219c", "indicator--063a0e2a-3d6f-4809-b9a9-7e1f91958b0b", "indicator--b5f37779-5a6b-48fd-bea4-7c37c46b8a37", "indicator--247a1b87-dce5-4252-ac08-817ff7c01ce0", "indicator--a140b520-5fb1-418d-9f3d-1501bffd5bb7", "indicator--9fd93337-43bf-4bad-93f5-24cf370b0616", "indicator--9f5eeec4-d1b5-4f2a-b396-844de1208e4d", "indicator--19d67f4f-40e5-436e-9a33-6ad8e72aa020", "indicator--6b02bce6-f953-44db-9e6f-c9f85049a06b", "indicator--87f572f8-a04d-43f4-b1d3-4ed24c8956a6", "indicator--f81ca757-9682-4a1d-8792-fabd8f418ca5", "indicator--22c7fb41-85a0-4ac4-8fac-30504e2c1663", "indicator--812ef713-9366-425b-9042-18f28676ceb0", "indicator--e727512a-ab2e-4db3-8d12-8482a2626222", "indicator--78f4f1ba-0652-4de6-8295-8963a22f9759", "indicator--7e83ce6e-9a00-4d4b-80ba-728e13e4e6c9", "indicator--a24a99da-42a1-4c1a-ad30-9a0ef677e61f", "indicator--0f17b8be-5cf2-4504-bb83-fc118061a9e0", "indicator--e6495387-9929-4f29-9d8c-f923ad811303", "indicator--c1f00e97-dcb1-4445-b3b2-42c7a5ec8887", "indicator--25108ee4-4f2c-44c7-ae88-c0aa627d69b0", "indicator--74a555ce-9160-4e57-94df-20b7b3a1387a", "indicator--1d3235b0-7edd-4fbf-bb49-098eecd9bf08", "indicator--2231444a-c2f3-48d4-a89f-60fbac7ab00a", "indicator--c10f42e2-3fb6-4869-bea3-76d60cff0b5c", "indicator--6de55a45-9b08-429d-adcb-7e3a3bf14292", "indicator--92800808-e0f3-44c3-97ce-dc72030d3604", "indicator--9dfb6c6c-a979-4667-8a6e-15efbd09c4d1", "indicator--b7c0e6b8-7e45-4dfe-968b-a5e9442c3f57", "indicator--d9bdc9e1-fd02-4d40-92ea-bd284b1662a4", "indicator--84288bf2-500c-4198-9de7-2493b790a1a3", "indicator--75c60867-4d90-402a-8164-78c7cb42c197", "indicator--4761ca17-df44-4258-a00e-70967e6fd04e", "indicator--2459b1ee-5628-4d44-b446-ce1f8827cf68", "indicator--4c0a4d86-2bd8-4860-bf08-cf525c648478", "indicator--4f562fcb-1a24-4ee0-b3a1-36ef3d8eed8e", "indicator--722f2a7e-742d-4c8f-bbea-498c69f9e6ce", "indicator--2470d9c2-521c-4e63-9877-8e3b67220fa4", "indicator--3438c511-b773-4927-9464-66060f60e2f2", "indicator--233d356a-3d58-41d2-8403-e949c786dd69", "indicator--75c7fb0f-44e3-4932-b158-43a7e5bddebd", "indicator--d9db248d-57cf-48b3-a700-395afce1881d", "indicator--3a139f9d-bff4-4ab7-843b-78731bfae381", "indicator--2c75954f-e0d9-4bb5-add9-f21667461f48", "indicator--b7f9604b-7f52-4f56-9aab-9be6fd22e8d3", "indicator--673f58e8-5e80-441a-8f5f-8120e5129224", "indicator--d0d2aa5e-0e4a-44e8-a1b4-c9daeada404f", "indicator--5853cb22-fb0d-4f8f-9626-9bdb76aef030", "indicator--6f51ad70-0af0-4a38-9772-912f7fa92d2f", "indicator--bc46e138-ca60-40f8-8218-e516280e03e7", "indicator--79acb6c3-24e2-4e40-8fcf-99abe2bdfc05", "indicator--511ade9d-054e-43ac-9e05-be39a1e2f760", "indicator--04495f30-bdde-40c2-90e1-42949f7cd981", "indicator--08004caf-ebbe-4310-8980-30a770f528fd", "indicator--c9b622ff-3ac7-4664-99f3-694cc4147e17", "indicator--7e1f146d-ed58-410f-8529-7148994135f5", "indicator--e75b6a1b-779d-4ecf-8777-eccc49ce1b26", "indicator--a801926b-26e6-4aed-944e-1c98fbf9dcb3", "indicator--24b23d6b-0858-4d05-a7ba-51b07e8e2675", "indicator--f9ceaf46-e632-4c4d-bd88-62ce73d791d3", "indicator--97f9e82e-0b23-4e9b-8330-ee64c588309e", "indicator--8e02cf42-4828-4120-a344-be6829f54847", "indicator--26615823-d7f7-4225-a81f-e80dded9d836", "indicator--52128586-a2ca-46e1-882d-3c9d121d0ce3", "indicator--aae904ae-bad8-4d88-bd24-477c9d8486c7", "indicator--eedb7457-ab7d-4042-8259-c5c65974c9fe", "indicator--7bab0a6b-f87f-4ef5-ba70-2d866da3191f", "indicator--074ab64b-40e8-47cb-992c-5d0a55341e8b", "indicator--9d3c4e9a-2884-4b8a-b14c-775fe157166b", "indicator--097d6c69-2e97-428b-8622-6d5d68ec2070", "indicator--4c1772b7-e60f-4fbd-b115-d9601299cd24", "indicator--1d12efb3-6087-44ca-8bd5-8c1c5b85ebac", "indicator--27ace7ad-fa14-4882-8572-8ef891359fba", "indicator--6430ec2c-4e85-414b-a64a-18fa6c540ebb", "indicator--eae7d747-b73c-48eb-8273-a3972d2c5a3f", "indicator--ef5619b7-cbce-4bff-a03a-e36522a17291", "indicator--5fa13bf2-212f-4c9d-94b9-19bdba9627be", "indicator--192b19b0-16e3-48e1-be00-62a68133d011", "indicator--7a5bd9ed-5c32-4367-9373-4d2a85ec7079", "indicator--af9188a1-8b5f-4686-b710-6aef3cf156ba", "indicator--aa731a5c-5229-4fe4-bf50-9eb66d22e533", "indicator--69d2cf01-9a81-470c-a878-2ff877c524ff", "indicator--11f745c5-422a-4e0b-b19f-d62e760807e5", "indicator--074d130e-d98e-4ce2-9ad4-09b0eddde800", "indicator--56a7ed79-5fca-41cd-9865-8f616f56c572", "indicator--9cff72e2-f47d-4df6-9d44-324426165cbb", "indicator--58f56a91-9431-4824-b8a5-7ef6200e6b9a", "indicator--ca11b07a-8878-4e47-af7d-466900dbd34d", "indicator--897559b3-2819-45c3-8bd0-ae34fbf6a016", "indicator--443ecb56-1787-4878-bddf-72505202c6bd", "indicator--cc71e386-e471-4898-88ce-1ded732e6ff8", "indicator--d5b13295-3be1-49da-a1ff-f50001f66feb", "indicator--6de07ba4-1fb1-44d8-9304-130d4d44c460", "indicator--0a894050-a82f-4c76-a6f3-532bde9dcdb8", "indicator--d9476f8a-39d2-4fc6-8ec2-1a2a0c884130", "indicator--cff45094-896b-471e-b24c-d77321ce3ccb", "indicator--91ad3f29-92f3-4f9a-91e6-a0ae40894a69", "indicator--3a15cc94-de5c-464a-8020-cc85f3d435a3", "indicator--ca418ce7-b677-4b00-a69c-576bed01493c", "indicator--2c34b7d3-593d-4973-b9c4-06f50ba7ed0c", "indicator--45bb8960-75fa-4aa4-a778-7e78181daf86", "indicator--6f1f24a5-9e8a-416a-9f3d-6af4db4c447c", "indicator--e57dfd69-b65d-4576-ac34-db35f5c8ea61", "indicator--f6fb0ff8-76c2-4c82-8053-b58005f34dc1", "indicator--059ffc7f-e091-4043-888c-9aa4080d96fd", "indicator--7b0c96ed-de68-49c6-bae7-84c1d5310fb2", "indicator--94b20c17-cbeb-4140-a802-299cfdb46a1f", "indicator--fc51a3f1-a450-48bb-a218-4b260e3f0f9b", "indicator--92f4e21d-cf5c-44cb-b783-c26bb6813045", "indicator--ab54cbb9-7641-4c97-869f-1e42b2ba78fe", "indicator--b10f06db-6e85-49ae-a736-20f000c98329", "indicator--52db0919-2181-4c75-a4f3-e6fa66bfb94a", "indicator--ebff51d6-21b8-4ee1-a766-0c485c98fcab", "indicator--cff840af-81b4-4d5c-a93c-2997baa8e26d", "indicator--28d106d0-dd8a-4439-81e3-cf2bf920bd29", "indicator--a6baefe1-48dd-4486-bb02-76f5db4b1b8b", "indicator--fd1759e5-1e82-4ee5-aee4-ac4dc3c73690", "indicator--ea3b922a-0f6e-4e34-877a-b6fb814a4043", "indicator--9d38a284-14af-4474-9ab6-6d0bde982d07", "indicator--d63e6e20-8bfc-4a2f-b30d-99eb21990669", "indicator--a0a34e3c-dc33-4208-b01a-b2a9248f7523", "indicator--f3ad3d8e-f1bd-4548-848a-fc1cbd8e8c82", "indicator--bf283f61-3e25-4a18-9961-9b594be8f4ad", "indicator--23e55c91-7c2e-475c-9a4c-799bf0c88638", "indicator--75a4ffad-af13-4e6d-9852-b74ab1b08264", "indicator--87a063af-f6a2-4cdc-97a1-c05279c2e576", "indicator--2a4556b6-1cf1-4cc2-80df-774cb1329c16", "indicator--a8519088-8efe-492b-9cc7-485c199e840f", "indicator--a1ab3fb5-8fc4-4c53-85f5-ee09a1a75a51", "indicator--69730f9c-af70-4f32-901f-3e9f8bdceaad", "indicator--3047cd5b-39de-40f9-bade-2e7c75a1f0b2", "indicator--3c6e575d-e36f-483a-9de3-45c3d2992c7f", "indicator--dc956092-df68-4108-9254-9130f1181ebc", "indicator--d7985b11-50a7-4470-b6b9-6189d77cd8a7", "indicator--0abe7711-5582-4210-8b02-4422dfc67bd4", "indicator--c3606be6-9f51-42b1-b2f8-455f6aa4d25e", "indicator--fa870238-4fc3-40c0-86d1-ac0c3f427e38", "indicator--dc419c74-40c1-47cc-925c-04bc4c9fcca8", "indicator--bb2298c3-3986-4316-a0af-66c8c310b1d0", "indicator--c3eeae70-9dd4-4303-a3f2-d5cf928b8856", "indicator--6ff0ec24-c2ac-452c-b02b-084fe22cf195", "indicator--224904d3-590b-43d0-909a-4dd0cfda5988", "indicator--74ec45a4-eccb-4208-968e-08075a9e3922", "indicator--e3a59fb2-1239-4e76-a7cb-1dc8c958b649", "indicator--e8285ffe-d566-4d06-86a7-ca6a6361befa", "indicator--2c8526f4-b1b2-479d-ba96-b2953c06e874", "indicator--03650b49-7243-4da9-9766-0dbd381b00c2", "indicator--51eca55f-faa8-4d60-ac78-911a5e5153cb", "indicator--4e846ebe-1882-43e6-8cc7-af675ea7771f", "indicator--4a4ab2bd-cf3c-4184-84db-d61870ebdd1d", "indicator--adc67551-90d0-4b14-83d6-dc81e3ed23b7", "indicator--41bcd8f3-0988-4fac-9991-093a15acbc14", "indicator--d097f9d5-e25b-4294-a2fa-67ea07b84ee3", "indicator--91256338-7ddb-4582-93b6-12f1e7f2c46f", "indicator--f40e9fce-68a6-4077-b510-a5ab71a9a658", "indicator--bd37c497-32e6-4c2e-94d0-a21df490d614", "indicator--d3ac80d7-8399-4397-be47-182032ee96bb", "indicator--3c02df9e-f51d-417b-824c-85a4d377b9dc", "indicator--cf42ee93-280d-492e-8b98-899a2477a4c7", "indicator--ab86f43f-b1c1-4070-8344-552b86c1adea", "indicator--0d298632-f821-4e71-ab1f-4ce3099b3ae9", "indicator--38ae64cc-386d-40c9-b170-b03a86d826c2", "indicator--2d33c184-78db-4171-ae1a-bd1326450fb5", "indicator--8ab6e88a-6e0b-44e6-b344-433a158b5989", "indicator--98951060-a8d1-4e61-ba1d-29acd760aa1e", "indicator--2c158a31-ef9b-4c33-bef1-5a648b593088", "indicator--1a80fbfa-aeb8-4079-86b6-ed59cf9e4d9a", "indicator--b85d9f50-d420-4f3a-a641-c6198a026a4f", "indicator--42068803-adfa-47af-9e31-bb247a229d8f", "indicator--933c0a93-1033-4f1f-8d78-91586530e2bf", "indicator--e5edeb3d-c0b3-46e6-b48b-46359470ef07", "indicator--0f92c6c6-7669-48da-8a1e-34b7c646feb4", "indicator--e230c6bf-4c99-4958-b97c-906019f0405c", "indicator--0c82c1cd-7c3a-41a6-bb5a-2305fd9503e0", "indicator--297a40bc-562c-4290-b6e3-6bc5f0de26f6", "indicator--a108661b-d6e7-47a7-8e87-2cb3697c40e9", "indicator--1bc69176-5555-4997-a10e-2dfdadfe46a3", "indicator--532e1ff5-5e9e-40c1-9248-3aa002f1fbba", "indicator--a53b4ecd-9ea9-4b1b-a9cb-b3d7b73044e6", "indicator--7f420cc9-0361-4a98-9f84-450f5d403702", "indicator--87265890-f5cf-4df6-9cfe-e32e16c06078", "indicator--989cb8a6-9b93-4416-8113-c67b24eb0dc3", "indicator--c1ff3cc0-0833-4b04-b139-9c0137f29639", "indicator--17fe53b6-66a9-408d-bc58-d6322d8b1b43", "indicator--74260206-2cf9-4036-89aa-406948e26bad", "indicator--6ffd7e2f-3e54-44f7-b550-20ea1fb20675", "indicator--ae1a5dd2-d143-43a0-98c4-da20c5d6268b", "indicator--582e5f31-d2b0-4870-a33b-49505d526490", "indicator--9f0af1e1-6d3f-41e9-8ea3-187f5dc697af", "indicator--e951ff53-490a-4cf0-98a9-ba1a82385f74", "indicator--c6c419a3-61ac-4da9-986b-516c94fb9bf5", "indicator--ce54623f-f7aa-40f1-9fba-0f10f0ab2b46", "indicator--75470436-7d0e-4979-a284-7c5d2fb7c796", "indicator--da4e1d68-6200-4918-ab7b-18964e6b374a", "indicator--8c3114db-afe1-4645-ab20-0a69a39465b5", "indicator--8acb80a3-3aa1-48fa-8581-7a720e79bb9d", "indicator--2bf6c991-c39d-4336-ae0e-04fdaf31e2df", "indicator--6b12971c-f5cd-46b9-8794-2700529a122a", "indicator--1f790f75-635b-4287-95e8-d358bceaef4e", "indicator--bb116791-ceb6-4b02-908c-cd613cf4b64b", "indicator--c61ecca0-f429-465e-80d3-1d7dbd937dea", "indicator--1f1354fd-45af-4369-882a-f7046038ebaf", "indicator--e1a638b6-6226-43c5-8809-b6a16398752f", "indicator--3bb258b4-5f72-4e1c-82b7-2b15699e7b47", "indicator--258da500-d40d-470e-bcba-868aeb0d1016", "indicator--6859c783-dac5-4c81-9854-9a3c624d8ad7", "indicator--d0de94cf-5ad5-4d4b-ab59-b8d041e7bf05", "indicator--7f508913-6076-45e4-97b1-bb604bcdcd0c", "indicator--5facfd4f-fffb-4e95-9545-3cbbc31431bd", "indicator--5098032f-c3bc-4a3e-9b05-302b30ce90a5", "indicator--bf2c332f-43e8-4c05-83d4-e45711dbeb61", "indicator--445cb299-3c40-4759-a920-4110f7157856", "indicator--1850ebd2-24ad-4c18-98cc-a35bdceb7b85", "indicator--7104bb21-00d8-41f0-94cf-9a97687e429b", "indicator--2481e62f-2132-4963-9a2e-e67b2f4dc6c2", "indicator--7a460e41-0b14-4ef2-815f-f24718b7d360", "indicator--fabbf6a6-124b-49ea-9f6e-50a6b30b599f", "indicator--92196f05-cdd0-4275-a031-8ccbb2281263", "indicator--8abe751c-f451-4539-b6b1-9e206c750c80", "indicator--81f54cb9-ae18-4e46-8337-2aaada4148f0", "indicator--1e31db5b-7eca-4ae9-8843-e3daac1e4ca3", "indicator--156aaf8c-e469-4c04-b270-1966d6878f09", "indicator--1ebe9954-a85d-4650-b2a3-bf943739a8f6", "indicator--eee629e6-54f7-43a9-a04d-f2cc1872d918", "indicator--3162269c-d145-4a40-92cd-d4b18be340d3", "indicator--dfd3e200-d221-4eb3-bc4f-47fd5293c597", "indicator--09f4dc79-a89e-47c6-ac7b-d338c97e73ca", "indicator--68009fea-76b9-4006-9190-6681fa2c898e", "indicator--29bd01f5-0126-45a1-a7cb-6546b925cbcd", "indicator--0348491a-ebf6-4ce1-9909-7a47590b057a", "indicator--70504e62-c91d-45e8-a785-8ced436215ec", "indicator--e0e6059d-cce0-44c8-9d23-858c64eb1f31", "indicator--2c629587-a7cb-4639-9ddf-67eb078c2f20", "indicator--6c9da44a-e889-49ba-937e-8b5dcb1f5f58", "indicator--001a10a4-3796-4469-9cfa-6beb7c3205b4", "indicator--7f3bae8f-4437-4e8c-943c-e496dfcfee2d", "indicator--6c240af1-01d6-4875-af0b-b3e7e0e61887", "indicator--57d2c043-c80c-4988-a072-ee20351e451e", "indicator--9ba1804f-cc35-4d43-8fbe-8c84309e2bf3", "indicator--a6bf296e-414c-4d19-9b2c-88040cfa17d2", "indicator--ec45d74d-5ec3-4d7e-bb13-4097e022c1c5", "indicator--79b4de61-56ab-4f84-a59d-d087aa77f631", "indicator--7295a4b8-edc7-4ab3-95d0-d6f5d18c1295", "indicator--fbfe4456-5839-4ffd-889c-281b5f6a43f7", "indicator--db4001ea-1c4c-49f3-9917-9ea56d49e75c", "indicator--63def53f-f012-434e-beef-397794bf6580", "indicator--6b5b8a59-cc56-42f1-b66e-f10b133e1154", "indicator--2185e9de-3faf-42d7-babe-2e5c3eba52bf", "indicator--349b6527-e76d-4d69-83d4-daef67a95345", "indicator--f96dacd0-cac0-4e0e-97bb-d9f25396da4d", "indicator--b0f921a7-894e-4170-9fea-e97d0ffac816", "indicator--48b09f56-99ff-4e72-b929-07d328cf54ee", "indicator--517d1e23-75c4-4e2a-bcd8-74c5add343d8", "indicator--69a9946d-8181-43b3-b6c3-1bc888751384", "indicator--7ba40725-73d9-4e59-8ad6-d525e843ff32", "indicator--55f13f45-fb31-44eb-bf79-fa820b12cd0e", "indicator--da4a744c-26e7-47c0-a47c-8fe793a48510", "indicator--354ca802-d38e-435f-8a64-89c7781807ac", "indicator--e86b6ec8-d4b8-43ce-b97a-72365e7fa050", "indicator--dc7a2fd1-a089-47c2-8178-9ffa0d9c5492", "indicator--913adfad-8c75-4433-818f-2630a992440a", "indicator--7b46600d-45bb-4075-a3e6-79f9c43840a1", "indicator--5d2faf31-68f8-456a-b4d0-fb02dea939af", "indicator--5c5f15c0-40a5-44d3-a043-87d218bff237", "indicator--519fc590-03e1-468f-a674-8f5fa0a0f8df", "indicator--1b4e3667-8241-4aa9-b91f-daa0267c426c", "indicator--cb381c02-0c81-4108-80ce-47130ffdd1e7", "indicator--3222a32d-2a08-4dbe-8b89-6cb07b641fdb", "indicator--de87ef0d-be5a-4301-b7e5-b714ba556629", "indicator--b106e51a-6b3f-453e-8979-1dcf7e81bdc3", "indicator--a17e949b-7516-40bb-9cb1-0ab88a132bae", "indicator--f97077bd-3319-4b79-9308-198cc9dd651b", "indicator--e0e0f172-0cb1-4585-8efd-17872306e069", "indicator--336bd2fc-8867-4c42-8734-64a3404f070f", "indicator--3572baae-8bb0-4874-b882-250bcae12336", "indicator--37fa1fc7-302a-4c58-a2a8-79d42ab56544", "indicator--da8aba15-274e-465c-88bf-1548bf886ff8", "indicator--2e9be7f9-ea18-4d7f-a326-bb4bcb58efb2", "indicator--eff905f5-d108-4943-bcc8-2d74ffcf7c80", "indicator--68afef1f-1d1b-4c9d-a434-510e7f0b5cf8", "indicator--6f07f38f-a5b9-454b-ac70-938643a3a024", "indicator--117fe93b-01b4-4c0c-9697-1f1e03688925", "indicator--090e7e36-6f9e-4529-892e-09420cdb8cd7", "indicator--6eeee88b-7e06-4b7d-ab37-08f8c818c5a8", "indicator--f59adcef-7a72-4a2a-a2fd-72be54d2bdc0", "indicator--ce149999-4320-400a-9a78-0d09716b158b", "indicator--a2764ad1-7a44-4219-bf63-1485395ecbc0", "indicator--137f02f7-c3f9-43b4-bf1f-fe8617bdced3", "indicator--e2ece16b-c22f-4d34-b001-ebc213ffe99a", "indicator--8e4ba8c7-6bcc-4136-995b-1f9a4d15c296", "indicator--398cb162-5ade-4742-97b7-31e3627cd2c9", "indicator--3775f436-1c21-4954-9b17-22d10bc50f16", "indicator--658f6e9e-dc8c-4b85-b9fc-5c8a60a42caa", "indicator--04cc480a-825f-4704-969f-03da3ba7c5a9", "indicator--bc32954b-657f-4181-ba9d-1d013370f48d", "indicator--72fabf23-ea2b-478c-b3ac-5d9d7bd0c0dc", "indicator--8a41dc45-9610-4466-b8ab-721da88bd9e9", "indicator--e8c7e030-efea-4c62-a556-3bbec3b361c9", "indicator--27580748-6189-42b8-b85b-b36a4f128998", "indicator--3de7dac3-3b78-49ce-9747-d92f1117554f", "indicator--1804ec30-7384-4f66-901a-e7ff6523a1d7", "indicator--93848b5c-673e-47ff-93a8-0515584b0c41", "indicator--3dd55c68-a641-471f-8597-f7a08fa63a2c", "indicator--492663d8-2a40-4935-8ec1-702361dd65a8", "indicator--a575193f-d645-4ea7-898b-a2c52952fef4", "indicator--e3e2d2fa-6e74-464d-bfaf-c99f01b43885", "indicator--85cccdd2-0f10-4afb-a9a0-a02b8940f64b", "indicator--054bbd37-ccb2-4318-ad3f-e2b7c0dece16", "indicator--cb97b803-3fce-4769-be20-560e093e56e2", "indicator--5423fe2d-6b81-4c46-9c77-52ae8930dc23", "indicator--c59a0cce-7f0d-493a-bf57-f5b369c354f7", "indicator--f2979577-e22c-4f94-b433-a194dbacdf1b", "indicator--853c8f6c-cb35-43fc-838b-31ebe75e4630", "indicator--2dba57c8-a2b7-4ed9-b08f-0ce242e8ef1a", "indicator--d882463a-123b-4146-a0cc-3465c0afce9d", "indicator--8dcb489a-bc9b-4156-a0b6-5debb02bb4cc", "indicator--60569e9b-3a05-4aa9-813a-ee765beab43c", "indicator--0ad639cc-f506-4737-8709-95b5186bf79a", "indicator--2ed529da-c2b8-414a-a258-f85e0d57f661", "indicator--fc8f5495-e602-4b93-9a32-2db000553c4f", "indicator--631092aa-c610-44ac-baeb-b8f9fe1881c8", "indicator--1338cb85-b2ce-4a6b-9a29-61aed6108e53", "indicator--31907f98-bda6-4d6c-9cfd-cd55c38ee35e", "indicator--6c1dbf8b-2c58-43ad-8756-3d919f666579", "indicator--bad20268-54ae-45f2-99ce-cbf278a1b19d", "indicator--0aceedd5-f959-4c01-b590-1e52cdd84bcc", "indicator--c550a40e-2bf4-40ab-aed4-424a203ae0fa", "indicator--dc5804e5-f0e6-4fed-bd36-ad74e73b3457", "indicator--8360752e-d84e-4edc-9a70-aa9a7a17487d", "indicator--ba30ecd5-8381-4f32-83e0-b9c72c52c32f", "indicator--e9424ced-c22d-4e1a-b678-fdd15576de57", "indicator--a24819a4-8c8e-40f6-bc16-0c757a0e6519", "indicator--c96604fe-fa32-49bf-b2e7-76274a7378d4", "indicator--bc2f00fe-1dbc-48f8-b1e7-172dbf9cca4f", "indicator--4b948b0f-44c4-49c4-8756-21e620190a67", "indicator--ce88b3bc-a190-48ec-acdc-d1db4e2a4492", "indicator--433d3a1d-5f45-4851-9a6f-29157400abcb", "indicator--4c8359f9-9ed6-41db-bdf1-587b43fd48dc", "indicator--f604fe77-6b72-4306-8771-203de3d67982", "indicator--06a173a9-1a86-441a-af60-72975a36dcc2", "indicator--8e99152d-296c-405a-841d-c51a417a6606", "indicator--d6ac9801-80b9-45fe-9361-d33c297d55eb", "indicator--f07058a7-f6e6-46f0-bcdf-68b152ffb794", "indicator--d33f7e5b-7134-4200-995b-b6762c4cc8c3", "indicator--76d86ac1-c0d3-4637-9a1f-0e5e85f41038", "indicator--38061e1f-8275-485f-9787-70afb9352be5", "indicator--59bb6d83-1f5c-4a3f-ba4d-99ef37555a65", "indicator--8099dda9-dc94-49da-961c-fb73c14f8522", "indicator--c6b23717-437a-4d24-a982-b446ab3a794d", "indicator--7bbcde61-2b51-430d-848f-b321826c6aaf", "indicator--6ff5fca8-4e5a-4729-be9e-2275942785fa", "indicator--b19f301e-291f-493a-93e3-2fb791c1a5d9", "indicator--253399f1-0028-4052-a518-6b1484e3bf90", "indicator--178486bc-f50e-4fcf-95ac-4259c6a92f9e", "indicator--f71eb624-3e5c-4b57-9d22-6639ab6ecb1e", "indicator--78c53b49-28a0-4fe5-8209-3dfbac96a0dc", "indicator--429ad5eb-6319-4cd5-887e-2e025a873859", "indicator--10b56d43-39d5-4ece-aed7-25e2fad8e6b9", "indicator--7dc4de49-7c2e-4341-b1d2-50273fdafbf2", "indicator--3dc00365-c454-486c-a678-964133997a77", "indicator--64a1ee3a-6956-4922-be61-93c6a30e7855", "indicator--e8177ff4-8861-4e3a-b134-aeb21f908add", "indicator--5937d977-7e2a-493d-b8e0-e20277b5a71e", "indicator--aefda670-9b4f-4b85-afe0-528c85d9fab3", "indicator--97502a43-d845-49bd-9e94-ff7f1fac19b0", "indicator--d663995a-9584-460a-8bff-152f054eac75", "indicator--970859e3-3ae1-4e67-9b42-11fb2fc76372", "indicator--db734b8d-f40c-4236-8a25-90af4965e4ce", "indicator--fcd3366d-d064-42cf-92c9-8e9a4723c73c", "indicator--a3f966e8-9e64-407a-8d06-e2f7c56150ed", "indicator--faaf7d01-7ad3-4919-bee6-a68d4eb6f58f", "indicator--f341434f-1a52-4e56-b045-93c71619a621", "indicator--35e75b92-e795-46bf-8245-c159676ab6d8", "indicator--6e7045f4-c48e-4ac5-a8cb-290a70c9bf14", "indicator--12b56556-5e90-4cae-97d8-dc9b70b39007", "indicator--11c0be27-d1c5-4d70-88fa-60c3c792e3d2", "indicator--6e43420d-7478-47d3-bf1c-a2aeb85aad80", "indicator--d9558753-8598-4ab9-bb5c-e506aac930b1", "indicator--c1bedcc7-148b-45c3-8b30-dd600e3ae398", "indicator--ce76efad-e0a9-4270-b424-c670ac2ddb84", "indicator--7017f4dc-2254-477c-9dd8-1b13a46f3937", "indicator--368e9b6c-4fd4-4374-982e-71c19cf8a403", "indicator--9d97e97a-17bc-4668-8014-681c5cf6babf", "indicator--619525a7-142e-43e5-81ab-0d3530012c0f", "indicator--8350dd57-821a-4087-b073-f15645e1e94b", "indicator--ef413b03-079f-46ca-bdf2-2b7636b42fb8", "indicator--d4677857-618c-47e5-b769-1030b729c3b0", "indicator--ee05726a-0a35-48f2-a743-0eaad394875c", "indicator--6c5e609e-60fc-42d8-945a-bb123f0cf97c", "indicator--67f7c474-34db-41e5-9668-a65c4a9b1ce3", "indicator--f7777726-15c6-4762-8c03-1feb86e44351", "indicator--07ece1dd-b608-4e67-bdea-dcaf9e681e5b", "indicator--4bbc9400-9f0e-41fb-89be-d04da9646f7e", "indicator--61bf5f7d-3a3c-4bc1-99be-5f00b3db23a3", "indicator--9258cd2a-5a28-4c37-8206-a3ad1d4b6485", "indicator--d86a9ebf-0bc5-41fd-a153-4b2237118098", "indicator--b4aa2789-b02b-4938-a3a0-79d42db3630a", "indicator--97b28616-e98f-4ae4-89a1-7dcb9c5bbc9f", "indicator--7f906d23-06de-4348-8c8a-de231395bf20", "indicator--969e20f1-fd81-4c89-92d2-0f1e86b7b51d", "indicator--8604fb51-72e4-498e-aec4-af1b9204b501", "indicator--8c42634e-1533-4ab1-80ac-a01023cd44ef", "indicator--81725510-a091-4c59-80ec-b8ed46ec38d5", "indicator--5ebb3b57-b81d-4121-b072-dc361c86f75c", "indicator--2819db4d-bfe2-40d4-b7ed-95977bede084", "indicator--03127386-1810-4ed3-96b9-1bf3198e74aa", "indicator--a473a9b1-f3ad-4876-ab41-0d84455ee773", "indicator--7d32e5c6-4c1d-42dd-bced-e62f62010723", "indicator--27c51ecd-ac87-440b-8395-a5ad68059103", "indicator--78be6b43-dfaf-4353-9ade-80093b4ef2ba", "indicator--7b98d70d-7be5-4922-bed8-3f1d483cf62b", "indicator--0a6425e2-6ff7-4b2a-b441-4ca285a2447a", "indicator--f4add079-5e9e-4afb-a1d9-e9275f2e6a1c", "indicator--f62587ca-2f21-41cb-929b-f761daf77321", "indicator--8cd67747-2905-4d35-9281-ac6c5726f6fa", "indicator--a7e96910-ef97-48be-95b4-1d64b9d53045", "indicator--c8fd70bd-ee36-451e-9ffe-af47e81ad5bf", "indicator--0c782fb1-37fd-4b96-b329-22d3e60d73c6", "indicator--64678175-3f86-4d3f-86e1-7076f9cd732d", "indicator--f54868cf-1c7a-482a-ad7f-7f72eaae207b", "indicator--eaed7d34-23fc-4682-937b-b4f134ab994b", "indicator--56aba4f0-8551-4c9a-b7bb-e1fc78334c16", "indicator--5850f789-732a-4eb3-be01-fd3e375ac14e", "indicator--97abb0ff-e99d-4016-b395-ea751537cc4c", "indicator--19f72581-1ee3-418b-bab0-3578fc412705", "indicator--7a5bedd4-5d4a-40ca-afed-024158415600", "indicator--ed7f5a1f-b0aa-449a-b7bc-f07d871b0db2", "indicator--c7692a7f-537d-4f32-9de5-30766cf07708", "indicator--e443b82f-3a76-4e44-b1b3-d3a938b60b39", "indicator--72c237e7-1363-4ea7-8017-efa5ad66cfbe", "indicator--87ab2dfc-476e-45be-aaa3-895aa74ce7fa", "indicator--4ef5cdb1-1b8e-4410-b654-2a88fe2da764", "indicator--775fd866-48f9-498b-8d34-4eef661ab246", "indicator--61d82587-629f-4b7d-9e6b-864ab3473cd2", "indicator--962f5436-06ef-4f4d-8722-44d67423d57d", "indicator--b2ace8d4-499a-4e3c-834b-69ecd71fd4d7", "indicator--8564ce33-c1bb-455e-a5df-978ad67eb38f", "indicator--6ad7aa9c-fba8-4d5c-84a9-b52ac4c1b1a3", "indicator--4ea134f0-1a1b-43ad-af95-02a04143ddd1", "indicator--15f53cce-4b95-486e-b72b-80f868795820", "indicator--eb7ad6a2-15ef-48d7-bed1-5499d0168f49", "indicator--4c11937f-24de-441d-b0c8-e9fdc247d817", "indicator--b38592bf-8ed5-4492-b5d1-fa9a08d3e8f8", "indicator--aba03fce-1491-44c0-ab9e-56dbbd07b28c", "indicator--a9e2eaf1-fe29-4458-bf0d-02f357fa7c28", "indicator--38c6ac90-e842-4b39-ad75-b10f3abb9802", "indicator--e6e3e9a4-ad0b-4513-a6fd-9823a5f75efc", "indicator--dbc09db8-6f84-443f-a23f-9f96c17c7ab8", "indicator--a1627c45-031d-46ae-894a-f3fb0a8db0e2", "indicator--d8556a41-97d9-4667-8d43-e119546e5a7c", "indicator--de704181-6920-473e-9cf4-74bbbd71b4ee", "indicator--cc1ab12d-314e-491e-bc1c-ae391d6ed809", "indicator--02183cc4-16ef-419e-b755-da2a1ed21ef9", "indicator--52004c6f-272b-42d2-9911-decbacce36fd", "indicator--df240f7b-3135-4227-867f-7471419ece7a", "indicator--2f0e7c5d-9ee3-4e98-b3cf-d989341b98d7", "indicator--b492e4d8-cfd2-4cc4-ac57-612b8de48951", "indicator--2558cc32-c3a2-4692-920e-4b89f16b6339", "indicator--04e987cf-bd4a-49fc-b576-fc5154867e42", "indicator--07035598-0a06-4977-88c5-be7e2817cbba", "indicator--5c48e324-ec45-4b97-ac42-a9225a4773c1", "indicator--a3816f02-a067-499e-b3d0-786cc912f079", "indicator--b65eea98-4949-4fc6-a562-9a1af6bc30a1", "indicator--84910b95-dd65-4773-b37b-832a67da8059", "indicator--b15eaa18-bede-4079-bfcc-bd6bdca4e11f", "indicator--af7910b2-b9cf-4898-b6a0-e2de1c80eed8", "indicator--de70022a-41b3-41db-a6ae-2aa80992ceef", "indicator--80d70ca2-d636-48e6-8bbc-cdab8340262a", "indicator--543965f6-1327-47c4-8f12-a6b3236cf7bf", "indicator--631f377d-c574-4321-be84-91b997e91239", "indicator--6686598c-11d4-422c-8224-4b9dffe88400", "indicator--fb245e59-2787-4a75-8e79-0e895e573df6", "indicator--321d5dd7-d2ce-4203-ba00-b13476972997", "indicator--28dee8db-7fa0-4033-b607-c2dc47ce6ad7", "indicator--9cf800d0-b35d-4e79-883f-ce7f12b6afe2", "indicator--74a162e3-6e10-461f-993a-ffcd642d1630", "indicator--4dc6fb55-88c3-4d09-bdca-66772283d5aa", "indicator--fc698242-563f-498f-b740-8c557e8e4d32", "indicator--02442aff-2a8e-4823-ae02-0d7f97bbb202", "indicator--abd0fc8b-e794-41db-b755-2502ddec452f", "indicator--0ff0fb05-56c2-4b5f-b5be-29c9669a80bc", "indicator--65a1e6cf-82d2-4b3d-ba8b-9c8c5ab95bed", "indicator--d44aa430-bae7-476d-8bf0-107861a1b23d", "indicator--fcbf6343-3784-4bf7-ae74-a74add6ede2e", "indicator--44174091-fde6-493f-a309-876d4551a738", "indicator--358412f8-6e90-463c-b554-7e973ae0a951", "indicator--04c7a925-478c-4122-a2ca-76147371d741", "indicator--dfbb35e8-1daf-4938-994c-40d0c0d7fd33", "indicator--8b9b6790-760e-45f0-9feb-437067890b01", "indicator--aaac1db1-aff9-4ed4-b2a2-fb16b2ac8e98", "indicator--08c502bd-7b84-4b4e-bc68-ffbdfcd3a50e", "indicator--2d37a605-fd21-4d4d-8cc8-72025b285554", "indicator--c12fe71e-6ca6-4b34-b433-431b0b212b96", "indicator--3abf1f19-3e2e-47c8-a7a2-a1be045def3f", "indicator--5bfc8000-580a-4bfe-9758-d94af2237203", "indicator--06846969-e159-42cd-af81-3a5e17445600", "indicator--54d10a71-bfc8-4956-be51-78896fe6ffa0", "indicator--60ae5451-8ee2-426a-b7d6-4b7bb3e4d4c5", "indicator--7102ac27-805e-440b-b7c4-4d68c3fc94f8", "indicator--2971f2fa-1be5-4010-890f-8afe46ce4cea", "indicator--05a9f402-6edf-42e8-9082-97c3458ad361", "indicator--ff784f1b-68c7-4a9c-8d46-9b5615baa015", "indicator--dba5fb40-ee80-487d-954f-32e07023728e", "indicator--3b726464-cd07-4f1b-b902-1a5f79d8c325", "indicator--9ed2676f-4527-43ee-8f2c-c10277481c88", "indicator--11c0c7d3-dc27-47d2-b07a-63d29b08654d", "indicator--9ec68360-28ed-4055-9f2b-34f2d110f970", "indicator--5e03f98f-03dd-4733-a0a1-36e8c6758a52", "indicator--0c31bc4a-4c2a-4dda-a297-6ee43d39cd54", "indicator--bbed9fd6-6da3-46d8-a18d-56cbe2119566", "indicator--f355f218-85ff-493d-b31b-ceae74c56675", "indicator--e83009cc-c8fb-43a1-8adc-10043e27cf9c", "indicator--a292ed6f-642e-48c2-a813-0d8b3d78d1e4", "indicator--be27800a-5e06-4c2d-9270-33952b50a2cc", "indicator--98aa38a0-ba4a-4aef-ab84-2e6a426873dd", "indicator--a1f9717f-9abe-4360-904c-6602add0224a", "indicator--d0effba5-418e-4187-938d-85e79f32c84e", "indicator--0d1786d1-caed-45df-a700-fc47eaf37078", "indicator--814148f0-42b1-4a6d-85d1-b636b1b48415", "indicator--b7284e9a-5ebf-45d0-8ea7-3c14c202797e", "indicator--3b784190-ed83-48e7-85ae-773881de3ede", "indicator--c6d7d67b-6d84-4e2f-985d-454f8c6a209b", "indicator--36a4fab2-7c57-4146-a673-20090558bdde", "indicator--9eb037b2-ac1f-4210-ba0b-9257353737a6", "indicator--be87464b-208a-466c-b375-1c8af135df2b", "indicator--18cd34ee-fbf1-4943-aca4-db3fb857f9f2", "indicator--cdc8b971-6db3-456b-9704-2b728d92158e", "indicator--4906393b-7edc-4281-b7d5-24fef0489b43", "indicator--fb10de92-1fa8-4278-9cf8-6b4aad3974b8", "indicator--2208bf01-df1a-4b4f-9a83-bb8f93ff75f8", "indicator--3c6550b5-74f0-46dd-a3c3-6e6ab3a37308", "indicator--a9ee6fba-162e-4dad-8347-b1d93af9a19f", "indicator--9ca9e9ae-acd3-401d-b55b-54ad0db7f0ec", "indicator--f6c4e58d-d64d-45df-9676-177eb128b9c9", "indicator--9d1769d2-dffe-43ac-acce-bd63f93b1426", "indicator--3cd4cc08-ae59-4e51-b0b0-ca0782e73e03", "indicator--478ecea5-7178-4658-bbe4-86ea1875bf58", "indicator--7590599c-a6a7-48ff-a39d-a6f10b54b368", "indicator--52c24a14-97d8-4f0c-a364-f8ea64399173", "indicator--5d59f641-a0ab-4d64-8bbe-998b441af1c8", "indicator--bc3da0f9-e330-4956-9a94-fbec0ec97924", "indicator--1dcb36d5-1fa0-4656-9831-083860b342bd", "indicator--9e2c82a2-9432-41ad-b620-770ceb627b1f", "indicator--b49ad551-9037-469e-a5a7-a7f1a4f7c345", "indicator--0fa5f0ee-9226-41f3-9a31-0d27608270d0", "indicator--6b4c6f15-288b-4e8a-889a-30708521841b", "indicator--d109b163-7818-4551-a95b-f8d5e39bb687", "indicator--72b41b99-4bd8-4f8f-ae30-22a7d8fd209c", "indicator--c45b2186-517f-4575-9e79-d0232e490daf", "indicator--d0015e74-451b-4225-b09c-b0dae5d8da71", "indicator--0f89ba4a-249a-4fe2-9169-b16c251e1509", "indicator--6d69f77f-2981-4aa3-b968-6316da073ccf", "indicator--59396697-73a9-41c7-ba23-07a7d6da6b66", "indicator--529b57bb-a41b-4f6f-9031-b080eead73b8", "indicator--906e7c74-9d2b-401e-8d7d-3e26b152d28c", "indicator--6b8e240a-9445-4845-9e8e-41f30f7b1a4b", "indicator--2fd334b1-f818-4890-b6c4-ae40697a6411", "indicator--aa46ba1e-068e-4a46-95e8-2ac6b3fe71e7", "indicator--4af4a7ab-c3b0-430c-a9bf-3a2ce28e866e", "indicator--9ecf43e5-a655-41af-8e81-d03861d34962", "indicator--944ef17b-ba03-4cb4-a3c5-a1eee6fad34c", "indicator--47426315-59d7-44dd-ba3c-23ff8064e6bd", "indicator--42a20dbe-f607-4cdf-b7c5-376ed061a8da", "indicator--9d109339-5b11-46dc-9a6a-ba30717acd16", "indicator--f521e2ac-4df5-4bd7-b78a-a064698b0631", "indicator--b12b2aae-865e-48a2-afdd-5b58aa1ad46e", "indicator--c8ebc4d7-37ae-4d40-850c-03c6efef0f3c", "indicator--f2ba980b-5eff-4246-87e1-9c7f5b48261e", "indicator--f1da8979-85ff-4f88-bb3f-895b53910604", "indicator--f215b4b6-ad60-4bf3-973d-b5e9b6f0fd77", "indicator--a3ef769d-bd7d-4f8a-8f36-1eaeeec688a2", "indicator--e52b8960-0b94-4603-9fa1-ed9a9c49e8d5", "indicator--a2f8fbf0-418f-43e4-b5f6-b5fe1d5d5614", "indicator--3bb0eb90-5dc6-40dd-8ec3-0d3166ed5e40", "indicator--2b27236a-9f77-4b6e-9588-b47fb0ce00f0", "indicator--e7bf444b-5206-4dd3-89e3-44583bb9ebe6", "indicator--92b4ca67-6034-44fa-aab5-60894ebed2ed", "indicator--bf305b76-4aaa-482c-b59e-d11aaf02a6c2", "indicator--b82f7efa-9553-4c3e-8a05-9eaa95807c59", "indicator--d89d1e5f-3ea9-4540-b3ba-562fc7116cb9", "indicator--4df891f7-de72-44fd-88ae-ea6bd8881122", "indicator--d58e1664-06c2-46eb-9a98-cb53718a34e6", "indicator--b63cb2fc-1d07-4255-b932-88a345ceef34", "indicator--023d9323-d887-4c4a-9f4c-dc3ebd103467", "indicator--9389d793-355c-440e-8d0b-4396b9253a9a", "indicator--eee7f7db-7db6-44d2-8e6c-06e3acc4db9c", "indicator--982d324f-16a9-4e4c-b046-58d027e561ad", "indicator--b80ca8b4-0183-42e7-8f8a-813c5b8c1fa2", "indicator--d67b1cf4-c616-4d1e-bbc0-ac13ee205fa5", "indicator--9bceb0e5-d52d-43c5-914d-05a15a7dce39", "indicator--173da8c8-c9d0-45b3-8657-23f656e217f7", "indicator--5fef1778-816c-4ba8-8bbd-f3bf27059c1f", "indicator--89775de2-caf6-46c6-9dae-f3b6b29e4e60", "indicator--f63c325b-b8da-44c9-b7b4-8012d6e52698", "indicator--a6b83189-8a96-4ff0-a85a-ca67d09c48ba", "indicator--105825e1-698a-4696-b3b6-3512339185c8", "indicator--5f8461d1-fd32-4050-8283-1deef762dc77", "indicator--cca1b884-8c84-42e4-9679-fa40ceb841a4", "indicator--0b99151f-43a4-4f48-aedd-b747940272bf", "indicator--53b7aef3-3286-4f3d-a181-688f2039d1bf", "indicator--fafe8589-671e-4ac6-8e8a-ce0531d5a7ed", "indicator--83aa1b89-6892-4890-871c-63bc215c19c6", "indicator--33687543-6467-4ad1-b8cd-67d9f96759ce", "indicator--b0c9142c-ae9a-4de7-874f-40a447d49833", "indicator--2860f6a5-0a68-43cc-9473-55c1f781ec58", "indicator--d3437a7d-d015-4498-a9e5-726d3fc5da93", "indicator--b57e052d-fef4-4daf-80da-d653c8d3385c", "indicator--c05b9dc9-3532-431c-8f3e-1786ab9d3e8e", "indicator--ff91f25a-57f0-4023-860a-9cc5645cfcd7", "indicator--55c0a7c1-708a-49a1-9bdf-101fff20e59a", "indicator--b4a5bb7e-3ea7-498a-a0b9-ddbdba154d89", "indicator--2c92ed8d-74a9-489a-87ef-5aa2fb8d8462", "indicator--a69a5b57-9773-4534-ac0b-d5f57cb3cdb0", "indicator--8c67a2af-b202-44c1-8a6f-81b4197bb15f", "indicator--67f87c3a-e086-4bae-bc51-bf976a5043c8", "indicator--8269a615-506a-4acd-8560-fda31082edd1", "indicator--93194a53-58d1-4f58-a230-1dc7957e134a", "indicator--635d67bd-d202-4051-bb34-e7384b7e7a69", "indicator--46756aae-b1f0-42d9-8bf3-8e5ce4fb7206", "indicator--a53a60de-5904-465d-acdc-f707bde72040", "indicator--7697e0ab-dbc6-4c02-9366-323ea9da8378", "indicator--add87e97-12d3-4f35-9c5c-41d6d01819cb", "indicator--c3dee5b2-571f-42e6-b304-5c1184e9a5d9", "indicator--8c871983-d111-4562-ad22-5c3078f1a29b", "indicator--02b1442f-8051-4ff7-a112-6ad5bcb4cb4f", "indicator--418e3505-aad8-4d70-a17f-63f0d3e102f3", "indicator--51ed9d3a-8400-4b9b-9e55-b8b720e68f6f", "indicator--b6fa97c7-c74c-4bb9-895e-b6705ce2b56f", "indicator--c1642ff9-6b90-4e51-b961-fca086c75336", "indicator--3e549311-19f3-45a4-a7ee-ba0913655b08", "indicator--ad6a30ec-f442-4e9c-9429-9c06e03f488e", "indicator--410b8cb6-fd76-4641-9e85-6045be99a41a", "indicator--b2720ddc-79f7-40dd-90be-7975c9e90c58", "indicator--f9a2efed-ecf6-41b7-9360-751e9f1f39a3", "indicator--442594e2-511b-4a3e-9117-417812e69728", "indicator--169c1137-711e-493b-bd84-1c235e2217d9", "indicator--ae3c0c0c-beb0-4fdf-a8f8-38660f4efa9d", "indicator--1c91170c-df8d-4ed0-b5a3-99d22e289e7c", "indicator--90f7f2ea-9f9f-4009-917c-9c0fe621b1aa", "indicator--fb4d6260-4f44-46e4-afc7-3cc11fc840c6", "indicator--0beb3675-1c00-4333-845d-13231ec78fa0", "indicator--7449cbe5-878d-46b1-bfc2-054a0b04a309", "indicator--36a54d9e-bcf0-43e1-adba-d77feb1d2114", "indicator--ad260eef-b7ce-446a-928f-edf5f0994dfc", "indicator--b8ed4b86-a162-4da0-b911-742c713d0fe0", "indicator--9c6c2c4d-ad17-45c4-801d-0898897f64ba", "indicator--53507190-802d-4f31-beb3-99db0d14c8ac", "indicator--db64baec-b39f-4bdc-985b-1957eec2f7f5", "indicator--1ca1ba1b-3ed0-4db1-9325-98dead5448b0", "indicator--7cc0385d-7043-4889-b629-29fd03a542a3", "indicator--53cde69e-1646-4f1a-9bb9-e186afb27b78", "indicator--540a90a5-9d4a-49f9-af01-e3779afa9522", "indicator--4cf2870e-8480-4eee-a0d6-fa32af60356b", "indicator--7cfd92b1-0d84-491f-877e-789b6d66696d", "indicator--9deef321-096b-414d-b268-662d6c061f55", "indicator--5ddf6b2f-4507-45d4-b504-5d0dacf4e5a3", "indicator--2364af6b-4826-4318-9bc2-fccb29f9e464", "indicator--de1071fb-a368-4984-b668-7b800a5ea217", "indicator--a55cca09-a555-4e28-b8c6-5e1e660a88e7", "indicator--5c996c6a-1290-4925-84d3-0e20e9c9bbe4", "indicator--ded8d64e-3fee-4db4-81ed-e3a044af98e3", "indicator--4272b38e-c006-4fba-9b32-68d73cb9f414", "indicator--5e8cb953-35ec-4cea-b77f-cc8c91c95eaf", "indicator--1bddd9a5-9b26-43c8-afe7-3d54d4219f9e", "indicator--c488528b-8bdc-4844-a145-e4f01f0ba334", "indicator--e220caf7-710b-459f-b405-7da1ac06a52e", "indicator--199c93bd-05b7-4358-bff8-6291f80693b0", "indicator--32331da5-3253-4926-a859-032c1e9525ca", "indicator--2d3f7b2f-d862-4d62-89f2-3d8eec41704f", "indicator--b94f8117-48f1-4be4-aab4-0eacbd993309", "indicator--257f5b46-7eb9-4d42-af0b-c4ed156f5527", "indicator--7912b52e-7446-4e15-90db-8cec6d6a287e", "indicator--92bf8c31-f8c9-4501-8e42-06caa35e68ed", "indicator--2fbf8df7-41a3-4752-89bb-9c994ffea79c", "indicator--76c77247-735f-4baf-b39f-863f259e06f0", "indicator--56e2e0ed-bf7a-44b3-85c4-b6f57398f5d7", "indicator--b6b12989-1c20-4333-bf72-1687d61fb65e", "indicator--731d75f4-638a-4bce-a31a-b8fbe330b0a5", "indicator--f590654b-a692-46bb-95c1-6698517e2c09", "indicator--7dea3157-4d1e-470a-99ce-c6edcecc7169", "indicator--015f74b3-3f06-4cf8-99ab-fceb8e323a9e", "indicator--a6358e94-9b26-4b09-aeaf-284c8a1b02ff", "indicator--ad7421f6-9718-4c21-9302-8f1053c90ae4", "indicator--93a2ea7a-eb72-488b-a5ed-9d893657b7b7", "indicator--f0a2e73f-0c93-40b4-859e-fc01efc25095", "indicator--cfaf5b8b-e764-4163-b9d1-8f9871abb9af", "indicator--b3fe4e7f-3e2d-4dc4-b885-98c33f93d37d", "indicator--7d11fedf-bd76-4c3d-82b6-837306e90f7c", "indicator--8e718c1f-2746-4b5a-ae3c-b8beded6f4af", "indicator--c24ad281-5585-4614-bd53-f2d400060da6", "indicator--e019bb87-1a49-4102-af6e-8c2a65521c25", "indicator--4f44aa92-d9f1-4b44-b107-4e7d4bd8e6eb", "indicator--fbb4ba03-6ecd-4812-8a7b-08ca9cff5fcb", "indicator--ec2901c0-ff0c-4a88-b762-1ecdb8c578f3", "indicator--d3acbc1a-3aae-41bd-b812-e7c79fdfa9c7", "indicator--6f0a4d8b-8a6b-4fe0-a334-321a6cedf926", "indicator--6ae89320-4581-4664-8800-b227d1deae8b", "indicator--f6a74a6c-3c86-4019-afc4-e2d463f46970", "indicator--8aac4ea2-1393-4f75-9ef5-e0c5661bcd06", "indicator--9cdb59b3-71a9-457b-8280-a00facfbc521", "indicator--e4e13ad5-e34b-4946-9ae1-1282a86ab2a9", "indicator--e880a5f7-546f-44fc-8331-347950416a8c", "indicator--e0e9eb9f-080c-4274-8cf4-3d5e351112a6", "indicator--0deb31bd-5ee9-463a-9590-6be2ed848bd3", "indicator--10b88b77-6fdd-4ee0-9a65-3b8ea143f60c", "indicator--797a7243-e533-4cb8-b17e-8ee7f4ed724e", "indicator--347a7892-dcf1-405c-9abe-2fe333fb568e", "indicator--eff73f0f-ea78-4514-9813-f0705bf69fe5", "indicator--a7f64d6c-aa66-4723-8f02-b9f191358b03", "indicator--695d2d22-c3dc-4894-888d-55131019a15d", "indicator--ce1ee1cc-2d37-42f5-be06-b19371136cc6", "indicator--4f365d57-9b41-490a-ac37-7d7149e28028", "indicator--207459fb-e752-4b21-8e4b-1638a2edc09f", "indicator--414f8022-7c77-4b32-ab1e-7a21b1b2b929", "indicator--33718fb3-5042-4f27-a64c-900a51c26c35", "indicator--e9bc78ba-006d-4e85-804d-cbe1bd8cb09a", "indicator--ca2a1ba9-2b4c-4683-b4f9-91087dacb419", "indicator--5d8ff6a4-2a94-4381-bd42-f02f7b682da3", "indicator--c8e3a78e-6c76-4868-a1b9-7739c0b76bfc", "indicator--60d3a87e-73c1-478a-9343-c694deeeb844", "indicator--60a9fd50-685d-4914-b24d-f829d279c7b6", "indicator--916aebc5-be32-46f2-a4e1-1b5d4f734aa5", "indicator--1e9826aa-0381-4c6f-b687-2cdd05876a8b", "indicator--1e6773d3-4185-43cf-b5f4-e8d666dec033", "indicator--ea1d8117-dabd-4ab2-b44f-82b4481cee87", "indicator--20c1d870-7e9b-42b6-9028-4e952c9df38c", "indicator--75613fb4-9f01-4c98-9211-b671d5b66d59", "indicator--477b2651-238c-483f-a866-d239d9a54e27", "indicator--0c604019-2ad9-4a27-826e-74bec4d2258a", "indicator--722a9d39-f47e-4c6c-89e4-51c4745ff59a", "indicator--dfc31261-f8e1-4c4c-8e1c-c0b7d61dfb64", "indicator--9bfef6b7-2938-4d9b-9738-d610c2572c04", "indicator--f2d933db-07e5-458f-9267-6c1ccf148a67", "indicator--037a9adb-1718-4658-a369-0d7b0baab1b0", "indicator--869b666b-6550-4e85-9bda-a3c844fb5989", "indicator--977b0367-ed77-4395-932f-75915079f699", "indicator--0e85582b-0c3b-45f9-bc81-293c0b1ad408", "indicator--27f5b52d-48f9-4f34-9720-334bcfc6239d", "indicator--3230b48d-b5ff-4024-a1f9-54464b84253e", "indicator--0939a326-4836-46bb-9abc-f09c0b4845ae", "indicator--90f46f30-072d-4a3f-8a59-4920bd58014f", "indicator--4e9179a6-9afd-443f-a7b1-2dd033e5dbec", "indicator--8319c65f-d0bb-4f2e-91fd-5770d5141efe", "indicator--6627fd0a-c560-4f8c-8205-6c7f63d5b1c7", "indicator--bfa4a739-561b-4058-916e-486cc9ca806d", "indicator--5a2f4686-ea1b-43af-adf1-d697087c4a2d", "indicator--4dacc00b-2a38-44e3-8b16-f1cdbce4a4b9", "indicator--1ba13e10-2b05-4772-a155-6f493006e131", "indicator--d2bdcd5c-9ba4-4b6a-ab10-70b295b24180", "indicator--e0d585f1-003e-4aa6-894b-3c907a45330b", "indicator--fe125228-bf3d-4c6f-a5b8-38395be4569d", "indicator--d8c7c142-85c1-4fa0-b84a-1757cebebe94", "indicator--bc08d5c3-e4c7-482f-b2db-ae7ecad10b65", "indicator--49b248d4-a54c-4d19-9f5e-6a1db5d172ee", "indicator--0de667d0-88f0-4a19-b4b1-fe6c86478f64", "indicator--7a5ba1cb-9a4d-4a49-a5ec-39a7b7eba38a", "indicator--d432ebe8-fb98-4784-8e76-d7832252859c", "indicator--257611fb-276b-4766-adc1-393fc8ee9c48", "indicator--002e5b6e-939c-4e0e-be5b-37a95f5e4d83", "indicator--7544203e-76ec-48f6-9468-ac43a6794f80", "indicator--ff3c02b1-b40d-4e64-a307-d8e1ea36c558", "indicator--c162bcbe-04be-4b1b-91e4-d12f5458d395", "indicator--319f2e91-bd24-458f-81ca-ec43f9d387b3", "indicator--417ae414-b706-45ba-8ce3-375aeeb13427", "indicator--72b26bb8-712d-416b-9879-46598a6c5698", "indicator--bd2fe0cb-a055-46a5-a4ce-ca80f32410d6", "indicator--64bf6d3b-e952-4efb-bde5-74ecdb332dec", "indicator--7c8804a0-de7c-40c8-8e5f-bfa51faee562", "indicator--3ad5733a-dc17-4065-a264-0fd5f312266e", "indicator--d726e27d-fc25-451f-8029-08ef1cf18073", "indicator--301e55b4-73e3-44da-9c10-e0d8d4f781c5", "indicator--95268472-68ba-4855-881f-a442c76e187d", "indicator--64970bb6-16de-4007-8e50-033db3083d4f", "indicator--9b22c21f-012e-4fe0-be66-332e1c6ac8a1", "indicator--c725d272-84c1-4018-8334-33c785c64505", "indicator--afa673b8-251c-4d1f-8b93-3f2ffd5a547b", "indicator--f5bc7796-fbfa-4ded-b295-bcf696730b66", "indicator--78c90222-0c41-460d-a3d7-143c2f060e76", "indicator--6f7cebb3-f435-41be-a981-8bd6529b30e7", "indicator--3ba63d63-6d67-4a50-9d69-b856e77f4de3", "indicator--275f80dc-ef80-407a-bbeb-48eaa43d9578", "indicator--da9b5c64-f473-4f1d-b5e0-8bfa02ed391f", "indicator--fe044227-97b0-43bb-9265-c617b4c0c8bc", "indicator--cb20a752-5a81-4cba-801a-265b91124341", "indicator--f9442c6d-650b-4d0d-bee7-78b068f19500", "indicator--e8e04f90-0c9b-40e3-8a4e-71f5fd188520", "indicator--51080415-b7ec-47c5-bc39-f1d32bc82dc3", "indicator--5f9ed1b3-0a79-46a3-b651-b8440545149c", "indicator--8e098a1e-3146-4221-8503-9dc346ec046a", "indicator--5d1bfce7-8bcf-4c91-af95-2e04726251d9", "indicator--1b650432-b58a-4a5a-862c-37ee87826927", "indicator--3516c4d7-2552-48cc-a9fc-c5d37c7e73b4", "indicator--4f6e3ac7-fdfb-4a1f-af9f-73d39d1507e4", "indicator--53fad511-6709-4477-a504-c170ec70460a", "indicator--2054aa86-0732-4ca3-9576-36aa1f93418b", "indicator--bbea968c-4d3a-4328-a131-d3842e1fd288", "indicator--34012148-44e4-427c-97b2-601ce9c1a437", "indicator--6dab1775-a771-42b1-82bd-51b266192ede", "indicator--e88bec75-8829-4efb-84d4-b26bfb455459", "indicator--8ca615a3-3a24-4be7-aba5-7bbb90658ad6", "indicator--d5acce5d-ea2c-4050-adea-598a789bd8c7", "indicator--8ece4f86-85c4-4945-b2f2-f55783a459bc", "indicator--881e538c-63a8-4f1c-8534-8731279771a8", "indicator--c05db130-1b32-40ac-a40b-b1baa0b32351", "indicator--358cc7f5-6019-49dd-8008-32ddaddd791b", "indicator--f155140f-a298-46fd-92de-36e8e7afb6ec", "indicator--c14fb1d9-3bc8-4bd8-8ca0-8051363d3ee8", "indicator--154aa3f3-a7e6-46ac-a5ba-8ca5d15a24cb", "indicator--54e33369-0034-4eba-8c13-c754ec811aec", "indicator--06104328-80c0-4749-ba2a-30081592631c", "indicator--c0988a46-11a7-41b8-a6fe-3abe21d4d2bb", "indicator--9d5be4d5-195b-4b2a-8dce-5d216d38fa5f", "indicator--726f25f0-3962-4fff-9819-0a67504c8595", "indicator--fa1536fa-d46c-4256-8e57-1df68a081b0e", "indicator--2f1eeac3-1261-4348-a74d-f32c9ccd3e08", "indicator--8a1526c0-7738-4f91-80ff-4307f863f978", "indicator--dd8c0dbf-9bc4-4417-b93c-26378f33730b", "indicator--3bb65455-adf7-4ea4-bd42-ec9c1cb74c9f", "indicator--2616f1fe-4259-4413-8d2c-6d5abd3c5456", "indicator--61f0a1af-9605-44cb-b499-81ca2b5f2c22", "indicator--1f276658-7c12-496d-91a4-b0625fa6c0df", "indicator--de8a1b88-3d50-4a14-bd59-04161fd616c1", "indicator--70ed2cd8-000d-4635-89c9-5709d9ff8cd8", "indicator--fa2ddffd-ffc1-4e81-a7f8-1939004ffc8c", "indicator--8fa1faeb-d16d-4db6-adc9-7c416fcea86d", "indicator--d79ee5b7-026c-4c88-9fad-a40a3ef4610a", "indicator--2c980803-6768-444e-a5ee-911555ce1a28", "indicator--854dda80-3f1b-4ea5-a058-bd56e34c0f17", "indicator--77be6c07-b1bd-4c86-b857-647334917d72", "indicator--bb280676-745a-4cf0-a29f-3e8396503775", "indicator--d0c249d3-2d71-47c9-8304-68cd9700924e", "indicator--c2c16d07-99a4-4b5a-b873-1404723fd2f5", "indicator--bf17b066-3d68-47ed-97ae-fbbc76eb468c", "indicator--86e18e5b-1aed-4266-bdc1-581137a86474", "indicator--2e895c6f-663a-48a1-b75a-d506faa897c9", "indicator--30b73bab-a8c1-480c-8c03-1207a5110b1a", "indicator--c873795d-0500-41b8-81f2-9c25ad411a63", "indicator--080bc6eb-6200-40ba-be26-1ebb16c8aca2", "indicator--1f3748b9-22f7-4611-a7a9-ee97d54d9a2e", "indicator--bed64bfd-7471-4d6e-8994-f4de4c25b42b", "indicator--f9af1f86-3066-47e0-9496-0c1201f98bad", "indicator--0ad86559-030b-49aa-9327-5a988a3fd240", "indicator--688e2ce7-f851-4c17-8342-d05d3b16f958", "indicator--5a312305-d4be-4038-9021-c19bd3dbbd6a", "indicator--82575e73-cc0d-40e0-bbe3-d99af9a6b1ff", "indicator--b7d93c1f-83db-48d6-afdb-5a0e01a78aaa", "indicator--6ef1a397-c208-4120-80c9-3a951b0d3b1b", "indicator--303fd53b-94bb-4a71-8b82-aa270e0f6325", "indicator--617c16d3-1b30-4590-b05c-fc558919b371", "indicator--ad0f093b-9adb-4c51-8460-1bc0e2862275", "indicator--d46e887f-cfc1-4340-a43f-ad89db3d95fe", "indicator--1184c09e-d303-4038-ba45-635611264350", "indicator--dd4d4b42-16bf-4d61-b98f-4d66f4855a98", "indicator--8da9d073-3729-471b-8dc7-0e5bdc6c3a93", "indicator--16e5f508-00f9-472a-ba00-d887ac4769ab", "indicator--38af561e-a0db-43f4-8bbf-246db94f000f", "indicator--b851f73a-d5b3-4220-afd0-adf6f0a8b3a2", "indicator--249d542d-e43e-498d-8d33-df66752b16a3", "indicator--9d335931-2a5b-47ba-80a9-06efc6c48e21", "indicator--0feac671-b6c3-4384-a434-0ee407a5132b", "indicator--033e24e1-1b06-4fd4-9b9b-4d757322e442", "indicator--40e47504-0a3f-4dc2-a7b9-8dc72c8b7973", "indicator--98599d96-4f39-4fd9-938e-c97359e6a65e", "indicator--0ec091a5-56e2-4170-a9bc-ae4947461189", "indicator--84797526-76ff-41dd-b5c6-14ab46adc4aa", "indicator--9a1b6514-fef1-4943-b714-53b9d98f477a", "indicator--56ef7aca-1509-4daa-81ce-35ec4ee86780", "indicator--fa31a5ac-eae8-4616-83e4-c32d743e24d0", "indicator--445d3371-3705-44ef-92ec-394a1fa9ae5e", "indicator--a7bd9f4f-8e4a-479e-b899-d0ea757057c3", "indicator--85094e32-ce6b-4217-9278-775c044814ff", "indicator--1fb44d41-a450-42de-927a-5d1e09a1dbb9", "indicator--e62a19f5-f284-496e-926b-b169f7953e29", "indicator--45554e0d-59cf-493a-9117-054eb679fc8d", "indicator--97da49f2-fdb0-4c79-adc4-d838f5ac84d2", "indicator--6135bc21-7e8b-4d61-aaed-a960f2b9d210", "indicator--549ef6b5-d05b-45bb-8a82-41452760f618", "indicator--ca0d82ea-fca8-407c-8cc2-2c453a60e5b4", "indicator--a4a56f54-2630-44b9-a942-99d643c54ae3", "indicator--247ef457-80a0-4126-846b-5c34db10b612", "indicator--07122956-8970-432d-af88-2d4d72aaef4b", "indicator--f6dca4f2-8593-41bd-93e7-fd23a9a9a05f", "indicator--840d572f-f82f-4477-8673-26e039d73186", "indicator--cdfa4896-5f14-40b0-ac0c-869b0ab7f22d", "indicator--2f0a1eeb-b28f-47f7-8652-6daa38a79669", "indicator--d2dc8c4c-2e28-47d3-9599-1a4eae8e58e5", "indicator--771e4140-2568-4c5f-a35a-b4912c74b47c", "indicator--3df86de5-8fef-4f4d-bf7b-213abdc80fde", "indicator--26ae6deb-425a-498e-b41d-93c9e61c20b5", "indicator--a06a0b44-686b-4b6b-90a2-08b4755b7f48", "indicator--25614578-4c32-4c96-8286-2f2bf1b5f1d0", "indicator--2d80dc3f-5fc8-4b77-bb9b-83ee9e03ad1e", "indicator--45d2159a-6526-4d46-90d4-f70418ecead3", "indicator--941d26c8-ebc4-456a-a95c-d6ef5dfea25d", "indicator--d1e0082e-b1ae-45ea-840e-97f9366ed892", "indicator--c005caaa-1729-4b9d-8b69-09ede26828db", "indicator--050ac85c-92e2-418b-ad3f-40c57ae4cfd5", "indicator--f3a611f2-af73-40d7-a241-f57dc944dc27", "indicator--85fee3eb-88ad-47b1-8188-a6853c3fe11d", "indicator--1431e4fe-e068-47a1-a8ef-049e84d757d8", "indicator--2e494ad7-6e74-42dc-ba9e-0304ed53fdea", "indicator--feee5700-b74c-4c28-9586-345c19d70f6f", "indicator--910291d6-eba5-42cd-9efe-30452c3c55aa", "indicator--1f06c3a1-7a04-43f9-9082-af5210fda6f3", "indicator--6977d31f-a882-4d06-901b-2753b99caa56", "indicator--1969a618-0134-4589-bd0c-a5841c6cf68d", "indicator--fa62b2d6-4be3-4888-9850-9ca4262e9f5c", "indicator--4f07af25-c8c7-4ba5-b909-c38daa4cf2df", "indicator--ee2c6af3-5dba-402b-a8c2-530baf5c960b", "indicator--1297c9a6-d510-451b-bbcc-d63066054ff5", "indicator--917e7e1b-4f83-48f1-ad27-7ff79bdbc322", "indicator--1dad6778-1386-445f-9453-81f53963f828", "indicator--6d89ebcb-4dbe-49d1-bc78-8715c56df826", "indicator--e04dec67-303c-4d98-97a1-3e4a3266b5a9", "indicator--f5b2aad5-af8a-47d3-8b5a-130531a88234", "indicator--6bd51134-ec3e-48cf-8505-1c14aaf99eab", "indicator--f5ee9eca-d65b-484b-9cd8-2cf935110e75", "indicator--33b6c3d8-bb9e-4796-92dc-cae490414f87", "indicator--e26a50d4-a4e7-4ab3-8580-7b6742abc6f6", "indicator--14e0ecc4-88bb-445e-a5ea-bbfd16c96859", "indicator--3a6e2307-3ee0-476f-9149-6054eed30b22", "indicator--30ef0f1d-a1b4-4d12-b115-a362ee648006", "indicator--ed826b1d-d12c-4139-8fe9-54a127890b1f", "indicator--f05d922f-6f87-457d-8601-f4530999eed7", "indicator--1a677fb7-1af6-468c-bb9d-aa38f4cb9283", "indicator--9df91021-c29b-4043-80ea-9488d86f0124", "indicator--0cf403f5-518a-4c36-89bc-1aaac84fda97", "indicator--49e360c9-8cb9-4acc-8d9c-2042ccb9e524", "indicator--d805584b-8ca0-486f-9bfb-587f97a9af3f", "indicator--9ce05063-36dd-4fbb-a102-70b756d178a8", "indicator--83122efb-214a-4952-8619-c9334291df3c", "indicator--3dbbc355-4e98-43c8-9240-5e493ecc7a66", "indicator--9897135d-4038-4489-b3b5-8751891bd8a0", "indicator--8f6ad00e-0082-4f47-af14-49e36d741ccc", "indicator--067703b0-0c29-4f8e-92f4-48b564785a6c", "indicator--f605b90c-b2b9-48a0-8479-42eb2a97752d", "indicator--9fc861fa-e002-4d1e-bd6c-b3f6616c3e50", "indicator--8d011b84-7c2f-4748-ac7b-14da7d0a17c6", "indicator--0db53832-717e-4a77-9ca5-3a1978037147", "indicator--f6a8dac5-83e5-47f9-9d55-4271d2b060b3", "indicator--f1baeff9-ef6e-4f87-a2f3-028ca2e40e8b", "indicator--16119b93-cd93-4ed9-a92d-3c475513a226", "indicator--d6e6fbf3-0511-42f2-a994-fc3990efb22e", "indicator--3f30397d-b4b7-457b-a5d6-7512fa2fb9e2", "indicator--003a5c9c-34af-4513-abbc-a1be73f47fb4", "indicator--df5e2454-55ea-4cd1-8289-cf8f33ebc110", "indicator--86c44e9a-cff7-44ca-b581-47453762b6cc", "indicator--d955fa21-4b87-4eac-adc5-26185fb3373c", "indicator--e7ccd32c-6b29-4221-8f9f-33cf49f6749b", "indicator--041a9945-4d92-4136-ac38-eb0d88dd3fa5", "indicator--44f9d190-1b26-4493-9f0f-76e7ed8382e2", "indicator--a6a46187-13ee-4105-bd53-ec1953a91d74", "indicator--b06ba918-ef26-4d18-a5a1-45887c823726", "indicator--8610be62-fc2c-4b7f-ac48-3e25971abfd8", "indicator--0bf00579-6574-4778-8caa-20115cc59126", "indicator--0a9ce0e8-6514-454d-8918-7cf41ee0b22d", "indicator--7d98445d-6bac-4495-9b5b-fbad210b8a07", "indicator--cac8f436-4fb0-4fef-8d17-38d65a498cf7", "indicator--b9962984-74d1-4b71-a34d-919c57955e75", "indicator--53e14ff0-bbe9-4590-8c3a-7247d436b5ee", "indicator--2e3ebd89-2dd5-4c8c-b94d-4584ba07c419", "indicator--b64a65e2-0ff0-4733-b662-5ba89306d565", "indicator--5362271f-49ab-4474-a2b7-da5d094d73d5", "indicator--d2281d89-a183-413b-bb5c-cc99783ece16", "indicator--a1845788-1a5c-4346-9a46-19b12dca1fc8", "indicator--2ed6bb11-fe1c-45b1-b90c-1bf8cdc34b65", "indicator--d6b289de-e28b-4b1a-b0d1-23a062fcee40", "indicator--f5dcdfc4-be84-4bfc-9dbc-82bc8d2e8c8d", "indicator--82a852de-4eeb-46c2-82ca-7c8c10083454", "indicator--eb228582-a508-46e1-b8db-e45953f6a806", "indicator--e08b224d-6583-4780-9c50-8e0e60d3dc32", "indicator--1f10a35e-9d49-4ebf-a43f-18c737bad7b7", "indicator--ef29844e-da9c-4be5-876b-26b9c483c3d0", "indicator--c12c26c2-b4dd-4420-b893-18e41aa9e951", "indicator--edb96c6c-2235-4707-9d13-85682edd364a", "indicator--4b874ca6-34e2-4049-b470-646f7146125f", "indicator--383a432c-9977-4c5f-b218-17a84947a9f9", "indicator--a18e0e21-1402-45ac-a957-b97048ff4aad", "indicator--71fa3cdc-0d06-48b8-97b8-f46d4abdd2b4", "indicator--84fa30ce-bb53-48f0-a907-b879ea139e71", "indicator--73a56906-4744-4b67-b4c8-f881d7bba0d6", "indicator--cf40cfed-6189-461f-8aa0-11fead06e0bd", "indicator--6efbb0b5-e68b-4233-a6e2-37691aa582a3", "indicator--067fe6c6-e3bc-4edc-ba9a-d76a09981fb3", "indicator--537a656c-3fd0-40f8-8207-5c916af363b0", "indicator--41243874-5876-4cbb-b36b-896a16d1a27f", "indicator--2310d97c-385a-427b-a3d3-42c088ce03ce", "indicator--4a233d54-579e-414f-9936-824c4bf79d09", "indicator--cd9964c7-1439-4590-a6ed-1a7fc38f1012", "indicator--a2d81a11-11c4-42f6-8d44-8b5a7f32ec83", "indicator--a3344382-f64c-4207-ac66-fd8fad7f0a21", "indicator--3294841c-93fd-42f9-a29e-c07d30741477", "indicator--a439d08d-ce51-4c7f-9597-a8af2ce5dfd9", "indicator--9f4ad67a-fa7f-489a-a835-3caf4c503b66", "indicator--b4a421e8-56b5-471a-b08d-87cb48624d5f", "indicator--561ef2ff-443d-4713-b6c9-45daec635cd9", "indicator--2f4f0f42-a66e-4cdd-bf90-ff67340ac694", "indicator--13bc894a-0342-43fd-bf06-a3b6d9843f2a", "indicator--8e09c3b6-d122-45ac-9da6-3dec01187649", "indicator--29b567ed-13c1-41b4-aa0c-7c929e37714c", "indicator--6a792c31-aa81-4ff5-9b4d-135c31b4e6c1", "indicator--1c23d17e-b6ef-470d-bfde-1ecf60a7625a", "indicator--c721f16a-36b3-433a-a715-b3b8f4b84bef", "indicator--5abeafcf-8995-4809-937d-0cfa6d402cb9", "indicator--74b0659d-9616-4332-a8f9-bcbdf75c0197", "indicator--02fff4b6-9418-43ca-b6bd-7dd0eccb45b3", "indicator--534064f7-e9af-4fb1-9be8-5b5e6eda0c5d", "indicator--ef2d9dbf-5aff-437f-8387-fe614518453f", "indicator--eba14dec-cac1-4f71-b753-94eb3f4b9cc1", "indicator--ebb1309e-9bf2-4844-9578-03d63e5c5753", "indicator--e9af9c8e-aa09-40d9-884b-73a06e75c7ba", "indicator--bde6b93b-d4ac-4edb-aca8-ccef33000e30", "indicator--787e0a3b-b39f-40c2-ae1b-add007bbd6bb", "indicator--ce7bf1c9-b083-4246-8df7-c05b40d02450", "indicator--6b3cd962-6486-4f2d-9f10-507bd8f55ac0", "indicator--0563e928-91e6-45fc-940b-ed6b87c2e96c", "indicator--06d6ad58-79f6-415b-a306-b7396d969a7d", "indicator--3342c5a8-5c51-4ca8-b1a1-201634037906", "indicator--766b71f5-4f52-4f3e-80eb-8bfb6872f8c9", "indicator--58041715-44d1-4882-a893-eb554154f8a9", "indicator--0c3a9a1b-d7c4-4278-9ca6-84e248258e38", "indicator--6dfd9636-fae2-4568-8a5e-4fd2be7d4e2d", "indicator--0861d00a-6e10-43a3-9bc4-4a5b26c6468f", "indicator--2a3abfdb-62b8-46cb-bdae-d44a59876325", "indicator--893afcc7-a84b-4c32-9bd5-1d807810392c", "indicator--9e42e6ca-c0d0-42aa-8458-f2d73b596dfa", "indicator--d8d3e0d5-7465-46ab-ab4c-7e7b62d60ed4", "indicator--e43404e1-6bba-469e-8fd6-78e7c16a6b92", "indicator--1880c082-44db-4fd9-8e07-5090e2666553", "indicator--d0c83e25-048a-4f10-b07d-ae76c7fafe58", "indicator--e4ee5b3d-fcca-4f27-a177-92b5b49b297d", "indicator--3acd0c8d-5fe9-4c3a-8e3c-0a241dd603a0", "indicator--fce39bf8-99c8-4795-89ff-8d9cc37dca54", "indicator--98aaab45-15dc-41e2-b4a1-ea997fd83451", "indicator--67fc2994-fa31-45a9-9c66-473d11e45a83", "indicator--2624f98f-bd21-4782-be2c-60d65c30f1ea", "indicator--b2591a68-967c-4c65-bab1-cfc19311bf84", "indicator--5923569e-da66-45c7-8096-dfa7b54521c2", "indicator--3374ce75-9970-41cc-ade5-92d161cbb8e6", "indicator--03731f57-27ec-4a7f-a631-070e54596294", "indicator--a2d2178b-85a4-470b-aeb9-e79e72b84cbc", "indicator--0ee3d7b4-6acb-4d65-8c79-2bc3b5286931", "indicator--13a256f5-1314-4ea9-98db-3916831d6cca", "indicator--2b08da49-541e-4320-8db7-fb2badeafb63", "indicator--040c8f9f-16c4-44b1-a1ad-54684629142f", "indicator--be3883a0-81b1-4717-9c9c-6f840c8d08a1", "indicator--81249da9-48d9-43f4-84ab-9715f732106a", "indicator--b85baab6-85ed-4d4b-89eb-4c7b52beb7a7", "indicator--0585bf15-d541-40b6-92ec-957886914bb9", "indicator--1145ef6a-d3bd-415d-a465-8cde1425574e", "indicator--fa48c0dc-41ed-485f-a8c5-9d21b639e355", "indicator--182b76ae-9dc7-465b-a7d8-9deaa1cbde38", "indicator--97154995-f1ea-4a52-9f5f-6bf00c2b8151", "indicator--0c6d8125-d684-4964-8885-12513c07f7f2", "indicator--d6619efc-6520-43a9-82c5-a8bea3d687eb", "indicator--12ec1ffc-7833-4422-9fa3-b0e76597376f", "indicator--c573a998-8b4e-46f4-b423-0cc027452eda", "indicator--bdb15d78-0ec1-42fd-bcd3-6c0cd5228d48", "indicator--77a18766-0ca5-4afb-9ae9-1730b3dd7c7a", "indicator--6b53d6a4-15d7-42a2-a5d8-2c5cb2c634c9", "indicator--9152cd82-fd8a-4c17-8676-d9e22593f32b", "indicator--f73555dc-3afa-44ab-9e5c-33396a1ce339", "indicator--188406db-6fac-4a4d-a2ec-b8401826bfbe", "indicator--fd840640-482c-40ae-aafd-ddc5f3ddf53e", "indicator--33a0adc8-5a8f-488d-a49e-7e6d4a0de86e", "indicator--cf69c09e-6339-4ba8-9d6c-2e88a0caa7de", "indicator--23509097-3ba2-4ac1-9c1a-59a2d10edde5", "indicator--2994d02a-1b8e-48b8-84ed-9651f3650401", "indicator--a68d2c83-65de-4565-8930-392178b704ec", "indicator--41eed1c4-7200-4033-ba5f-de16d7eddc9e", "indicator--fe88e856-2767-4982-a2a3-f8204a55cd97", "indicator--27146e4f-8bc1-4c8a-abd8-ba6b7a2fcb44", "indicator--2f5a07b3-1261-4bc3-a1e5-1ffabe011119", "indicator--59fbab07-0e68-4d5e-9918-a537447533d1", "indicator--07d33ec8-bb70-4dfe-bdf7-4bed73a521c5", "indicator--129dc67e-5e75-45d1-b28d-f627298bf99e", "indicator--4de0617e-98aa-42c1-967c-a5d4e429e9fd", "indicator--7d76c129-b603-4230-9143-5cadadb95f7f", "indicator--4782bf2a-a862-4f72-a8f0-e6316d93c31a", "indicator--461a2bcb-354e-4a25-a7d8-fb8ee27362ec", "indicator--74c1a0a6-70c6-4f72-a061-938b4ee4f90c", "indicator--2220c3e8-e405-4afe-b4c3-fa4992c54538", "indicator--3d29301b-ca20-425b-83f5-99a705baa956", "indicator--9009e5a9-05fd-4fcb-8222-4842187001ec", "indicator--e0b693ef-9650-481b-aa1c-eade18773fcc", "indicator--152703a2-dfcb-41ff-a07b-8f0d2d81fe7e", "indicator--3dcf68da-0eac-4786-bc3c-ee8a0886f8b8", "indicator--8f88aa02-e33d-4ac7-a7ab-2ca8d41742ee", "indicator--b5470c4a-3720-473f-a436-4544e33c3fe7", "indicator--e997c6fc-c85d-4039-88d8-f3c6d9cf974c", "indicator--1d53531e-4aee-4b4a-98c3-db16e659632a", "indicator--6b784469-e993-480b-a8ca-51c81a6a13db", "indicator--a675be4c-b013-458d-b4aa-c3bc86aca923", "indicator--c473b92b-0ee0-4a01-be1e-3a83fcd5054d", "indicator--0cc37c4d-d167-4e98-a95a-775e4ac48dc1", "indicator--e5c68095-5723-4679-9a6c-49a2f77c0dc8", "indicator--5b590cd4-2a39-4cef-ad8b-303a491d6cdd", "indicator--da1ac49a-797c-43cf-bc2e-b08c7bc9516c", "indicator--286e4e0a-52f6-4030-aede-5db2dc16e24e", "indicator--ef93c956-0373-49e5-8837-47a9a18aaa4f", "indicator--5bf46631-23b2-465c-b863-79ff6915a8ae", "indicator--cffec1e1-b6f3-4320-bb65-be83673b6c00", "indicator--ca8fe609-464d-40ee-827a-9a83b5f3d8d4", "indicator--d5fc262d-49b9-46d5-8c19-80584343d4ae", "indicator--346ba0a7-b2b9-4abe-a39c-b05c3a66b904", "indicator--e8b93afa-1bf6-46c4-a8a6-3761f3a93828", "indicator--5bd28d42-9084-40af-9d56-cc9dc3fe5ced", "indicator--e7a53438-438f-4b61-bcee-662d937227b2", "indicator--9112e9c7-fcee-4d47-900a-23cd2d92be20", "indicator--03fc7017-329c-4c31-a8b4-9c6698e663b2", "indicator--b5336a65-9f93-429b-bb56-af371701d5e6", "indicator--c642f240-c8d7-41ea-8203-ed5ebbb7048c", "indicator--5bc4e5e3-7dbe-4a19-b5ec-dfdd30a44453", "indicator--2a4c8a8a-0686-4a97-a12f-9c071082a54d", "indicator--6e7f7871-7320-4643-87c7-5b962d426ab3", "indicator--9ecffac9-1565-48d1-8bc0-cc64378e9c6b", "indicator--5002d195-a732-41af-bb88-978b2a91a117", "indicator--5cdbca27-c13e-429c-90af-f9fbf3fba783", "indicator--521dad83-fc55-4aed-abc6-81048d9b9958", "indicator--2eeec665-84a7-4c9d-a32f-4b901e0b861a", "indicator--f902d093-e732-4c0d-8416-373b8016a0a1", "indicator--a079f4d9-1b50-47e1-9bed-b80ede1c5035", "indicator--89e4895d-4011-4409-beca-0b5f039f01ab", "indicator--457f9b7c-1533-4101-92bd-7d2e6eb8c950", "indicator--4e59dcd7-4d5e-44f5-8876-f7d1626c2010", "indicator--45a3c58a-1976-4496-bf59-cd13910accc4", "indicator--cf0bbcc3-774d-4668-b83f-80304b05c663", "indicator--d7c4a8ec-4bea-4671-bfc5-90663803d3db", "indicator--6624f70f-14fb-427c-8a40-b75b59c923ae", "indicator--c05ae1a1-6f32-452c-a494-67e17dae90cd", "indicator--d95042b1-304d-44b4-ac3f-e0e0bc08138a", "indicator--cb4167a5-ca1c-4061-a35d-1710872adb1f", "indicator--7208aa59-9f8c-4340-ba73-3b8f4080be8b", "indicator--1095814d-0b70-4db7-9355-d19984bddfe5", "indicator--0b9500be-fc02-4f61-8ef4-70ee8f3861d2", "indicator--b30fa78a-d98e-477b-9a49-ffce3ca8f0e1", "indicator--29e92f91-51f0-4111-a587-954c623ead23", "indicator--c384c53c-0b72-4ef6-b3ea-3953f126b028", "indicator--d3b84a75-b188-45e4-8f86-d5d158508f3a", "indicator--00363852-d685-4de4-bbf6-27b1b8d366cb", "indicator--40214543-5725-4f28-8de4-c7fc2d40ab3d", "indicator--355e846c-1471-45a8-b970-7f61c0974b54", "indicator--9fe99b7e-1cec-4c5d-9ddd-2c837b169fe5", "indicator--59fd3212-0890-432e-9e8b-34c6a151ba3a", "indicator--6db78fe9-dbc3-404b-93d6-662d02288c10", "indicator--99eaf376-ba80-4efa-acef-40343e6c3a35", "indicator--4b69b272-483c-4191-8f74-2069069487b3", "indicator--07562aae-6d7e-4dab-b465-fcf06827b268", "indicator--321ccc6d-5dca-4a3c-923e-06ae4712e300", "indicator--e35a4bfa-baf0-415d-902d-25f3b81691ef", "indicator--8060830e-3a7e-492f-bacf-7c5d58e1b6fd", "indicator--dcacaacb-5386-400f-9da5-6501e99aecfe", "indicator--24b1e6ad-0a44-4c5d-8245-b4ecb2eaee64", "indicator--4b6e86eb-2416-4b3e-a583-09bb80477f82", "indicator--e64d3e12-d7b2-4f8b-8748-4ad0cb484faf", "indicator--c5aa16e6-ffde-4509-9d1f-d0b595316033", "indicator--a8cf59e5-3724-45a8-9ea6-d13e997339f1", "indicator--987c877f-7345-4f13-b10c-265923de99c4", "indicator--ab7746b5-8be9-4102-ade0-cdfee19dfdd1", "indicator--1d3d6b53-9c01-4c47-a030-20afdeb90556", "indicator--940cc451-cef8-4cab-974e-bd95c73b64f0", "indicator--8c989230-e844-45b2-bd7b-c3a7809d162c", "indicator--8a10957d-11a2-4223-8db7-784196bb1896", "indicator--d5e71f57-11e5-426d-975a-50fbe7f766c4", "indicator--a1ff2091-6987-4d31-aaa9-0cdb9455f5ac", "indicator--f165bb5e-1513-45e0-8a67-34ff36192821", "indicator--95c4dd05-dd31-43c0-95da-5eaa5981493c", "indicator--d3accba4-28b1-4c50-9d3b-a5dd28f0508a", "indicator--6ab8dfd6-ee5f-43f1-a80c-0de798be3d68", "indicator--62e3d7cd-78c2-4b39-9aca-cd0d16f37578", "indicator--3a109c36-2db1-48ae-b4c8-081db08dc213", "indicator--9a652f27-8f69-4ef6-8faf-b79214910247", "indicator--91711d26-df49-41f7-a86f-2ee0452baa09", "indicator--9743c628-12bd-49b8-9924-fbb12ac9f3c1", "indicator--3c149b10-0e62-4207-b2ac-57088f34c9c2", "indicator--3f5d8ee7-336e-4ef2-b894-43f018179c1d", "indicator--dfc6fe97-6891-474e-ab64-6c6a7d9609e6", "indicator--3bb22698-4f2c-415b-8708-702c72eca409", "indicator--46a09507-7c6f-4af8-9fde-3855973e1cf7", "indicator--de1cdd8b-68ef-4b9e-8568-4c0370d6e428", "indicator--407d5938-c896-4d63-8049-60a1019daf29", "indicator--66bcb84f-0b17-488c-bf63-54db42218b89", "indicator--612a541d-99c6-4f84-98a9-4749f1a529e4", "indicator--0c73a590-2830-4aa8-8ad1-90f5d06df30b", "indicator--bbe4b31b-6547-47f6-b207-154bb86f54e6", "indicator--89f3b7af-d56f-4000-97c2-b69b2715e06a", "indicator--7d419c07-eb93-4c07-a255-28882a77c77a", "indicator--d105a93e-f6d9-4e04-9488-3025d7f6ac5e", "indicator--cc62130f-2701-4446-a277-b899f9d43ead", "indicator--137123aa-b63b-47e2-867f-6827f93bbe6a", "indicator--5cb689b4-89be-45da-b829-c3314bd2d82b", "indicator--6689159b-7e47-4099-9939-e516c9b91aec", "indicator--1d361102-332d-4af2-ad46-3104a37ff4b3", "indicator--3093950d-ff79-4690-9c14-5587e304a7eb", "indicator--8698fa65-b33e-44c6-a581-8179edbcfa0f", "indicator--1446c9cf-9f4a-4099-bd55-b5c6dc30a316", "indicator--5476d9bf-dbc8-449c-9947-9bfec95556aa", "indicator--705000d9-b656-4a0b-ad01-9e5f95559490", "indicator--71dce0de-df00-4680-9218-7385349b67cb", "indicator--2c6c298d-50b7-4da9-ac14-00abeb63620a", "indicator--a0e298d5-4198-4274-92d6-333b3a90d07a", "indicator--01a000f8-2e57-4e3a-8b3e-47aab6d04852", "indicator--e4c1ad4e-24b9-47ad-b242-cd4efd69d41c", "indicator--97e5e64f-7313-44d9-9782-0c1df44ee7f5", "indicator--d010cb5a-a0b1-40a7-ac86-096be18d721f", "indicator--cc6e59e3-5291-488d-946f-95b34aa1b69a", "indicator--2150ca8d-563d-4b6b-95eb-220ca7c7e60d", "indicator--fa72fd24-c544-439d-b818-91a854e5d64f", "indicator--e0594736-8cd0-41ff-b5df-93698008cd1f", "indicator--3cf21e14-29a7-43f6-ab7b-ad72820a5806", "indicator--26266c88-53be-44ad-96ef-2eb02380c200", "indicator--bfcdc257-231b-4272-82e5-77788b73fbbc", "indicator--19ea5fd9-cd57-4a84-83d4-4c06ce937a09", "indicator--91ca8d99-5e5e-4ccd-9603-d81abd6db7b8", "indicator--bc6a8e5d-b4c6-432d-97be-0e7e14544295", "indicator--703b74f7-bcdc-4da6-b31e-49745e053ba6", "indicator--e32c6576-a339-4cc5-bae7-a212238c0e44", "indicator--0241771a-ecf2-4cab-a04c-fb3c148854a4", "indicator--c432a5d4-0eda-4105-97c0-dfb68447932a", "indicator--c6c4afec-4c80-48e2-be46-407918a52f4d", "indicator--0573f73f-ffe7-4514-bd1d-0175f9cea6c0", "indicator--96a14b38-af73-41e5-9bad-4a2c890e324b", "indicator--dcb990f7-736b-45e3-b86d-e5a0c022a794", "indicator--dc44a394-95ae-4c03-ba6b-dc0701312c42", "indicator--57bc8647-669e-4b4a-a104-aac4895b9ad8", "indicator--25ed4d50-c9b5-4940-9ea3-973d1f5de0b4", "indicator--672a61f7-e5c4-4b65-be0b-2f301b9c754d", "indicator--d1777de4-ef47-412c-857b-f2df526a64df", "indicator--4762155f-8689-4bb5-adc8-b53579462a83", "indicator--25944f2d-a961-4827-bf67-aa011f14c906", "indicator--b7b9da39-3246-4de4-95e0-4d4b9a295666", "indicator--9742bc69-1b1f-460b-94ed-d2b83e9c0433", "indicator--5cfcc585-7f1f-4257-9b31-928e32fab88e", "indicator--9b1f1d06-c9ea-4d5b-92fa-85e1609f8390", "indicator--0d74deb8-4a09-4dd5-9ce7-e77871ef5449", "indicator--bafb640e-0a62-4bec-a7cc-bfbd75a9fae4", "indicator--f5168e14-71ea-4e33-abdd-417e517bdf01", "indicator--5b63f39f-f622-41dd-a4a1-d94d833f98e3", "indicator--772d9410-e6f7-413c-92f3-567d9c729c46", "indicator--01443d27-20fc-472d-9c93-b8d380420d2a", "indicator--e18806a1-851a-468d-b519-8a1e30e4951c", "indicator--e409e279-7d47-4209-a391-35b73ee79737", "indicator--a9ebf7f5-16d3-488c-9b21-779ba4c85265", "indicator--4a6b4e05-69dd-457b-9dd1-f46580afb173", "indicator--0d017793-9511-42fb-b528-2e9a2a9f3cb5", "indicator--d7b5822a-6c05-41c9-9d8d-e4758fa6a7a4", "indicator--6685a25f-0459-4b8b-9115-cf15bbb3759f", "indicator--e7ae619b-0840-4d98-9b6f-a65282364920", "indicator--4e724aec-58d4-43aa-b4b4-43cd17df61fa", "indicator--ad84c5f4-7c80-4f5c-a42d-a09a057df0cd", "indicator--d71b22d2-8d2d-4f84-ac28-29c9b8cb916c", "indicator--344127d1-9c4d-490e-b364-e7ba35d2947a", "indicator--1d7f4fe9-81f9-4e1e-8df3-70baf14ae9ad", "indicator--40a37d86-df9b-4966-af41-c0ffc94b31e2", "indicator--4db394d5-cce6-4693-8ec3-4fed039f01d8", "indicator--8620f7e1-5362-4be3-969b-f0b3f6658abc", "indicator--fae489af-9ad0-465c-a81a-9f3f6ae2b4bb", "indicator--0b2601ed-957c-4dc5-89f2-a3e5f39738cc", "indicator--f8dd980e-b54b-466a-829b-2fdce073894b", "indicator--c9ccf742-90a2-469c-9471-1c13760ab493", "indicator--b318da0a-41b6-458c-befb-fd9d6e6ee242", "indicator--3407ea7f-ae81-47cc-ae52-401afc2a66b2", "indicator--3d71ae09-3bdb-4d08-8ce7-07b5fc016f52", "indicator--ea5a2e0c-9433-4cb8-96a3-027f26b2cd66", "indicator--8154aecf-a20f-4dc1-8df3-45464ebe3b2e", "indicator--bc95ef00-652e-47e3-98eb-313dfcffb8e8", "indicator--7ce93c30-df27-4033-a178-b9e7e8c5e351", "indicator--3fb7c8d4-7179-4499-9d98-b7a9503c4e97", "indicator--23cb29ba-da36-4231-b22e-40164c836158", "indicator--0d39d42d-6694-408d-b77a-c73d3c3b169c", "indicator--476c0227-14cd-40ba-81bc-18235d6c49d1", "indicator--7ca451f2-e050-4d8f-9b10-699110412b93", "indicator--a5abe533-ed4b-4d8f-8d59-e7d59cfb77cc", "indicator--b425d6c4-8983-4fb9-8364-2cf7464d805c", "indicator--58d42271-de1f-49a6-aadf-a22a34408234", "indicator--9a014c92-4801-4b3c-9d27-7d181a4b8777", "indicator--cd33fd48-813e-4141-91ba-8e24cc02aa1c", "indicator--e48d569c-8472-48a1-ac67-593ea8ba053d", "indicator--3548506f-c122-4256-a85c-4f34c94ae48f", "indicator--feac29eb-eeaa-48eb-9fe9-f8f726ee1f8c", "indicator--f60ec18d-e623-4c8c-9f4d-a372f4a67931", "indicator--3b95938b-6742-40b9-b3f6-bb4a7f27debf", "indicator--92b80626-6510-4e87-90fd-ed9e0f1bf31e", "indicator--ce6b4feb-0bbd-46d5-9aac-967878fd5eb2", "indicator--5580824a-0507-45cf-a8c4-0f38f419d199", "indicator--07cc5fd0-a6e2-451d-a0a2-671be74cb686", "indicator--8f83c5e3-df10-4d42-8999-3ef833676ed0", "indicator--02b20ff4-c188-49d1-ba68-a90c865f924e", "indicator--9754631b-1a09-4716-a8ce-a46613c35d9d", "indicator--91122a14-ba09-4bc3-956b-a2c01be878e0", "indicator--a5f4a4f6-5f44-4c4f-a32b-6f2f8d426dc9", "indicator--242955ef-9192-48bb-a845-032070525479", "indicator--e773d80c-7835-4bdb-b6f7-c5d28e1cc541", "indicator--5036ce4e-b0f7-454f-8dae-d3b0e492b685", "indicator--0dfb222a-3821-4b45-8f70-4afbad5f8969", "indicator--901c4d31-2e97-43d1-a59d-fbb403bef9b6", "indicator--809543d5-6b0b-4a9c-9d81-1fa735008317", "indicator--dd021962-b926-42ef-8acf-5bb9c2c9ec54", "indicator--e5c3d1b4-5824-468f-a853-89095e4a039e", "indicator--a48b9601-ed5c-4207-89c8-57be39def829", "indicator--dd0a838b-ce60-438f-968e-5078a4e5e307", "indicator--4554145c-9fba-4585-a437-194119590cb7", "indicator--7fdb109c-744d-4409-8a88-9ef915c78b98", "indicator--45cb2c73-e26f-49a0-89fa-0c504a641e6b", "indicator--b1a61a27-38f6-4fed-af5b-6361865b8adb", "indicator--059e22d7-22b9-4d48-bb07-063a2e33f48f", "indicator--765d8d0a-3d0c-4193-9dcd-36efc7634dec", "indicator--2e31c6ab-7255-4068-9b47-d7b63b8975a6", "indicator--a6b5189e-d173-46a6-b33a-cdc277e4f7e0", "indicator--15c0c5cc-0a66-4b20-8743-1532237078f0", "indicator--99dc3f45-6ed0-473b-b41d-712be6f31eef", "indicator--ad64cea1-101f-407d-96e1-fa6193ff0cf5", "indicator--86de05d4-3e0f-4f2f-b7fb-1c75f60876e5", "indicator--f66350c8-e474-452d-8db5-8e9b5176b4c8", "indicator--2910229a-7c43-4fdb-a19a-7e74e44716dd", "indicator--82798cb5-839a-4fe2-9ba0-1bb621f1963b", "indicator--29bfef9e-b7aa-41e6-9853-136ae27c55de", "indicator--de77317d-dea0-40e4-b044-76ef219e8c49", "indicator--92f40a84-8530-434b-a34f-9d627fdd2634", "indicator--3518113d-a78c-4d03-a8c0-b98626edd2b0", "indicator--e48677a6-0a5c-42bc-aafa-bea05e6bc800", "indicator--c8ab4eca-7681-4efc-86bf-f20d816f4698", "indicator--4c61789e-412e-4e15-80ae-391179576327", "indicator--5afe67cb-be05-4128-a211-13f149371bb9", "indicator--32e2212f-5aae-4101-8cfd-8276e189fa57", "indicator--1c57f029-b20e-4710-8db9-745f302af6e8", "indicator--2246a31b-6ea2-4004-8c06-28fb6709f573", "indicator--e6c17976-0473-48fe-9a31-a1b84e5d27ae", "indicator--fe4076b5-9644-47a4-88f0-995faa7062ac", "indicator--a83ecb74-81b9-4989-a27c-431df7bd319c", "indicator--57080c5e-711f-4753-9a85-363594d8a976", "indicator--c1921005-d77c-4fcc-896d-c3caef94e3b1", "indicator--5849a4ac-bcf9-476e-8fdd-da3a259ad13e", "indicator--86f4ce75-1be6-4e45-a14c-31155158d1d4", "indicator--43444bdf-47a2-45cd-a665-b4a32ae854ed", "indicator--1077cd7b-68de-4f8e-9f0f-4fefc885ac1d", "indicator--ce5f1d47-c01b-4bd0-b7b5-ab025c083308", "indicator--9e7610eb-427b-4cbb-95b8-48281d3671c0", "indicator--3fb9110d-b39a-4908-989d-d736b93412e8", "indicator--ccb48058-fecb-40b3-ae07-9ec62ec412f1", "indicator--18a19b42-ba42-43a2-a950-2e73071d37cf", "indicator--e2ae9af6-b993-45a0-9b8b-c34a5688b3d5", "indicator--12d2c04a-5515-49c1-b162-f2a01ae1aa25", "indicator--7c6ca461-aad5-4ac9-92ff-100cb9740540", "indicator--91aba376-02bc-4b4c-9d8b-691e0fdc6444", "indicator--5041f0e5-d58f-4f8e-bd33-a6e6e9adfd94", "indicator--ce8ad206-b571-4d9a-80ea-53d65a564f44", "indicator--a6ddc985-8082-418e-8a39-509748cda39e", "indicator--9f52179a-894c-4b9a-89ca-db7fe14efb26", "indicator--25b28a50-ce87-4bd7-ba4d-06a315708928", "indicator--a26f3072-558a-45d5-9f71-16610308172b", "indicator--03e6d31c-7fb8-4d33-8a96-b9760ac8ecad", "indicator--1d07e022-ee46-4e39-8c5e-489990b69cc4", "indicator--648efea7-c080-4e5a-930e-516d01c0d467", "indicator--3b1b93e1-f8c5-421d-90a8-712404983291", "indicator--a5beb425-05af-4e51-b2cd-46bfdffe50f0", "indicator--c8b20086-0f1f-42fd-b35c-1663dc122f11", "indicator--a3910bbb-3dca-4160-80ea-2ec6dbecc909", "indicator--3afd075c-b373-4aa6-911b-4901b427e3ff", "indicator--204aa8e6-05d6-4c6c-bc82-29bf15cc9061", "indicator--db101f78-92d9-4a96-a4a6-48900ea46ca0", "indicator--f1d1647a-6f55-4970-a448-90c162ceca13", "indicator--4ba8f7a4-4e87-462c-bdf3-e2c55da41c46", "indicator--dc080659-1d93-421b-8005-da276ba3a749", "indicator--03dfcffa-c5a7-42df-b7da-3076f253f0cb", "indicator--62c9ef10-370c-4dda-a360-aec839d88029", "indicator--86e5f9f4-de7c-4662-9a5c-3eb99450d67e", "indicator--c1d04a66-1b7c-491a-86af-6406f84f34b7", "indicator--186078a8-6705-4e77-9b5a-3da204902c26", "indicator--68e01a62-cadf-4e08-858c-d8c083b99c3a", "indicator--75b31357-697c-4864-a262-e0c2d6dc5998", "indicator--12a56fe6-b9f0-47dd-b5e8-fb22fc0a80ea", "indicator--2875e839-3387-45ff-bbe2-16e0d8a11b07", "indicator--3314c071-9a40-42fd-8811-9609e4730ecc", "indicator--17ed6d19-12a4-435b-8379-13fd478273fc", "indicator--a58e903f-06a1-4db6-b260-4fdf76333009", "indicator--a2554a8a-6915-447a-9782-e163b4957433", "indicator--2a0ef84c-2c83-427e-b7e2-795bb7dcb8ba", "indicator--37c04f4a-ceb5-442d-befe-e97e3eacd0d9", "indicator--105939d1-1156-49ae-b074-d017950407e8", "indicator--3e23417f-f88e-4a6e-abba-699b6da717cf", "indicator--218b7a13-73f2-4249-9f25-06858fc469e7", "indicator--ad7d9cd6-c68d-4c65-80f7-dd8509b04053", "indicator--5457333d-d8a7-4321-87d3-e742490e6679", "indicator--2e4a7342-a3a3-4371-b613-690427161a74", "indicator--f0a548b9-a03c-42ab-a5f8-1c6d571c1702", "indicator--eed1d60d-f735-4d9e-a335-7a20c20b72c2", "indicator--850af6e5-ea4b-40d6-a7d5-dbbc630eb656", "indicator--fee89492-04b9-4586-a648-7f15d42b75c6", "indicator--6692ee8c-7d69-421c-a82c-d6b0af2794da", "indicator--870f864e-8aaa-4929-a793-31567ef7acd4", "indicator--1a18534e-a26e-4842-b70c-3b5bb3c54e5a", "indicator--75cc2103-a71f-4e40-b5e9-5d13e0010136", "indicator--3b8813cd-b1f9-496b-9305-48c96e6c7774", "indicator--58e8bd84-9e5a-49f3-939c-538daa842ae6", "indicator--c31d21db-00e0-455f-ad23-49a5fe36195d", "indicator--b0b54b21-1af9-451b-830c-edcdbac63b1e", "indicator--7def71b1-ad88-4af7-8477-9cfa7becd6b6", "indicator--a01af8ec-c481-4657-9002-e97b743b51b9", "indicator--cc3988d3-3bcc-422d-8abf-cd29640e70f2", "indicator--448ad064-ea55-47fa-864c-bb037c70dbf6", "indicator--c01aae9f-915d-4fe2-83c4-9d5da40ad3e0", "indicator--b470d454-a5dd-44d1-9ac3-4f075ddf100a", "indicator--b4bf4133-68ff-484b-9514-d32a11fbfdd2", "indicator--ba895609-1b8d-4772-8cac-abf94c77129b", "indicator--b8e3cf8f-3339-4e7f-95f7-d34470a62bb8", "indicator--527c7871-79b0-47ce-9602-65bd8d9d3d21", "indicator--91f207a6-e83e-46df-a028-e9cda01d4678", "indicator--2171eb62-c531-4fdc-a5b5-d24a3f6a0784", "indicator--42d266c0-4abb-452a-9bee-83b4569268cb", "indicator--94e77991-865c-49d3-8c52-1db3e6f2ecda", "indicator--07a96484-c9de-414f-a4c4-14e35dbd44b7", "indicator--da0cda28-f2c9-4b13-a4ff-00e2ab9996c3", "indicator--820c99a0-473c-4d80-9b9b-c80f8ba77ca5", "indicator--c538c0fc-466d-4c6f-bbfa-9c87456ee039", "indicator--91456945-151f-41a2-9af1-312d9f8ea844", "indicator--253f4cc3-fb76-4cec-a66e-3cac92f11aee", "indicator--b6f548d0-198c-4447-8bc9-65c70bf45288", "indicator--1e10b7a9-0ef1-4034-947b-e06c1d515365", "indicator--d2e7e2ec-667b-49dc-98fe-f3265d13d348", "indicator--4e488a59-c851-433c-968b-378c9154f8e8", "indicator--1d4c323d-77e0-47f4-b902-56a7d4174a4b", "indicator--d52c0c5c-0ab1-46f7-973c-2980b22009ab", "indicator--23ee3291-cc49-4efc-ac76-03fc13120bfe", "indicator--b193b4e4-a8e9-4182-9ebf-fd56116b1300", "indicator--65de927d-ac55-4c2a-98c3-ed1eb75a98a6", "indicator--84b72d97-d6c6-4aa6-9812-a0cd873616d2", "indicator--ac542c92-6824-4730-b13f-c07aba370f9b", "indicator--a7000593-9eb5-4b4e-bf32-8cdef19636e7", "indicator--285a1b5c-ae62-4992-ab06-312ee1fe4eec", "indicator--62622d8c-998e-47d4-a44d-d15c973c9b00", "indicator--2278cc4b-8bc7-46f9-954b-c254228f2a11", "indicator--a49e1f54-acbd-4d1a-9202-77f904b41ab0", "indicator--9c016f9e-ff5b-46c9-90b8-d6b02d0bf31b", "indicator--fbe3ba90-8e95-49e3-b6ce-0b1dbda19099", "indicator--f01a348b-7aef-4cf7-b20b-b573b2d722a9", "indicator--2c59873d-8a27-4dd9-a552-8fd607408958", "indicator--a8c47d90-86e5-47ad-8730-8521ea11a888", "indicator--9fbf3fff-522d-443d-b589-eadfe93df443", "indicator--c9e9a3ee-9054-4222-8b2a-cf2ae96ca24f", "indicator--66516b02-4fb4-4572-8f1a-f16578425d90", "indicator--f3d2d1f0-a3d2-4bac-91bd-d2af3a88ce73", "indicator--4c208d74-96cc-4218-9818-9eb14110a1a7", "indicator--46ccf14d-a984-494f-b84f-5d03fb3e89a6", "indicator--517bbfed-f89f-45af-8a99-306f9328e17b", "indicator--7d2a0015-4f1d-4524-bc47-b3528f9693ba", "indicator--d8dddc71-1558-41e4-855c-88a60c195a93", "indicator--04c79151-7660-4793-a5f6-a54ae1e947bb", "indicator--33d6e727-cd73-4785-9141-5af5eeffe56f", "indicator--6a9d612f-09b8-4a6d-b29e-c35e0c311202", "indicator--4052dfc8-9325-42bb-95ad-8429612b3078", "indicator--3d99d2e8-f864-42c4-be00-2fb19256e778", "indicator--6bfbff0a-f95a-4bd9-a073-07b778d98302", "indicator--77738561-d352-4b0e-a67a-50ea388a1432", "indicator--6c47f73d-61e7-42fa-b38f-650f1e624497", "indicator--92fb5af7-3738-4ba5-8515-e9782c80b672", "indicator--ae234572-103f-48a4-aadf-2a630088163d", "indicator--74d3728f-9963-4a36-905e-a7a626698d31", "indicator--3467efde-b7fb-44bb-a503-f07c6f4a922a", "indicator--0d9b3243-d50a-4238-9af1-9171c12cfc42", "indicator--e3687812-def5-4c86-aedb-5f1299e2b525", "indicator--c38cef1e-64e2-4930-8938-f61d14cad3fc", "indicator--4513a277-262f-43c3-8c74-c98ce071bcfa", "indicator--70233424-95d7-41e3-b67c-05005a166b95", "indicator--ec0be3e6-72b6-40cc-8aca-6166298bbe38", "indicator--e0500d45-2004-461f-b03c-cfb0d4d2cd47", "indicator--3846ddff-4a33-493d-88f3-cc964cd3599e", "indicator--153d7f63-05a9-4052-bac4-25bd00943cd1", "indicator--fa9227a4-ac5a-4048-8baf-74804e1d51f7", "indicator--d7e43414-054c-4d16-b149-1f54c0339649", "indicator--ed7fed18-5c18-4b03-ae95-33a15e39b0fe", "indicator--ab97f637-6b34-44df-8c4b-7faa8ef7aae1", "indicator--2696be62-1e8f-4d86-9260-352302ab66d3", "indicator--cbf30a07-f0f1-4943-b0cc-22e84d3395a0", "indicator--791a5a40-ee9b-4632-988e-a61d3f8fb95f", "indicator--95199265-ca09-4917-a30f-3e33acc0c7cf", "indicator--b4e14858-e11d-4324-b2ce-ab8e53cdfe72", "indicator--c5bd10c9-09f3-4c4b-9c45-d97ee243996e", "indicator--1441d9a0-c123-4b2f-b00d-c0143890083e", "indicator--3d8d2e83-2b74-47ab-963b-2c71acd2602a", "indicator--a775988c-acf2-4dad-95a0-bc5056ad910b", "indicator--3e78efa5-b333-4545-9e56-e2da5842c475", "indicator--fad2f354-9dcf-4f75-acb2-37de82b6e1db", "indicator--1a727e26-7f70-499d-a278-59beef299c3d", "indicator--7753ca2c-49fa-424c-a222-d8e6ab98cef5", "indicator--b5ba91f6-01cb-4b56-8a7c-74fb481f6ad2", "indicator--e222266c-2610-4498-89ee-dec8a96ab743", "indicator--5987599e-e42c-4af6-baf4-c259edf18508", "indicator--edde8099-f96c-4c95-ba35-8ec67df17f4b", "indicator--c7778f9f-ed5a-4eb7-a933-2450741aa0a7", "indicator--81cd4ba6-4450-4bcf-901d-fb5f6a6bedde", "indicator--1962fc17-029c-4c6f-b599-0922cd5018ed", "indicator--68be37c7-1eff-4b41-83e2-b416e2148e53", "indicator--344e80c4-5d3b-46d2-8cb2-55913d8ef27f", "indicator--255ac3e5-e853-447b-bb39-814a1cabe671", "indicator--601ccfbc-6d75-458e-a3cd-eb764fe92dff", "indicator--44d22ef8-0f3a-455e-b2d1-a87b2069c0c9", "indicator--3a08b1ea-f751-415c-8cef-eaed222ffafd", "indicator--2d466c85-139b-4370-9df3-5c7169cf71d3", "indicator--52c0a4bf-1f2a-4123-ae50-fb754daeaa09", "indicator--a79fb3a3-f5d5-4966-9d39-a09bf421c7ec", "indicator--94bad397-cfbb-4cb9-8a12-85e3c7394fc1", "indicator--17b64ad9-1368-40d9-b3ee-e5537e53aef9", "indicator--bab8e2b2-e0f2-4f2e-8841-69ed29697099", "indicator--86745203-30f8-40e3-8b51-5d7dd60ee60b", "indicator--92c569e1-b07d-461b-8e7a-b204afee6321", "indicator--837bc902-bb73-4953-944d-b081553470ec", "indicator--5ff32d61-3063-4bb7-9498-95fa741feed3", "indicator--d7405d5e-caa7-4c53-9716-1bf570adcda1", "indicator--bbaea937-1a27-4e98-b513-62e262c62b9a", "indicator--518fdbbb-95c5-43d5-b768-c4e5e24667eb", "indicator--6fd1ee72-2f67-4f2d-805f-06a0060655f7", "indicator--8024b221-4025-4658-b59b-7b07df87b175", "indicator--ffc6a12d-cac2-40f3-bed9-4f5db8bbc675", "indicator--206af775-f4be-4cb9-b509-6e2e2ab02308", "indicator--e8147fb1-75de-41e2-9cd6-bfc2c7412c7e", "indicator--8d57623d-de0d-4a41-9840-021a673d9be4", "indicator--8a52f995-e7ad-49ff-bcb4-e37e8b551260", "indicator--5f763957-5b64-438b-aa02-1dd9acc808ac", "indicator--0a854743-6ff9-4467-88f1-4e0ea12eaa56", "indicator--f2f0395e-ddad-4b28-ab2c-50d370b7b857", "indicator--f9ab6498-33be-4110-8d57-49274d6b52cc", "indicator--13c7d06a-11ba-4910-b80a-452ba613b3e2", "indicator--7151b673-a662-4940-a812-7000c37f453e", "indicator--a4cf22fd-9900-42ac-b8ad-a20c9f73b929", "indicator--a6dceaf1-7299-48d1-aa35-e4a1f6210339", "indicator--83e081a1-68b3-4126-86f9-508ea612df00", "indicator--e3a4e90e-72ae-4611-9ac3-0d47bec1e02f", "indicator--5cc0dad1-7bf9-42c7-a495-5e2fb201b633", "indicator--663cca86-f0d4-4289-9a08-d5cc599ef949", "indicator--572eef9c-9212-4847-910f-c9d628083334", "indicator--8603ea85-a2ad-47e7-8810-a362be940854", "indicator--bc53b6c7-62a3-4f7b-aee1-28f412b8d4c7", "indicator--a95e45d9-4ada-4e1f-8f04-fbf9e0d6a6ec", "indicator--7f65cd56-886e-4639-934b-4f54be02eeb9", "indicator--91465347-bf0c-493f-84ee-55279cd93f7f", "indicator--ef51d558-2129-4471-8ba6-cb4b9efe1ede", "indicator--a0ca7cd5-e580-475c-8412-af0248097376", "indicator--642a3241-3321-4828-9956-28bb2328514f", "indicator--0f9058d3-cff4-468a-82ed-57e966cff346", "indicator--52d630dd-3478-499d-a3e0-6c4c985dedfa", "indicator--5e4f2836-b90f-4f22-adf4-eaa2ad7ba317", "indicator--8160dca7-e81e-46df-8c1d-278d1c1dc78b", "indicator--35ae3902-a592-4c38-b499-4c03e510bcf2", "indicator--1a6ecf32-6d04-4eee-b774-1e9b9caa878f", "indicator--999b5da8-cc8d-4417-b282-a8c47b82b176", "indicator--4fafb569-a2c2-48ff-979a-c9f95cc4683b", "indicator--a07607f5-186a-44c9-b0ab-410a46b0b94a", "indicator--ef9dfefc-b835-4d95-9a50-58315c29a83b", "indicator--7985bcb6-56a0-40cf-80c6-d29d06b0758a", "indicator--2b361f9b-9e60-40f5-ac84-bf0e22d19b84", "indicator--c0ef3ac0-735d-46e1-afa7-caca03cc5d8b", "indicator--720dff46-b23d-4ba4-9aa1-7bfc618abeaa", "indicator--7dc3dcfc-60ca-4d26-ae95-66d9a01999fa", "indicator--df240f4b-7c7d-4631-9289-39cf08928524", "indicator--8a59672e-4a88-4cf6-af97-63b8fd2c4336", "indicator--aa032931-7528-4ad1-9a44-1b021e1ceeda", "indicator--9c12e25f-8761-4521-a4be-75b8882710c6", "indicator--0c79a7e2-47ce-43cd-aae9-57ee00ad6dbe", "indicator--78b227ce-a437-41dc-a1ef-0798b3292d01", "indicator--d81d79c2-5043-4881-96d7-2f3e258dc26b", "indicator--33ec208d-a39b-488f-a634-8399421fcc80", "indicator--465f2d89-d81f-41a9-8828-aaf22a352c66", "indicator--c8750f59-0df0-4ceb-a51b-3df18514d019", "indicator--98611d0b-89e3-40b1-b7da-40cfdadb6fc3", "indicator--1d1698f8-64a5-4130-847d-10b7acfa0a71", "indicator--e85ed528-37c3-4ac2-bd8e-905adf200dec", "indicator--566e90b9-1e9d-4389-a87a-582fe53be69d", "indicator--9e8f55cb-e248-44d1-b44b-5a242b2d6716", "indicator--a8c57818-5ed6-484f-a2a2-9e293c855276", "indicator--39dd31f1-8e92-4674-9596-9de6f8a90893", "indicator--fc8953f4-4ab3-4260-b347-e923db1852a7", "indicator--f2834bed-e7b0-4f52-99af-71f542f48a95", "indicator--2f09cbba-0e23-4e35-a802-76dd1822ee35", "indicator--da336969-78ef-40d7-a13c-847ba3b74e4d", "indicator--dc5675c4-b4e5-4608-b5a2-2d4818ea1443", "indicator--6d2bb719-330e-499b-a068-7081bac65c0b", "indicator--0ff8d8e3-3101-4bc7-a611-07ec9d7710b4", "indicator--47d0f897-9af1-48c7-b96b-b2f6cabad8c5", "indicator--778fe931-d417-44cc-b2e2-e6266367fefb", "indicator--b10bacc4-078f-42b5-9d6d-25338a9f4891", "indicator--99bfc855-213f-49d2-bd79-68752957fed3", "indicator--f1f5b6b6-607d-4ad8-96ac-a18381da6dd3", "indicator--acb62116-f694-4400-94e6-685c2dd113ed", "indicator--591be1a6-31ce-46ec-a7e9-d362008704da", "indicator--d321108b-a6db-4e1f-94ee-2762804579b2", "indicator--83282d71-89c4-4d38-8950-2543b79a1615", "indicator--c773e362-f6be-47d9-9f8f-f9cee161c99a", "indicator--accbbc7a-4365-4c5d-ab93-59b9e944c4a0", "indicator--295afef9-675f-42f0-bb7d-f209ac0764a1", "indicator--da08bb07-f75c-48ee-bc82-b3ce3fd4a71b", "indicator--649eda7a-d75f-4a69-aaa8-bcf78f50e577", "indicator--66b70192-450a-4862-aea9-672a7035cb7b", "indicator--0a5ba6cd-f0e2-4732-b4b4-e6203504d5ea", "indicator--88a6db54-30ba-4456-8818-2c118bde8a22", "indicator--f9c9ec04-a43e-4de6-bbf9-75f7b3565d01", "indicator--d531d60f-cc31-4a1a-8af3-bc2da9dff9e0", "indicator--b736458c-d9d1-4fd3-b6ca-71e4fbaae5d5", "indicator--f3c6b66b-4d6f-48fa-bcdc-9779d1c2a377", "indicator--dafc86fd-ad0e-4a11-a77a-9565151e994c", "indicator--8a2bbcfe-3984-49a6-9990-fac6612ad094", "indicator--616044f9-b2b4-4a5c-8424-5dd9ef085050", "indicator--9f6e2d64-ac8c-47b9-b76d-c0889a5f5bf4", "indicator--971ba8e9-742f-4623-ad77-4265c24201f4", "indicator--effd2322-ced5-4835-9caa-3d671e6d8ee3", "indicator--9375e620-29b8-45e0-9353-61570e96d8f8", "indicator--5c7860a1-2b7a-4a4b-8247-29a2a15502e4", "indicator--487ff3c8-92b5-40ee-9a0a-f0ea5bbd0372", "indicator--f6fb8988-c5cf-49f9-b7c9-afba7c3241e6", "indicator--c0bad849-af2f-40e0-804e-1c65d6a76fbb", "indicator--885396c7-bcf0-421e-892c-4ba3158e83b9", "indicator--240ff185-e7b9-41c8-b41c-49cbb1c6c97a", "indicator--6901e27f-808a-4a90-8656-dbaaf057cba4", "indicator--268fbd22-e9fd-4e0f-9c7b-bcbf1df5b3e9", "indicator--8b3416e5-170f-42dc-8438-625d16419896", "indicator--ad15821c-9d78-440b-9f6c-9971a912c0fe", "indicator--7b6e3a05-5c90-43df-ac07-a65965c62474", "indicator--8bcd1c1b-54ae-492f-9350-11c3707ca31a", "indicator--f7d34d81-206d-4d57-87b6-72e96b9e2136", "indicator--6e028884-dd7d-4cb9-943f-b2b52351a7a7", "indicator--7a4d654c-d0dd-459d-9649-905569956097", "indicator--a834782f-9b50-4fbb-bd2d-0ccf55e441c2", "indicator--3610a454-e45f-4e2a-9cce-4f17559b46d4", "indicator--e1623e82-c090-4889-8086-5d8a577408e0", "indicator--e7259adb-b392-4b93-911b-7dc0d950a033", "indicator--a6ebb202-7eea-489f-844c-f0946bb10d9f", "indicator--09c33b63-8d7f-4ff5-ba55-9081d61160c2", "indicator--33e3d64d-dd92-46c8-9f63-33e6da742693", "indicator--c25ce4d6-388a-4d36-9847-151aa9904c1f", "indicator--c0c50cba-e0ae-48e3-aeae-21667720da55", "indicator--d9e0a792-77d0-43bd-8bf4-cf553575d33b", "indicator--94b4db46-e661-4442-84b4-3c6ae98d20e3", "indicator--ad83c0de-d3f1-472c-a9e0-8d7c773ffe2a", "indicator--674f02e5-128e-4e81-a922-c60ef845a31e", "indicator--53e9ea7e-fef8-49d3-8b08-f7093ce7b0aa", "indicator--6b595ce2-5ec7-404b-a594-1b26c8237c3a", "indicator--75b9eecf-6de5-4272-a0c2-46bc82b410ba", "indicator--ff819e40-19d9-41ca-ab5a-dcfb3b38ff1c", "indicator--04e87238-8cc0-4ec3-bcbc-0cbf30e7f28a", "indicator--37a1cd5c-8ef3-4e3d-9a0d-1d30fb3f50ed", "indicator--907aac52-e403-4458-a6d1-fbdc975f28b5", "indicator--830e2cae-f88a-4144-b010-16674111736c", "indicator--d5a664e9-92b6-4d17-b49a-762ef304a5ca", "indicator--f826efd4-c22b-410b-879d-b254a6958182", "indicator--74875cb7-6eab-45e2-a223-e00521623d6b", "indicator--c6f90620-27e0-4196-bc35-f6ed0a08cc96", "indicator--886e9086-cfb2-44fe-bca8-84bd09bcc495", "indicator--015baeae-e9f3-47cc-a203-835fe85634be", "indicator--d8393599-e573-43bc-a3a3-1e0f0c2d169a", "indicator--e0095a83-bb1e-4f68-90b4-570db3e26a4d", "indicator--3b1e54f9-46d8-4acc-9d35-25b4dcc60f93", "indicator--d55a7013-0b01-492e-b01d-8ba2fd7244bc", "indicator--ae2656b7-a0b9-467c-a7a5-bd9de013ee59", "indicator--8209d129-8b0c-4f88-9cf2-053f13183346", "indicator--9d880709-04dc-46f3-bb11-33b66aa37a24", "indicator--3bc346e6-63a8-4af7-bc4d-7ecf24fbf6e1", "indicator--87b96c37-68b8-4e13-94f6-8ad43779434a", "indicator--b0683d36-05de-4a96-ae9f-b0e9da348d0b", "indicator--184600f2-60ac-481e-b205-6f41ca51c497", "indicator--5b57e7ef-5d33-428f-bec8-4a33c1173899", "indicator--b6a9ae45-16c5-4a93-bee0-963bcbe70c52", "indicator--6d8e14db-8094-4129-98bc-a25d5008d200", "indicator--04c36f6f-231b-42c9-bc69-cee2f41d9fe5", "indicator--968384b1-a6a2-4921-a069-0897c4c6b672", "indicator--3ea68e50-bf34-4fdc-8f87-780bd5854343", "indicator--c4a6e98e-69b2-497f-a7b1-6c24f243e00b", "indicator--5f1a0df2-b59d-4f2c-981c-7cec8f57e0bb", "indicator--a03f5d7e-6f63-47e1-a5a3-1ae123a1b542", "indicator--e1444f5c-9201-4ccc-94ad-7ae327aa93a9", "indicator--a8f476b2-ad4e-4108-8192-93d5351fba09", "indicator--e7bba666-1149-40dc-acf2-0b690f679ec2", "indicator--e76d5a2a-c314-4814-ac2b-3271a07809b2", "indicator--f6278950-8143-4c43-ae77-c140e8a418d4", "indicator--28aa9976-9953-4f0d-a774-6424d2c0340b", "indicator--c82450ee-1dd4-43f1-b003-11ae9c524739", "indicator--8fd39673-7ecb-4865-a454-c6b40669567b", "indicator--ca4f45af-62cb-437f-87fa-9232250d0320", "indicator--93d575d3-9089-49e9-ac97-0f4df0ba468d", "indicator--cb2f9f3d-2ef1-49a4-bae5-517c36b5452a", "indicator--2f60e7a6-353b-4369-a8b2-9b8a2478561c", "indicator--3d1870f2-6b48-4b84-bac1-3c1fea8924ad", "indicator--a160e07b-23c7-4947-801a-13c89d422eed", "indicator--b73d922e-dbed-44d4-946f-b7945f55fe5e", "indicator--27fe5682-ba62-4a57-a65a-453ffa7cbd8b", "indicator--523bd342-26bd-4965-93d6-440add100323", "indicator--29aacbdf-da5d-427e-b6e1-30a4367b56f1", "indicator--6d61bc13-e4d5-48bb-8c7c-5896b4bcbd92", "indicator--ad5b93d9-1c6b-4a94-95c9-6e0737d5d15a", "indicator--3d5e85e1-0488-4484-b37e-3c81e1d507e5", "indicator--16f3f8bc-cc8d-4d43-b7a6-260dd5c8ded7", "indicator--0ce2ca52-d55e-42e1-bafd-64b7cc26a132", "indicator--4f39d86d-5b1a-46c2-b9f0-21de91e791bf", "indicator--ca62eca9-1d78-4cba-b10d-1f266c794e7b", "indicator--6d7dab38-a4f3-4f64-b4b7-826e4b08d4fc", "indicator--7cc973f4-09e5-465d-97aa-8101d9875337", "indicator--297edf59-0a10-4604-a4dd-d61acedf6d11", "indicator--fee75ac5-e6bf-483f-ae6e-3dba997737a4", "indicator--c710495f-b87f-4b38-9a6f-0032d89487ad", "indicator--c4626463-5358-45b8-8070-d21f1b79f0a0", "indicator--374c492e-e47f-46a6-897e-6a249cd07e0f", "indicator--9138211d-75f7-429c-ab03-88c0ba526ce1", "indicator--02a965ca-8353-4b55-95ae-202f198a29dc", "indicator--84d75565-c7be-42d0-bc59-803ca2320d73", "indicator--38363357-378b-4b2c-b209-85bb013a83d8", "indicator--f42a837a-3f10-4db1-903c-c148b3b3d3da", "indicator--f332d1ce-c5cf-4edc-8298-67a46e7c0ee9", "indicator--0ea326e1-2dd2-4056-86c5-b18e18a22b8e", "indicator--34cf0efb-ddb3-4dd1-8021-b317c6e0d175", "indicator--9b18c496-9759-45ce-9b1f-5c3cf94c87df", "indicator--dae5056c-3847-42d4-a9e6-b173c442959e", "indicator--470d4037-9999-41e6-b5a6-a110671b1917", "indicator--cb23be46-e793-43a6-98cd-68f1ea777607", "indicator--ea0a2883-ee01-42ae-a895-d8ab8331036d", "indicator--3a9ffd14-337d-4348-bf46-b3a1127532ea", "indicator--bff71e86-7753-4c9c-90e5-2060aa85fdeb", "indicator--ab98296f-2453-4f19-976d-b8550ff0963d", "indicator--82c47f75-5480-47ed-b12e-2e89e39c4cc3", "indicator--e09363a2-0595-4355-a03d-9c19b4c2c754", "indicator--fc5e47a2-8ca1-4b49-b162-4ea687668e08", "indicator--3fa131cf-577a-4553-8d27-7a3501b74b56", "indicator--7b72c42e-1f72-40c3-9a5d-d24c4d125ca9", "indicator--697a7176-3e07-452e-aa6f-745605a16233", "indicator--e957ad6f-5dfa-4d1f-b786-568033d71c60", "indicator--c434cbab-0e1b-43ab-8ba1-763930b10919", "indicator--5838f1bf-0c7b-4b99-b7f0-ca6a1e5cd8e1", "indicator--ebedd33a-3538-4622-91ab-52ccd049b429", "indicator--6dd64461-c113-4a75-b67c-52c1a16ddfbe", "indicator--840febe0-65c3-4cd7-b1a5-47131ba08d8e", "indicator--36540227-f6e8-4642-b5ef-b51ae75a1fc8", "indicator--a3f64a3f-9dbd-4f5c-a8c3-cebee43dfd91", "indicator--e7195058-0520-4e87-b4a6-23acc822521a", "indicator--0ef3564f-7857-4f6c-a3a0-64cedacc4934", "indicator--bb63bf75-40e8-493f-adc1-b368aeb23521", "indicator--f3cb259e-e108-4a03-9279-f4f3cb64e642", "indicator--b7144492-a9e7-4ed7-844e-f51e4169cce4", "indicator--3822e06e-57bc-4603-8e77-2b4a0a7721f7", "indicator--86803d1b-d420-4164-991d-1369670ba149", "indicator--160e6142-f41a-48ed-b6c1-2b296ad0d7c7", "indicator--c878ca82-9276-4a53-9e82-13677fa43c31", "indicator--6ea8afd5-a482-4227-9bcc-1e8e091f6b80", "indicator--227d5d9b-3581-4c53-810d-ab3acd14a35f", "indicator--a8066b52-9809-4b06-b762-6ed40fef3f88", "indicator--6f9c97a6-2ce6-446f-9345-c5ffed5c73fd", "indicator--a746d5cf-227c-473e-a5e0-d644b401a865", "indicator--ced11628-34b4-406f-ae68-167509cbc2d1", "indicator--8ff5709f-62a5-4469-8fa5-75d98b3e1d4f", "indicator--1439fef2-135c-41e3-90b1-a609e08492f3", "indicator--fef129d8-78eb-4fb3-a914-d45121120a9f", "indicator--e49c3372-46b8-45f4-92c0-2ccea46324d2", "indicator--33515414-871d-4e93-a123-1ffd29bd20d4", "indicator--f93f51b3-667c-4e00-adba-7dc962453514", "indicator--bc0e4640-ce11-4998-a5d8-ead711c235d6", "indicator--40fb987c-cc3d-4580-98bf-9bdb4fa9fc0d", "indicator--1659a1a3-32b7-4de7-b8d8-181431fee783", "indicator--b5604bdb-cfa0-45bf-b22b-e22e05da9d8c", "indicator--947a7006-d80f-44ba-9c28-b7e6f08ea22e", "indicator--159808c0-96d9-41ab-a415-bfaf9424858e", "indicator--770a02e5-3ac5-4f5e-b9b1-08b22a0cc18a", "indicator--2954e006-634b-4eba-aae1-68992ee1dd57", "indicator--2f3e2a70-5d47-44f6-ab45-04c5c53089b4", "indicator--3e8fa95a-5bac-4d5b-a2f3-2987f327ed32", "indicator--f7685588-68a8-44f0-a0ee-425a2a5ac0d0", "indicator--6359a434-029e-464a-944a-b6f02ae960f4", "indicator--6b85f8d2-1890-4aa5-9da0-f8384bdde05c", "indicator--687cdd18-2e90-463a-8882-7004a48b595f", "indicator--bd834103-3a10-4a5d-b1da-586dd9b7fdde", "indicator--99f7713f-8f16-4d0e-9175-2eb2bbc87cd2", "indicator--52799475-8a69-4ab1-962a-1125fc6fa291", "indicator--3ed6222a-cf76-4267-89b5-928e25c0965e", "indicator--6a0688c0-2f67-4ec5-b415-3b63a61f0ec5", "indicator--8d06252e-023c-4164-aae4-2c8e4382221a", "indicator--243ea716-b7b3-4f68-b095-96b48c72e580", "indicator--0a76db66-8214-4bf1-ae39-a559cdc48178", "indicator--78f1945a-b98e-48a4-8b7e-7618bcea5bc7", "indicator--04abd59d-aa2d-444b-9ee8-186a09620ce0", "indicator--e67dbd8f-0157-4df5-bcc4-007626525bd6", "indicator--ee68a55b-62c6-4d31-9ffc-aa6009d8d76a", "indicator--5c90fee1-9cf6-4faa-a5c1-f68bbf395291", "indicator--aef2032f-b1e7-4e34-a084-f56eb9059411", "indicator--d87274eb-4f12-416c-aebe-943eb278d054", "indicator--0ea6debd-afd7-4ba7-b104-c17f7d26d109", "indicator--4c36468b-f59c-45db-8a66-c38d51e131dc", "indicator--87d6c0e8-b8a4-4c87-a352-382317f0e83b", "indicator--ed702255-894d-442f-8b15-57ab58a7e05a", "indicator--6e697818-7997-4da0-8b87-034e789f5b7c", "indicator--ad577447-3a7c-4d3f-98a7-a68f59536918", "indicator--22366ccc-f1ef-426b-ab09-92ec874991b5", "indicator--fdc21351-e9a8-4be9-9f57-cd2c1f2326d6", "indicator--d63290fc-76e6-44cc-9a47-40401a68e559", "indicator--6f468bad-d1b4-4d5b-956a-cffa3972fe4a", "indicator--bb8507f3-ddcf-4eb3-ba9e-1b19c331827d", "indicator--5c35e79c-65dc-4381-b371-1c900f564ced", "indicator--64665dc6-c82d-4f76-a489-8d55a3757ad6", "indicator--ea1f4d47-6570-4683-893a-5f93ada1580e", "indicator--aca793cb-4b81-4ef0-8108-63003da36c65", "indicator--8fb1230a-f63a-479b-93b4-8bdf8d1440fb", "indicator--049e7bec-fdcf-4f40-8bb6-7eb5fabb3c03", "indicator--c3cb5420-3bcc-4178-8c03-30175341080a", "indicator--62a9ebfe-d1e6-40ce-8061-b07d859c0beb", "indicator--087ba77f-4058-4cdc-bc08-4e5cc73e6fcd", "indicator--648236f8-5326-433f-a62a-22db1f1b7d0d", "indicator--01921b48-8d7e-4852-bda9-c8ff4c89d83e", "indicator--ec06c724-08fb-496b-a5e9-221526cb1db2", "indicator--9974f2f2-46d8-4424-9ee6-dfa52b57a174", "indicator--742f394c-251a-4f12-8271-7718d77e5dbc", "indicator--0b4e491b-1125-43d1-9970-af0a8f2ad7a3", "indicator--fe712c50-8317-4f9e-a900-371e4f681fef", "indicator--477b57d5-9557-46b7-9288-f82e0e31d2d4", "indicator--a83595eb-1f21-4c00-b28a-e9cbfd760eda", "indicator--8ef8d8bc-ba33-44f2-b002-f13f27788c34", "indicator--4783a219-cefc-44a2-a8cc-9fecd4c6a927", "indicator--8d749140-173e-4474-9c85-b1089cc9b7e6", "indicator--c934cd86-b4c7-4f67-bbde-bd2c87b97cb3", "indicator--a73b048f-db87-4b48-a75c-62bb8e8e1e02", "indicator--4c703d1a-007b-4489-9078-14b839a2b3cf", "indicator--6945b116-69f7-45da-93bd-020854224883", "indicator--3064df54-7252-48de-94b6-33b2f3ea25fa", "indicator--5ef031bc-cd83-42be-ba0d-efafb0ef7f61", "indicator--2261316d-73eb-4dd4-9af4-9e5d383820f0", "indicator--b13d95c3-a6d9-42ad-bf79-2a6d7d3f1513", "indicator--52c70879-c1de-4840-89fb-c6920567ff99", "indicator--6ceaed7a-dc60-417c-93c1-e625b5272fdb", "indicator--f1861aff-729c-4bbc-81d7-838d85396dee", "indicator--58e4cb38-f161-4c3c-9fc5-a7099e11fc45", "indicator--fc97d612-aa58-468e-8a06-44cd8916863f", "indicator--b3e4bbe9-a91a-4666-9d2a-fc54eb6e6919", "indicator--3261f0a4-148f-465e-9388-742d6b2cfed9", "indicator--eca88b0b-3eaa-4f3c-8263-8a9d093eccd7", "indicator--29cb3449-afcb-4bc8-8635-a9d480e1b7e8", "indicator--c5fcc918-b8a0-4ffd-820f-9e56352d9045", "indicator--7d0a6c04-7b75-468f-adb3-a0be47fe2610", "indicator--59850ac1-eb59-42be-91d0-b57c6809fc7d", "indicator--b48ee430-d287-45fe-b378-aa8311c85d78", "indicator--2ab0fc17-f660-4736-93ad-2b5ec0792c44", "indicator--c70ef136-4666-4a67-b0d4-e42c5461fb4c", "indicator--62340a5b-405d-49fb-8532-a66eb9482c22", "indicator--69e7eb12-7602-49d7-9872-138ee52448ed", "indicator--2378b207-af6e-4200-80f0-08fa8ab4fdcd", "indicator--df3abf18-d791-4043-9db3-6520d0e6ebac", "indicator--5aa61f73-3146-4b5f-8503-968dd887d7b5", "indicator--721de374-07c9-479b-a9e9-372279e5bdc1", "indicator--94de079c-3415-444b-a3b9-44230f2eb540", "indicator--6ef889b2-4291-4669-9243-2892e2df69f7", "indicator--b3e9e10e-4d74-44e6-81cb-be2e6d0396e2", "indicator--046dce7c-5efb-41ec-9708-73baf69c1129", "indicator--b4c5812a-98ec-44b2-8b6a-69b01a12e389", "indicator--ed1be9e1-3c65-41a6-9069-f59df9d19556", "indicator--8bd8e6eb-a52f-4f46-a171-3a1d22600039", "indicator--a08872a3-70e8-428f-bc23-7df770eb9024", "indicator--9205c89f-ce96-41e9-a2a0-f5c8384cb636", "indicator--cfd292ab-44e7-4237-b671-cb5e85f6a936", "indicator--8405bc02-cfe8-47ad-ba93-3207fffff9be", "indicator--ac1ecc2e-6731-4eb7-9dd9-253b5bff4afd", "indicator--e2abfc7d-de49-40eb-973b-2dfdc9832c08", "indicator--b1ab377b-8a4d-4f1d-aa97-3cc7aae3778e", "indicator--e40c9126-ea3d-4cc1-8150-a82f6e81bbad", "indicator--d0aeff93-6015-4131-b3b7-809f26c3df43", "indicator--41b6481f-82ac-45dd-a55f-2d767708f068", "indicator--b70695d9-b828-4a79-ac64-2db8c81744b0", "indicator--d940568c-5baa-4184-bb38-d3ca0f4258e9", "indicator--623f54f0-bf29-4553-aa50-955a14fba66f", "indicator--b4b19a14-67d3-4cce-9f3d-243f6ae219ea", "indicator--e54afad2-ca5d-4f5b-aca5-d2326aac24da", "indicator--c8cd4da5-8019-4ad7-801c-56526e1b6497", "indicator--961057b9-14a8-4a79-9ec6-c1a0b11cf54b", "indicator--dfe4a38a-125b-41d3-bb08-1d275f79ba80", "indicator--cf9ac537-10ce-44b0-9b65-ae2fbbac3880", "indicator--0af89f37-c2a2-4e93-befc-e6b4259f37db", "indicator--d2bfd207-0c23-4698-8bf8-61bcee797c5c", "indicator--e05c5670-8573-49df-9711-9bd44c821bbe", "indicator--1cd35d0d-86ff-4eaf-aae0-9b0002be0154", "indicator--7cfc34b4-b1fb-4786-9292-bacc9def79f8", "indicator--1ce93089-e1d9-48f8-9f50-c1d7f578102a", "indicator--a8e1ecf1-235e-4bc2-8912-6db74d44b367", "indicator--bb71ef66-bbd4-4485-914d-d757103062a3", "indicator--d85a6418-045e-4e68-b5a1-575ea013c828", "indicator--fad2eb6d-b20d-4cbd-b11c-98175fdd50c2", "indicator--513a2f00-71a8-4e83-8848-dcfd5b444ac7", "indicator--86d42b7e-b36e-49b2-94d2-826dc0daa39a", "indicator--9be3e2f3-987c-41af-8cb4-152ab14989c3", "indicator--9ce52b4f-4a21-44d8-80d7-516765998909", "indicator--0d7c41bd-48bf-4153-96cf-5baa97e3cb36", "indicator--7044973b-461a-46ad-8c23-b5ea4097b2bb", "indicator--c858978a-7999-45a1-b9dc-05ce9c3c59c5", "indicator--99a95a72-5d9d-48f2-b512-a2f0b835ce91", "indicator--28da78ee-ef93-4f6c-b9c1-417be1f523e7", "indicator--1c3921f3-fa53-4723-9d4d-72c084f73fed", "indicator--666f54ce-5151-45bd-8d88-4d0ea03216cc", "indicator--a95e5f0d-bf45-4e6e-bf1d-60501e141736", "indicator--16139a08-0894-4dad-9514-65a4d18612d1", "indicator--bb2a251d-80f3-4bbb-8bf8-298046776f35", "indicator--1c92251c-0bf5-4e8b-b08b-22bdf28cf935", "indicator--a7350c00-41b8-4418-a951-f600bad01ab3", "indicator--9b5f8cfc-ce1d-463e-9852-035c619294da", "indicator--160f2a2f-ea29-4790-8c74-186267ff73f2", "indicator--d037bb5c-ce83-494b-bc6e-af37c949cb83", "indicator--63867894-22fc-4f88-9f30-95dfb0079cf9", "indicator--435a8ea6-d42b-45f0-bd78-a26a583b0f08", "indicator--abea95b0-e4a1-466b-8956-581ec41bf19d", "indicator--847f70b9-58f8-46b3-a228-261426cd1e91", "indicator--36e0c469-e004-4c77-a28a-a3af21ccbdb5", "indicator--ba691e6f-6495-4c31-900b-54b4dafec45a", "indicator--10b59f64-2f96-4198-872e-233a2a8356ae", "indicator--e6f6bea4-e062-4297-a123-c2d5f281509a", "indicator--8760351c-1cd7-428c-8f77-e9cb3aa34173", "indicator--28e5208e-f7f7-440e-bbf9-a630fdba7ab0", "indicator--27df5ef6-1294-4e98-b063-d88395d3d0c3", "indicator--50c7412e-dfd6-4502-a26b-e807c43ba685", "indicator--16d5dc4d-e5ee-4838-83d7-66b41171734f", "indicator--7f79be64-87b1-4f02-a5fe-a827b28150d0", "indicator--010d0064-6b56-44df-a46b-cf64510261be", "indicator--aab613cb-a5d9-46e6-810c-a901f743fcc9", "indicator--e7471a98-8c89-4af4-b8de-1960ef841a2e", "indicator--74522c86-1901-4a1a-93fc-d2895d824b8a", "indicator--ea3914b4-6c76-4733-9f67-eb0af99303a0", "indicator--04049bcd-44ff-453d-ab9a-1eb8d3ccb2f9", "indicator--a108b4e3-e257-4b0d-9845-b0e596037b9c", "indicator--1dacf780-4568-4824-aa34-5be0846f1c03", "indicator--cac224bb-2e34-483f-9d04-79ce407f0484", "indicator--b609d343-2f7c-4430-9e7a-21338abe967d", "indicator--5f469882-4be2-46a1-87f8-2fea2d5f903a", "indicator--cecc93f5-2f44-44fd-b73e-2e405748c487", "indicator--534bded7-37a5-4d4c-a54b-3fb7c5ac13d6", "indicator--2bf199bd-3fbf-42cb-9de4-0100f442804b", "indicator--55aad2d2-c6a9-4310-a227-a25c56bc8a96", "indicator--d6406b0d-ef3a-4227-b27b-d01285bd2879", "indicator--ad42ec91-5b70-449a-a85b-c565c03c05e6", "indicator--fafb2fe7-cdee-4d82-bd91-1d7bca074cfb", "indicator--01047782-5439-442f-8d8c-f1f483153363", "indicator--2324e6c2-6f9e-43c7-b69d-a647a1edfaa4", "indicator--cc89029e-ea8c-497d-8e2e-4254f40cb9d5", "indicator--f11cda4a-a980-4cf3-a081-b59f4e4dc016", "indicator--2b685e88-b4d5-49b5-8fc0-36798bf2e26d", "indicator--ae3c74d0-c1c7-4db4-a8cc-796bf6395d8f", "indicator--c0283fd0-3e86-4762-bb4f-1429330dbe46", "indicator--87460cee-97ab-417b-857a-d2dbfa59bf9d", "indicator--54a0875f-4473-46da-bb7b-a739b162bc26", "indicator--5ae2fe4f-7346-453d-8eac-40915adf119c", "indicator--2128f7be-f79b-4d60-bfea-f23c522f14ad", "indicator--74e86fae-dfc0-4bc1-952b-7884f4168a8f", "indicator--c36388b3-43cb-42a6-b72c-526579d9dc51", "indicator--e824cf7d-22bb-4ddd-8251-21e3fd31170c", "indicator--8b8752b7-4104-4b08-99d9-e9d44eb0a9c8", "indicator--49c996d4-4d4f-4d17-b8dc-24c165dc4688", "indicator--4c85a4d4-b054-4bda-aba5-071dae048716", "indicator--09ab0ddf-a78c-4611-9b22-73d72026aeed", "indicator--92f1a3fd-a15e-4276-9f5c-ca1b32114501", "indicator--10de3714-82ba-4f38-91d4-881c9c6d013c", "indicator--c58061ea-e0f3-44f9-bb17-db54455b34ff", "indicator--3d19ce2b-7ff0-4b31-953f-f74f057bb27c", "indicator--da928a5c-bb7f-42bb-8792-52d0b0aa0ab2", "indicator--a9dd92bb-d84f-44d8-b2f3-d2507e7994c8", "indicator--4bcd4ff5-bf95-4075-af2c-73d9c71eaa8d", "indicator--a6c15498-0de4-458b-a426-ea017b289351", "indicator--7aa76ba2-3966-4cd2-9be0-50f251e12540", "indicator--6d572991-f528-406d-8a9b-6662b6f39965", "indicator--a004639f-46aa-4155-b34a-397fe3b236d2", "indicator--4c7cb538-bfad-40a8-98b6-27c8e8aaae3a", "indicator--e2a0344d-d900-498f-8e4f-af91114277cf", "indicator--7239b174-0457-43c4-8ea3-d00a19d4f1f9", "indicator--213dc033-695f-4517-b88f-1823815ecd9e", "indicator--c07f87c8-8766-4bca-900e-23c7c0c7ebe4", "indicator--86425841-32b0-4454-a6fb-b7db55db638a", "indicator--caeba06c-126b-4b62-816d-97d2598dadd4", "indicator--8c4317b7-27ee-4c5f-8ebf-451d5db03092", "indicator--dd035c83-f378-444d-92cc-474f5d2aa841", "indicator--c34231ae-d17a-43c2-beee-ce5795b9f446", "indicator--09f51dd7-e498-4ef5-affd-51f33cf5955e", "indicator--ca5cc23d-c617-4cdf-a848-245fa06417f7", "indicator--9c91e46f-7109-45fe-8468-90fb915842d2", "indicator--fe3d4c30-f340-4666-8068-66c81e3a68ac", "indicator--ffe46f0a-3926-49dc-8c42-7be8b196a197", "indicator--0d735d0b-a2b9-4293-a6dd-7d7a8640831c", "indicator--294719ee-a530-455d-80e0-14b196a4f3bb", "indicator--f1bcd03c-eefd-463c-9eec-b45353c25778", "indicator--d7b312c5-13ba-4f77-a615-257d7db5056c", "indicator--3eb629e3-0eec-4027-9bc8-eff969026acc", "indicator--6134e942-0ae1-48c4-bb21-5c2ab2aedb6b", "indicator--dcea4700-bf02-4203-90f8-33d97e4a200a", "indicator--c2e575e9-ffd7-4ca2-ae50-d4ace68013e3", "indicator--1f54155f-ed90-4630-8801-b51e5b3bcbef", "indicator--2e4a4c0d-6143-4b27-aa65-c5e990efb12b", "indicator--fed0e16e-0135-4300-bfc0-9e04ea89b518", "indicator--99717759-c430-4254-86b5-952c00f449e9", "indicator--adb4dbca-af90-48de-9b89-f228ab04329c", "indicator--80e61ed2-b30d-40b2-89a2-78df91795a85", "indicator--8256573b-58c4-4766-a7a0-6b401c7d15ee", "indicator--c94e8eaa-738c-48c4-931e-9fea183477a9", "indicator--18c46ca3-deb8-490f-94cc-005d43c11cf7", "indicator--85ddda13-87fb-4926-ad23-a317ab6d075b", "indicator--af5ff636-ff64-4c1d-84b0-8663e1590320", "indicator--33346248-4fbc-414a-af52-9a3c2a29ea81", "indicator--eb241fc4-6cda-4468-87ed-4daa737cdeb6", "indicator--c4313493-2984-47db-8d7b-a88a079688af", "indicator--7a8cc554-ed8a-4ee4-9b5e-0c04a530f2f0", "indicator--062e0e32-1d0e-4b63-9b0e-2f1f2f1837b7", "indicator--52391058-c415-470d-8fa8-1984d8bcec02", "indicator--78417989-331f-4e38-8ea1-d6928a15bd4d", "indicator--ec65d2fc-5022-4beb-aacf-82f1196c61a6", "indicator--02da3373-a35f-4e49-8bf9-d646ca60dd85", "indicator--053f2785-14ac-4ea5-a5f5-d72a29e522ab", "indicator--8a9a516a-8d2e-490b-a54c-c7d0f8fd8791", "indicator--6ab98924-7ad0-48bd-9559-05d90e3e62a8", "indicator--08f7b77b-d4d8-4130-81a2-86a3b03b41f3", "indicator--3b072ad1-9956-4609-b36b-695456d99eae", "indicator--f44316a5-86b8-43d8-bac0-3a5da5f1fe7a", "indicator--32e151d4-eabc-48ff-bfd7-a28c89c805a1", "indicator--c25aef3a-15d5-4fb0-80f0-2b2037400163", "indicator--6c066a21-3291-4e8f-8752-af9eb7bec591", "indicator--d3a0dac3-266c-41fa-9a50-568679c6f812", "indicator--c30cfe33-05cc-4a58-a641-ac566d5d3ddc", "indicator--88b1d981-bd8d-4ece-8408-0e7e06d32405", "indicator--a4fab777-96ca-418b-9532-9a87efd7a199", "indicator--e97026f7-aabb-4bba-91ab-6e65c5380a52", "indicator--4968f45d-4214-4b44-beb8-75dd63fbfcd9", "indicator--02d1f2a2-6cfc-4d21-95ca-e6315e6ad496", "indicator--ec294648-1ad8-4357-aa50-d7be4da36c6b", "indicator--344d785c-0db2-43d9-85eb-e3fc76aca2a3", "indicator--bf2720fb-f821-45d8-bd12-e4cacbb59d98", "indicator--ab512b40-a98a-488e-80e2-0e60b120c908", "indicator--1db4c9dd-a0d7-4982-8815-7c8026e5bd5c", "indicator--436456d8-d0a1-4c1f-be8a-dafde1f126af", "indicator--7f0f698f-e6b1-4951-be3c-c7de4a355058", "indicator--903b9a64-345f-4bfd-9ff4-bbd007f9868f", "indicator--926fdac2-cb63-454b-8d0c-4fa5ae13921e", "indicator--0d5ea210-348b-43fd-8a0c-bfd418f40418", "indicator--e4c508ea-275a-4e5d-a200-7d229e633ed7", "indicator--c5d8031f-4f87-4ef0-b9b7-2ada34e74a00", "indicator--9e5a509a-d85e-4b33-a775-59642b98142b", "indicator--c489a80d-a168-41e0-bb7d-166e30d48d2b", "indicator--e0ae23e2-c5df-451f-b3cf-6eb5755f496d", "indicator--a5052e49-8d05-4417-b9c7-15c50bc8d102", "indicator--185c49d1-d175-4be5-83b0-65681d066c38", "indicator--d8c8d9c9-2865-44c7-b208-6bb2bb2948fb", "indicator--164f9af1-d86f-4e4a-8bd2-98e21fe3eae8", "indicator--cd61258e-a049-4b7a-9f8c-76b3e52cbc72", "indicator--ab1e3f15-e527-433e-907b-99a3f446e685", "indicator--afea2eda-55b9-48b1-961e-0e06cb48c7db", "indicator--5d8058f9-6d53-40f3-89df-601c1b96c277", "indicator--f596b7c2-3ac0-47d0-9e80-bf117e09dfe6", "indicator--2344f899-5985-4d1a-8cbb-1864d2f1816d", "indicator--30804179-b560-4e89-a2b5-ef9774a493d3", "indicator--276679ae-8988-44a3-b5b4-625f90dcc73a", "indicator--64060310-8244-443c-9f06-b63990e4786d", "indicator--2655c0d8-743f-4ef8-aa78-b6395520db2b", "indicator--6c99602b-b733-4ba3-b3ec-99f23578dea5", "indicator--8366fbe4-dc90-4afa-9d58-05a4ce42c8aa", "indicator--1d11ae53-7532-4e05-9365-0f678d115b27", "indicator--bce5e330-a819-4143-9190-2068c4d1cfe0", "indicator--e416d5e0-c36b-408f-823e-b2d7f0821914", "indicator--f939fa0f-46e2-4f6a-97a5-c106c730283a", "indicator--3e678bae-5203-4296-8e03-8fdd5b9287d5", "indicator--2884f4c6-e9a1-4ef3-acde-d1bc3ef77efa", "indicator--7cb5c76d-93d1-4e7d-8755-e4f9fe42f39a", "indicator--3df22e58-f253-4cf6-b1ee-57f6ff9ccd08", "indicator--760a476d-30fa-45a0-b2a9-fca5a86f3300", "indicator--82ff1ea8-79a0-4971-8496-62e3de2dc67b", "indicator--8ccd758c-a8de-447b-829d-505411ed74a9", "indicator--93dae356-404b-412c-94b9-d9daef2fd9df", "indicator--5621bd05-99db-4c7e-9027-27f4ce7c1865", "indicator--d3de9c2e-9fd4-49aa-8d94-a6da04da57a8", "indicator--1b535b4b-6f72-4fbf-911b-7ef4f1c2632b", "indicator--38e96e5d-d1d4-44b1-9b68-9d99d1e3a5d0", "indicator--53a107ad-5c0f-4d37-98be-ff25a8a09801", "indicator--25a0688a-50ea-445a-9956-b91ec4039b06", "indicator--b877cbd4-3d1e-4c21-899c-449faafe70df", "indicator--2f431261-ae6f-4a01-948f-f5773e0d8a3f", "indicator--dd3c3e93-d35c-4046-9316-aa361cbc9055", "indicator--50161a25-d622-4169-96a3-8979af730d0a", "indicator--48be25fc-6649-46c6-ac60-6d7ef8d6b2d6", "indicator--2d355116-7069-46b4-89b7-f65717cceb6f", "indicator--aaadf063-2b5a-4737-a77f-30cc422d23de", "indicator--2e1b63eb-c5d8-438e-9441-ce7609dbc577", "indicator--cdf54ec5-8938-425a-9d89-0a88c6f0b511", "indicator--6da91aec-82b8-4c28-af30-d96143d71c20", "relationship--54da3dc2-921c-4e45-8e90-1b0e70d97a1a", "indicator--339e2137-5cb8-4d20-bf27-a6da60b58dd0", "indicator--f2a7b6c7-2818-4d1d-8ec0-8ec4ea1b62c9", "indicator--ece6ebe9-5042-4a97-aa20-b914ee907a4f", "indicator--69d42c03-a89b-4fa3-a1b0-f5a8e1f31a49", "indicator--5a63577c-c7ce-424e-80d9-0e2af19d2b9a", "indicator--5856c0c5-2606-498e-9c31-c38672d04aa7", "indicator--f27e2234-7572-4266-b6b2-7b463c28f4e9", "indicator--136a1580-839b-4d76-b859-c500421e705c", "indicator--7666cf83-ce49-4e5a-9733-57a99dcdf676", "indicator--5bb0fd37-3f0a-4284-a39d-aa5d5b065392", "indicator--38db32b5-b5a2-46f0-b6ee-1873b7cd9f64", "indicator--9359c4d7-3722-4087-b0e1-ab985779d916", "indicator--d477ceff-de66-481a-acdb-0d675de9f2f5", "indicator--b168eac1-0875-414d-a5ea-c6c359f73b16", "indicator--92688ea0-8311-4e3b-a5ce-6a6edfc5b46e", "indicator--e361f283-ea09-4275-8f60-d0fa28f6e0a6", "indicator--60967c84-8dc9-4ef2-a361-7d95170c1eb4", "indicator--5d66a09f-342f-46b9-8259-7b7a328929f8", "indicator--2b459192-8ab1-469d-83f5-e094b3e26180", "indicator--440ed617-6834-4d15-b730-16069b77578f", "indicator--5e3cd5b4-ce16-4f57-9664-bf901e58ae2b", "indicator--fc639075-7559-4380-ba53-45cfc6194087", "indicator--27a00ff0-09ef-4108-ab81-b5157323b1ea", "indicator--27a8381d-1b3e-4b2a-84ee-f816e3fafb85", "indicator--800aa807-a01f-4ac0-bdf8-83c06c8bb909", "indicator--bcd2fb6e-88e2-45f3-8725-6cb7051ffecb", "indicator--053bbca0-6976-43cd-b9d3-7ae707dc7eb9", "indicator--8cea021f-4ca7-4c24-8b55-b51304488aa8", "indicator--09e08a5e-87d8-4d06-9008-c5751034fba2", "indicator--3af26253-1899-461f-92bc-a14ce46088c8", "indicator--e66ac102-fcdf-4ce3-985b-4e015ad870c6", "indicator--8d0c5d23-850c-4fc2-a05d-bd7df4e26b2c", "indicator--00d755c2-d75a-4fd5-bbc8-ba30ac72eb23", "indicator--d631d05c-b93b-46ca-8d27-be4e8e49498c", "indicator--c1c11296-94bf-4ada-b8c7-8bdcfcb14096", "indicator--03dc2479-cdc1-490b-9d6e-768a0bdab6bd", "indicator--d78a3bc8-4b63-4602-aea7-6c201fada872", "indicator--2d3e2979-ed97-4758-8f58-e2b2647ef7e8", "indicator--cfc6b1bf-c9f6-44f0-8763-b22917ee8783", "indicator--4a26e130-bd04-4b0d-945a-fb4e806820e6", "indicator--7a3b6b69-d3ed-48ba-9ddc-74d549c921f9", "indicator--e9d069d7-7ef0-420c-b48c-94d0dda903a2", "indicator--dbaf0a44-0c48-4145-b861-04a7228cac0a", "indicator--3902b494-692f-4107-bb82-b9d9a412b970", "indicator--309a853e-37eb-4e05-886d-3ea4d2b75db9", "indicator--b445ff63-d3f1-4c38-8fe9-bf49c486ed58", "indicator--7b4b2888-02e8-43b6-97d1-8c829cc27aa9", "indicator--dc9cdbdd-0069-46d8-bf5f-2549bd0b7ff6", "indicator--187745ab-136f-4cf7-a2cf-05dd0431c0c9", "indicator--a9644d48-fdd0-4ea1-b426-c3642a335633", "indicator--f0098b8f-2a3d-4788-ab1d-003fc9a207ac", "indicator--7458dedb-e286-410a-9f4f-31ade071592f", "indicator--5e8e30e0-d932-4e70-97b7-3a9edf6ee429", "indicator--129278c2-ec3b-497d-b3cd-32c69eb58ff3", "indicator--e12f676d-0afd-4b74-9810-b51d2e3953ef", "indicator--4246ee6d-a844-45a7-8731-583bce02ae84", "indicator--ca380c9c-7cdc-4b2b-bbdf-066cea8418f8", "indicator--2a4d717e-4681-4fa6-b2ed-e4f0df110009", "indicator--1b2ba82b-1c28-447e-bb5c-c4a48b4be2f0", "indicator--1e6c9654-25cf-422f-80ca-d240ef61d6c1", "indicator--17fcb63f-518f-45de-88b2-964db7998887", "indicator--230a6820-b1f4-4b89-8af7-ca5c4991fa08", "indicator--8c3f537f-ba02-474d-8bab-ff1899753098", "indicator--cf4119c1-05f6-41b8-be00-126e43d08b36", "indicator--c7715bd0-7c65-49d4-8a9e-7b7766ec8a6e", "indicator--4ecaf125-6cb4-4788-806b-1bbfa8414d44", "indicator--bb8cc45c-151b-4e05-9614-cb7102316c53", "indicator--d7bc639d-0d1f-4a57-85bd-1295efedcc20", "indicator--750c0c1b-3b24-4776-bf54-5a057e586827", "indicator--b7a5a16b-24e1-424d-a0f6-a2e37e3d7fcd", "indicator--aec5221d-4cc7-4a4f-bc4b-905b5d0e2441", "indicator--be01cff9-2ba5-452f-81b9-f29a1fde38e1", "indicator--965f6fcd-61fe-432f-88e8-fe637a5c0a63", "indicator--4c937e1d-f631-4c92-a4eb-8b0232d602a0", "indicator--110b120a-154b-4cc4-8d50-1af5489ca57e", "indicator--c772fb91-1836-4eed-bab0-082b80b5bf46", "indicator--6907af8e-62be-445e-ad20-ef75cab4d67d", "indicator--ac6e8f5c-b0e9-4f54-8c4e-fb0cb7166f1c", "indicator--e4bd4a37-73a6-4be2-9cf1-0380619fd412", "indicator--2cfa829c-0f71-48ea-9920-30bb3aeb21c0", "indicator--ee670a6c-a53f-4352-b499-ac228e3ced18", "indicator--5aacb300-626f-4969-a75b-b32c7fb99355", "indicator--a403a7f2-980f-48ac-ad3d-101389d706f8", "indicator--8350e189-edf3-4355-9e9d-315f8562c39c", "indicator--519b1b90-d763-48ee-ad9b-338d99387818", "indicator--a48b6b76-e082-4687-a03b-23dd1cec62b6", "indicator--aac7ae9e-5788-4fe1-bab5-6bf3a4d79886", "indicator--3ab09ff9-4403-4f34-a3a7-b111535194af", "indicator--5f3b6f64-8b3e-4b7c-9eb1-2ade5edd4dfb", "indicator--bca56cef-aca5-4a1e-a46d-a767e255d82a", "indicator--5d0450b9-867f-4e90-adc8-cfcc88c7bab2", "indicator--d6e582d9-f018-4b57-ab5c-342c290149f8", "indicator--16d63beb-aab6-4fe6-b27a-2dacb21840b8", "indicator--e7524994-6eae-464b-8f6d-cbb9cc140004", "indicator--52a68f1a-b2b5-4294-b02a-0f0a2e13a931", "indicator--3dd90351-4a56-457c-b34c-22b9f9214d88", "indicator--ab2ee8ce-9f57-41b7-8f02-f3a0a4b1c229", "indicator--57a532a8-d686-4bdf-a8fc-2740f174bb5a", "indicator--07ada45c-f6ca-47fe-a756-eb2c74a74192", "indicator--5daeae92-6474-46b4-a4a7-0934fd0ba557", "indicator--8c29ec1d-4fee-4fc3-9778-a22ff89282db", "indicator--c5dcc9fb-8167-4849-a55c-255e91461a6d", "indicator--6fc92423-974d-4bb6-9977-158ed56bd7e6", "indicator--1980cdb4-2912-46d5-a265-196198392a7b", "indicator--63e27b1c-a64c-4d53-b618-ac9dea1933f0", "indicator--37a2aa8d-140a-4aca-b28b-41cfa47b487f", "indicator--d889e05c-e25c-4901-8c11-0208ebd22b85", "indicator--2795f9a7-a163-4023-a4a7-a904bdad1f47", "indicator--b3078b4a-d067-450e-8d43-096135a5344c", "indicator--215a462c-45f3-48aa-976f-38ba952f6416", "indicator--22bc53a7-b89a-4878-9b1a-f7d3a0906a3d", "indicator--49e3c9f3-ea2d-4b83-8247-766cc3fd0f0c", "indicator--261496b5-3568-46e5-94cf-9d17d797678f", "indicator--e8369ea4-40ae-47b2-955a-e88a38523195", "indicator--1168dc3d-7107-4b3f-a7a1-92ab29a3a3de", "indicator--854bb284-9127-42d0-ae3b-3d232f74ff07", "indicator--51b5a25f-7f32-4a7d-98f1-e04e4fd2ddf7", "indicator--38f9546e-398c-44ab-bf57-ed07d4c26d51", "indicator--832b726e-0ce1-4849-af8c-870699b96634", "indicator--b27307ac-7503-4ab4-846c-17b690c642d9", "indicator--ef9d719c-081f-46ee-9ccc-6904714fc9c0", "indicator--5b3a7afd-6236-4026-b531-035e69136faa", "indicator--6917d264-8e1a-4895-94c9-c709b9363d0f", "indicator--e67f26e1-92a7-4291-a7a7-4348087bea77", "indicator--955a9919-107f-471b-a726-5712c229511b", "indicator--2f2fca4a-7afd-4890-a210-09c046cff642", "indicator--115f68d8-f2e1-41a0-95c1-539e95e2c5b3", "indicator--73fc46d4-a460-474f-b6b0-0ccf7f76c82a", "indicator--cfaa61f4-0555-47f7-a2f7-9557c7c5379b", "indicator--1f86b6b8-45cb-4e60-8e4b-f211bd92a9fe", "indicator--2485190d-c610-4cb3-89de-9fd4b382c881", "indicator--eb6b40b4-dd6a-46b7-bf3e-f567f7b8a155", "indicator--ab7c2365-2810-4aea-b5d5-e8a6e3ea6bff", "indicator--b73bc0b7-5fe8-446b-8c0b-6d858278ba50", "indicator--52583963-ecdd-4a67-aa31-6f4d98733e79", "indicator--d2b4a663-24c0-4e87-aad0-bf8033cb01b9", "indicator--42110688-d9cf-4279-b531-9725af0424b2", "indicator--d0f5082e-d9ba-46a9-a4a6-4457bbe72964", "indicator--511112de-2082-414e-9803-0928e7897b87", "indicator--6e0679b8-7733-4e28-922b-39d887e961b9", "indicator--e3d7dd32-8e87-401f-82d6-9abae31f3472", "indicator--9ecb8517-f303-4144-ae88-ab98671ea93b", "indicator--024636af-b5a4-456e-9732-64f4625d9f92", "indicator--9539c7b7-5fbd-44e1-a6c6-b41902f045c9", "indicator--fdd22dc5-bb6a-4f09-af11-72d6dc0d84a4", "indicator--0b07ef83-0ddc-41f9-93c3-56af4961e5e5", "indicator--b2394436-433b-47f5-b0c1-f935fedbfc2b", "indicator--64187a45-48c5-4404-ba0a-528fb21d68ed", "indicator--6e698344-2d5c-4983-b535-87a711b0a15e", "indicator--d632e111-2a57-49bd-af79-a659cd071ac6", "indicator--168e1981-4e58-4c65-b11b-3455f017ed77", "indicator--5f5d7e0f-43da-4d7a-b4b5-fc0e8163620c", "indicator--efa8ca53-074d-4fb1-b28a-75d9578e6753", "indicator--0c9922fe-c257-4d7e-a2b6-25ca27177a3c", "indicator--1a69aa33-e56d-480c-93a8-0be489dda4a5", "indicator--610903d4-dc53-40aa-8ccf-0bb2f2abd313", "indicator--07b6878f-faf5-490e-945d-fcc2679211c3", "indicator--475a8261-25ec-4173-a867-c6dec141069f", "indicator--325a6ea6-c00d-417b-b761-7163dcedd9e4", "indicator--41c3ce68-dece-45ad-9e74-0d58d92a19d4", "indicator--c7f91507-b793-4685-a5aa-caefaf724925", "indicator--cc3fbe18-f0b8-4d71-998d-a82354d33698", "indicator--29f1e8ed-50fc-417a-95b1-77d5e8297da6", "indicator--ef5e45f6-06c4-4742-9497-2c2630711781", "indicator--6e287c95-10b0-475c-aabc-1b7a79780ea6", "indicator--4dcc7426-1cdd-45e1-ae49-a71429564e73", "indicator--c30fd006-2890-4e84-864c-55ec83f9255e", "indicator--ab4bf623-9e87-4b3d-8aee-ce8596878e3e", "indicator--b128b43c-9126-4fa5-80e8-336f4d73c246", "indicator--b91937fd-be2a-428d-912f-597d0f05696c", "indicator--11ade6ae-5f4a-4be5-956e-a14176187f51", "indicator--6523ed1a-4812-4997-8d68-7e6958478d38", "indicator--493f15f7-4a96-48b9-a18b-f4c266a3b779", "indicator--6c9362c6-4749-4b08-bfe0-ba90e95254a6", "indicator--441315b8-451a-4d85-83d9-fa0fa232006c", "indicator--871baa55-4aa7-4f02-92db-a86efd8e3adb", "indicator--67d8f70e-cd13-46fb-8f89-b22a48aceed3", "indicator--03971f97-d820-470f-a47d-d4752ab85e57", "indicator--39959551-0649-44a1-99f2-c762bc268bf4", "indicator--fd4f9af4-2ed0-4bff-b12a-bd5a619eaeea", "indicator--1286f655-0d37-4503-9137-55e1d4ab13ac", "indicator--63dfa406-bd9e-4575-8ba5-06db00a64ab2", "indicator--efec2ba5-dc0b-40df-ac4b-3289b68a8902", "indicator--e272d9c5-8a38-4be8-adf4-9729c26d3630", "indicator--91e52fb0-6d2b-4b23-8f93-bde3962f1f99", "indicator--b7949591-a61f-4c0e-b2f7-68da765c8b6f", "indicator--1f07eea0-15cb-4817-a4aa-1cbc6af76b52", "indicator--1f78e067-cfec-4f5f-99e2-51595a92c52f", "indicator--2643f23c-66d4-495a-bc2c-ec1e8e81e179", "indicator--ef01e6f9-1ead-487f-9ada-c8233b4880ae", "indicator--040c22a6-07f9-4d54-9b0b-1730d0c25d74", "indicator--010025b1-e1aa-4ea0-9221-5b2fb9a04f73", "indicator--3f2d1a8f-c48c-4b20-9cda-9ca0f13ccf9d", "indicator--90a492a3-3c69-40ba-ac01-8089119fbca0", "indicator--eec3d084-daa1-4041-aae8-0a3c40e9003f", "indicator--27e53609-5c44-43f8-86ee-1d942dd76f72", "indicator--9bb86b41-d4f0-49e8-8b36-daf4aeba40b0", "indicator--c2e6f412-85b4-4150-8b54-0f6fe93b9466", "indicator--8fc364ff-8822-4c23-9f62-1a4940238e5c", "indicator--ddc1054f-cdb3-4cce-9e79-18704a7dce8d", "indicator--2ac98cca-6123-4a87-b397-1ce02cdab28f", "indicator--3980ad6b-8061-4572-824c-43073080139f", "indicator--c2361a5a-9363-4ed0-a103-f3eac3495ccd", "indicator--523ea7cf-d168-40c4-ab4b-754dd91d1f09", "indicator--f3f1e60b-3cc3-41a9-8723-f39ef5e1e501", "indicator--c6b70a9d-7db8-4689-b27d-186a18cf338f", "indicator--826f23a2-1279-4a56-93ff-c4ec7a1780b8", "indicator--9684c357-eaf8-44bb-92a4-095b321213f2", "indicator--73f9af31-1c74-4679-9ea7-49077cd4a3cd", "indicator--99ec1dd1-6545-4019-b1f5-2c6e9bcebf9b", "indicator--fd12167b-128d-47d2-83f3-5c7eb78c56e5", "indicator--0f4e01bd-e7ff-4012-b960-ccc2ae7ce6fd", "indicator--b89a1c2b-92eb-4648-8f48-d4d459d61296", "indicator--fd7fa1e1-6236-4e52-9db3-d006614d8f09", "indicator--995afa43-43f2-42c4-bff1-df13bbf40f29", "indicator--1dafb13d-2363-474f-9c73-e428871da9d9", "indicator--b853ce6d-5d8b-4663-bd37-3816052c448a", "indicator--f28339ff-82a5-4520-af98-e06bb88fe5f7", "indicator--a0fe1d91-6856-4d78-9452-3c4044af4ff2", "indicator--e2557604-45db-4476-89cd-82a8edc8757d", "indicator--718ddcf6-d868-4fef-92b8-61eff37a0c4c", "indicator--429ae785-70a0-4db4-b8ae-de9715e5c45c", "indicator--311a7b66-bbac-4a86-8d53-282aec6a1c2d", "indicator--b977f626-9d84-464b-b3ca-c73d00c018eb", "indicator--390c48aa-a593-49e5-92a4-1cb4cb7dfa47", "indicator--8b57d7ee-9f4d-4be9-aadb-99eb44cb8ba4", "indicator--be3419bd-7c8d-42fd-ba68-25db0b1a4f3e", "indicator--6a3d8139-012b-4c69-b2ec-e6bd057dbe1e", "indicator--e0ec7fa7-3199-48f8-bc21-6b6cf30f2894", "indicator--ab82ed73-56b3-4e27-924f-0cda33557453", "indicator--1aa47031-df67-4635-8051-8eaa90f72fb5", "indicator--1c75d91d-41d0-4ebe-8c48-ec945fefb82b", "indicator--b406e5e0-39c7-4b50-82d3-c25770c71ad1", "indicator--be9837b3-f1d6-49ed-9256-69ae89e60001", "indicator--ae3fe816-04af-4d05-babf-9fe2edad2b17", "indicator--df216acc-8e2c-4227-ac3e-2efb6547b5aa", "indicator--b9615d46-7e9f-4340-a488-534c7f7a2729", "indicator--7128efba-5cf9-4ffd-a701-4e7ff511841b", "indicator--6c53e43a-609e-4558-bcdc-2301e01c83d3", "indicator--41613623-a69e-4a38-aa76-1e3dfe282204", "indicator--f74c353a-c5e8-4bb6-87fa-0aeb44f9dab4", "indicator--38084297-e431-4e40-8a9e-be38e3d72f21", "indicator--c625ecce-25b4-49a3-a252-083a5ca81a58", "indicator--4fe409ab-3cc0-471f-a3c2-3a4a8dcb17ed", "indicator--eff7248b-e2c2-4810-afe2-b2c83d5e2ac8", "indicator--61a4d1d4-98f8-4652-b21d-486586c29471", "indicator--caf033c0-907d-4b89-8a85-fcf38893b66d", "indicator--1e910178-5616-4ca5-946e-cab32cabbd0d", "indicator--ba081c7f-23cf-4cca-8eed-6961c8043cb8", "indicator--93554704-835c-46b5-9bfd-9d84f546db88", "indicator--a8e799e3-fc89-4b03-b48d-48eefe5a45c9", "indicator--2014f852-9a37-4bef-a37c-b7b631309b84", "indicator--32b7f7dc-3cb7-4b51-9e1f-512acd8a4ccc", "indicator--8cb9f81c-90cb-4f9e-bed7-cf2c7ff18f93", "indicator--d9b48d63-cbbc-40ba-9d47-3a144f785d5e", "indicator--457aefd4-7021-4bcf-bfc8-f15a0aab57ee", "indicator--b46e01c3-3ea9-464f-875f-d4a7f1a29a53", "indicator--2f8dc68e-be46-4335-95a8-c52881001c6d", "indicator--dd51f7e1-792d-4877-b564-f7182df5fbf5", "indicator--0f17a614-a35f-4083-92b3-1b509cd76306", "indicator--0f7b0074-c08a-4176-a319-848009fff0e6", "indicator--212a6de6-4daf-459c-8991-f0d77fb38aab", "indicator--ec9e30f1-ac07-45cb-abb3-c9b8071c2ae8", "indicator--166cb469-7442-4e07-b055-fb68c5dc990a", "indicator--03f18592-f747-4686-96a3-d8b0c70fed77", "indicator--273920cb-4810-4e60-81c1-233e03ceed17", "indicator--4e2abe8e-db1d-4897-9a82-7db68170d1b1", "indicator--f28b150d-f69e-4b2c-a88b-e375989c3f4d", "indicator--ccb4e9be-4e2e-4a19-b553-b0cf07bfbb40", "indicator--e8822b9d-3be0-4976-b386-9c5c3650c70b", "indicator--93090e79-79e8-489f-b6c4-e01c9b1db2ea", "indicator--c7980591-6c6b-46c9-bcd1-b5ae503beb5c", "indicator--96152245-1853-45e8-af2a-e42c239a5083", "indicator--0ea5fdb2-eb47-48a4-ae58-19c34ad50ba8", "indicator--6880ddd3-b0e5-439a-8c57-dbc4289b5560", "indicator--a0a43a84-1912-4718-84f3-871181eaaa86", "indicator--7661bcd0-075a-4c0f-b9b0-14ac612b10e4", "indicator--ae08f0f3-8db1-4883-a011-2917fdb14fce", "indicator--66e4abb5-a2c8-45ad-a19c-876eacbda657", "indicator--185faddf-f7f1-4b4a-808f-33aa2205f80f", "indicator--6b3afb84-892f-4fea-8dda-15348fb3e880", "indicator--87931118-fa00-4a0e-86a2-6e1c0cb08399", "indicator--95dfbd34-c0b8-4ee6-8f07-bc6201cd9c40", "indicator--5618080c-e8e4-4f99-a146-f2104965926a", "indicator--2ccf7010-9bb4-45d7-95e1-ef0b2f083a1b", "indicator--f5c0a61d-02bc-483e-9f9a-df2ad92d5915", "indicator--c9671471-4076-4b4a-99f1-faf39f46678b", "indicator--31a25246-2e41-4704-8db7-7bd028cd9d10", "indicator--e759f4f1-ce8f-400e-b791-568a8257a482", "indicator--b808d461-1602-4d86-be05-c234a2ca12fa", "indicator--a837a8c5-69f5-4fc3-bf05-1db12797845d", "indicator--548e2a31-5cef-487c-8243-43afc1402565", "indicator--2bd4d114-4ed2-4d1b-aabc-d959be6a61c7", "indicator--7cb468f7-3b27-4145-afb8-9227b10bd0c8", "indicator--fa1efa7c-8245-400e-ba42-80c5f5bbc8ca", "indicator--0d088bda-e79a-4afc-8a70-b3c7a394b0ea", "indicator--be52edc7-2b23-4732-895e-2e2b9d9d1eaf", "indicator--d47bfbf1-0e05-4af4-aa47-b763aaea0eaa", "indicator--2c9e6dcd-7766-459e-862d-9777bce873c5", "indicator--eebbee02-37e0-4109-8d60-9da5c47ce44c", "indicator--1d73f1b0-47fd-433a-962c-f7dad9e633d6", "indicator--26abb4cf-d329-4db5-9712-5c64f39a621a", "indicator--2688ed12-d7bc-4fe2-85c2-b9e687daf665", "indicator--d2250717-f23b-4310-bd8b-a676e47c1a92", "indicator--eda45e03-6c7c-4368-acc0-f4f6ab817bac", "indicator--c00a0da4-31ea-4a0f-a579-08466184fd5c", "indicator--538e15cc-d62d-480c-8d66-521761591686", "indicator--1fb2d248-a768-4a3a-8709-822aeb8abff6", "indicator--958194a9-6f5c-4f66-82db-97a8c5e1ca36", "indicator--c8fdefb2-06a9-41d9-aba8-cd39eb3997c8", "indicator--eff8ae47-db21-4e1c-ae7d-1b451f38b6d7", "indicator--98de5fa5-ecaf-4bc0-9b5d-f2c09aed28ed", "indicator--7574b540-2598-42a5-a1e6-88ae6a77373f", "indicator--34214133-7748-4f20-8c61-ae2a340d64cd", "indicator--211b85ac-5ef3-4563-9be7-5be7bb8b61e5", "indicator--5c63cba0-7300-4775-b77e-ec99d998659d", "indicator--f91539d2-dfba-402b-8e92-a431782fc4ed", "indicator--508015e9-ae63-45b8-8015-5014df50e161", "indicator--b348b0d4-0f9f-4aca-bc45-506ac3b88199", "indicator--f9ec41a4-0e4d-4193-8ea4-febc7a182a66", "indicator--d3ce543b-d83c-4741-ac7a-b20a6a49f56d", "indicator--a9782b09-dc3e-4413-822a-80dd59da330f", "indicator--a4db94f3-7952-498a-a1be-e7ceb322c04e", "indicator--9ca95498-fec0-4338-aaba-e4286449641b", "indicator--3a84596f-1a81-40a1-90a0-cde75596d7c0", "indicator--9e7c5853-5e02-43b4-9e56-8b5b19424765", "indicator--a21188a4-eca2-4b60-997f-1a2b54651402", "indicator--7944a0d8-3e13-4544-a354-c1c5fd31dfa7", "indicator--e5659b45-0d35-48f4-9b82-0a3eadc16502", "indicator--713972e7-35f8-4af1-9588-fc9ecb0ed713", "indicator--01911dd4-7de1-459a-91f0-4befbaa54993", "indicator--492c4b11-31f6-4649-8038-852e51b9d63d", "indicator--a7c0241a-271c-4c8e-987f-3fa232fe2ac4", "indicator--fe6c9134-2f7b-46a3-8914-ea4d176a957f", "indicator--48b1b395-9343-459d-b8be-502a48abfc2e", "indicator--65f4adb5-6d9e-4839-bbf9-d314a7a199e4", "indicator--488adfa2-0cfa-4a84-870e-950e20ed876c", "indicator--8087ab56-44d6-4977-804b-faf8ce50246d", "indicator--c6500fa1-ef29-424d-863d-be197f8dfda4", "indicator--7bb17bc1-0dd6-4a0c-8c65-59cfac196b27", "indicator--41721708-9f80-432e-88eb-b5fa35d0ab9b", "indicator--c658b616-2e85-4b7d-96e1-f2bb096c8998", "indicator--de1dba14-1df8-4471-a6cc-3abf11880869", "indicator--9eccbfdd-0809-4a28-aea6-e617c22e99d6", "indicator--7ac2f901-dc51-4096-b926-148bed8b7692", "indicator--7c0dd96d-42c3-47a7-9151-f3a70ba23d2a", "indicator--46f8b183-78a5-470a-9a97-9ae4cb4cdd65", "indicator--afef1985-b335-45a4-8c40-3c5666bbb201", "indicator--eef45ddd-8a5b-4364-aedf-d34f84a70a86", "indicator--ddf48e71-5f0a-4fdc-814b-b111d2edd544", "indicator--623e8245-1e07-4c35-8af7-fc191c2515f8", "indicator--ed88834d-fff0-413a-af6b-7a1ae181355a", "indicator--d7ca89b3-38e0-45f1-8095-869fa4b40da8", "indicator--6f08f9ac-0b3e-43c6-bbf5-755bd6c40694", "indicator--1668774b-2327-47ec-b6a2-b7f69ca8a115", "indicator--c3f8d64f-3532-41a4-befa-e51c599a0188", "indicator--15aa788d-abf1-4402-b4d9-997ea5da23e8", "indicator--312109ac-bb8f-462f-b28d-f2ed45da81db", "indicator--693c03db-6d3c-47d6-896a-4dcb6c991ac6", "indicator--efa727c3-585a-49ee-ae3c-d9862c705efe", "indicator--7d185f92-a1f0-46db-90b8-a045e1e05348", "indicator--a44fbc9f-67cc-4df3-afbd-6b8cfa45873e", "indicator--d8b10abf-c5c4-480b-912e-ccf10056526d", "indicator--aa7c6bc0-6dad-4d22-86b8-f4b5d8a2dc9e", "indicator--3d0155fb-6c04-4ade-afb5-a4422be3c3e6", "indicator--497e9606-40f8-41b8-8e42-2cf738116ec4", "indicator--a0f36f00-53d6-4799-b9a4-89d87fda25bf", "indicator--80659b64-4438-4831-ab2d-44d09c1f967b", "indicator--8669a19b-6dc0-4365-ad7e-372c4904ea7a", "indicator--e6952122-3e26-4890-92b1-7b4eb419ed13", "indicator--68756e5a-72fb-4c03-ba18-88e97cd045e0", "indicator--129b760f-d214-40b3-9ce0-3a95be8d4e98", "indicator--7fff8796-ff2d-4b6c-8d1a-febcae44ae50", "indicator--0faf3d0a-8dab-4ad4-88b9-8eebd1f7fa25", "indicator--a20dd0d9-bd49-4acc-87fc-f05ad012e4a0", "indicator--e68d466c-d0e0-4af9-96b2-26feab58b335", "indicator--6f716065-2ce0-4e79-a57c-201af36b6658", "indicator--33e56b98-aa12-4ca0-a5e0-acd7de18de6f", "indicator--ab73d0b8-e0c7-4e76-9462-b11dad3b6b87", "indicator--032c6366-166f-4b32-a421-5dabdad9a6ab", "indicator--d06d2ff8-d7cb-4c78-965b-ff48f9184faa", "indicator--2fc65d49-4a74-4ec0-9c50-c5db7a60f78a", "indicator--9eed6f52-a824-489e-9996-54038eba0d5c", "indicator--b86b2929-33f1-4425-ac4d-f585aa61b40d", "indicator--9d2be9b4-f09e-4839-a1a4-67cc741e8b86", "indicator--369ddbb6-59a3-4821-a9ed-30fd6f1957ed", "indicator--25f709b6-ad6d-41af-91ac-bdc4aec1801e", "indicator--ee4ea44f-aff7-4165-87f7-0ff6f43405ca", "indicator--11c39ee5-8f4b-46be-8709-3a3faaac9fb9", "indicator--f29a8d1d-c63a-4902-9f78-97e8ef0fb119", "indicator--909774d8-24a5-4217-8243-d04ef961b4f9", "indicator--5c19035e-2405-4e80-9cfb-4030d015360d", "indicator--c9c90130-cc1a-4ef1-99c5-329e472d77ce", "indicator--5b4e308c-7b70-4dc1-9939-881ca78e1b1e", "indicator--4f152ced-955f-4b98-aa6c-9c0050a4817a", "indicator--bce0561d-c095-4f25-9513-b8672a034d0f", "indicator--10047fad-9c4c-4a4c-b0d2-c41fc8be6190", "indicator--ada523f2-6b95-43d2-9a39-380a44b50bd4", "indicator--1343ad5a-9b95-4f7d-9eb3-515516e89d13", "indicator--98557e2a-3e78-47ca-8dd5-bd2210df9b15", "indicator--a17878cc-cdc9-459f-8deb-635bd3323e02", "indicator--096d8485-d258-4ddf-b752-6222317845af", "indicator--c940eeb8-d9a6-4000-8115-325bfa6a76f0", "indicator--ad35e643-6ce7-40a3-9d94-b17cb95c6f74", "indicator--bb4b1aeb-4135-46cf-9771-02ba95bcc4e0", "indicator--3844aeff-50bf-405e-b56d-19e3b1bb0913", "indicator--b55dd791-038e-406d-a286-ac14ecc3a0bd", "indicator--54a0c5ef-5af1-44e9-a9e2-fe9f9fc2ac32", "indicator--0a14d11f-be0d-4f99-bcd6-8f9421394cdf", "indicator--79efb76d-1342-4aee-822a-8a6466263a9e", "indicator--120ca318-f9fb-45fd-b7bf-e65d07d8bf56", "indicator--a54ced32-c7fc-4762-8114-803ccb4c070a", "indicator--1fea23ef-6f88-43c6-ab29-cc491a8d1186", "indicator--db91c008-1a8c-408f-b49d-c4df9876d027", "indicator--0d23ce76-4ad2-4947-a30c-5c5f09ffb383", "indicator--f35121b4-db3e-467d-aa60-d893f51a479b", "indicator--2528c0b4-498d-47f5-bcc9-80956b7b65e4", "indicator--4751be2f-a30a-4ce8-a3e5-4764bc591621", "indicator--e427ed63-cc11-463f-b105-122f29b7edf7", "indicator--d5aa780e-8dbd-4e12-83ce-137a39688572", "indicator--65628644-52e7-4f09-b46c-5f36f1e1c9fd", "indicator--89bea894-4f35-4e9c-810d-8f89bf94ed96", "indicator--73d81f2d-51de-497a-8af8-19c9164c3b06", "indicator--f40cd485-16d8-4f09-8ba3-4a3e7b03413f", "indicator--ab79b450-577f-4a3d-9542-95c5483981fc", "indicator--364dcfa0-b037-412b-99db-8d135def099d", "indicator--e8c07fee-0897-4aa9-bada-b8d425e5a231", "indicator--2a7f7464-802a-422c-bbc8-699d98bece7e", "indicator--ad55f85b-2b0b-49eb-a8bd-8d10801bf67c", "indicator--1560cdd4-f739-4fee-9e8e-1b1dfecbea84", "indicator--a16a80a8-6310-44f2-8c93-3edd9d7dae31", "indicator--77b992d9-1a03-4e57-9cdc-6691d10789bb", "indicator--5bccca01-ff0c-4e2b-b127-aae93c63cfb3", "indicator--d9a9c82b-8f50-4461-a0c9-bcc5cf784f64", "indicator--10a7e4f3-09f0-4d66-b84a-85900653eb8b", "indicator--9df0759a-d038-4ca3-b597-83f3f16ff5cd", "indicator--09dd04bb-3956-4f35-a348-c77c24d27d94", "indicator--7e76cb0a-a4af-4d30-aced-2d74d5880682", "indicator--d573550d-3fc0-48ed-82b2-bfb532872eb3", "indicator--4999120d-0e79-4e94-8fd1-0a760d099457", "indicator--f7024b1d-457a-48ac-8f06-58fccdef06a1", "indicator--f65d1449-bfd1-43cc-8588-bb7c9cecfd0c", "indicator--204c683d-ff10-4124-b4f2-ccb0c52cfc70", "indicator--c17e69ce-8cf1-45d5-ade9-0f1f62703dc7", "indicator--67b7bd92-f0c2-4b78-b3e2-248401e01792", "indicator--413fb586-a80e-4672-a683-205c15418c08", "indicator--cd768e1d-fbf6-4e60-a55d-911a2f861aa9", "indicator--0e36690f-4e6e-41f9-902d-f25261c6b8f2", "indicator--e0fdad6c-400a-48dc-86ac-93329df282e2", "indicator--d76e853b-53aa-4839-8ad8-e65802140b9c", "indicator--aa91db99-1c80-4c84-9415-92f1c96e418d", "indicator--5de84057-9c19-4417-9dd1-c866370127ee", "indicator--748b9543-7dcd-402a-8d4b-4b81681dd2d8", "indicator--85388a5f-271d-4d7a-b066-91169c27b481", "indicator--d7a32992-5bee-4d61-9460-dfedb9f66559", "indicator--708057a1-858c-42da-900d-521b33e21cb8", "indicator--0648759e-0463-4a11-ac8e-3db297b72dd5", "indicator--835d013a-e746-4b1d-8fed-1115342a6d39", "indicator--d0e3db28-534a-4f71-ae4a-dd76f851fff4", "indicator--6c0572b1-144a-429f-829a-86b57a06e0b2", "indicator--27910fcb-269f-46d1-9888-5c63f64ae33d", "indicator--cd2f2439-475b-4a13-b063-2a8e5b0fc435", "indicator--3eb23b3b-c865-4e47-a2e0-1f5f9f69eebc", "indicator--56923e1c-d05d-4e25-b62a-dc2eb793eb98", "indicator--a7008e17-0ae4-4b4f-a48f-67bbd9f434c7", "indicator--7f2d4551-60fd-4530-b7d4-4d7a2d2b3482", "indicator--18acffd5-dd56-41a3-b086-b4955f439128", "indicator--5e00180d-8135-4255-8c8d-6a6dcf2e0ded", "indicator--d24ffbc5-5342-417e-b2d0-80be243a54c3", "indicator--e915e8ce-4d9a-47e8-af4e-dc2b51b7029a", "indicator--775496b7-6b99-45c8-be3d-86ee86e5cae4", "indicator--8365ca80-b6bc-49f2-b973-32b4855f94e3", "indicator--aa8a0c50-4a8e-4895-a78f-bbde4d20876c", "indicator--6fd4ce61-54b9-474f-acf0-8978bf357b61", "indicator--7c372a96-4971-478f-9fde-b9f8a3998b36", "indicator--de9f6472-08c4-49a7-865d-ea53dfb25aef", "indicator--f352b54b-63f5-4c0f-abb4-c98ddd3b805c", "indicator--4bcff545-1652-446f-a03e-56bc7807daa2", "indicator--2be7ecc9-b4e0-4278-aa95-4501d3fea101", "indicator--00d78d48-d356-497b-8e5a-c4e93e96d4a6", "indicator--ec03da57-f322-4b4f-b004-1e3bdd7f12e1", "indicator--674b3cee-d953-4bdc-8a5b-d07ba7c59f9b", "indicator--9cb92686-610c-4795-9b89-6f55b69f6e19", "indicator--8198a439-e4b8-415c-bf28-6727d4f30fab", "indicator--2b5298bf-c28d-4111-b587-007efed5bc63", "indicator--0fa048b3-b32e-47e6-ba82-4974d94b2c4f", "indicator--fc58ace9-284c-4556-a25b-0e914b9859bc", "indicator--81d9358e-0e88-429f-9583-54b0b1f722de", "indicator--8b9ca491-013e-43bd-a917-58cd0be846e9", "indicator--32c3f0ad-b295-4a8d-a518-a92f23dacc2f", "indicator--8ab85d32-f054-48af-9b32-44ee819b68ed", "indicator--e4d1c2fa-39d3-4edd-bf34-b45960e544cb", "indicator--030bc1c4-8ba2-430b-8a74-d168d1cddf8c", "indicator--7b9deef8-eac0-48f0-880d-039c4bc336d9", "indicator--106cb46b-5a47-4e3a-9e75-6e46ce70db07", "indicator--3e9889f1-f33b-4942-9421-5e6eefea9070", "indicator--8e1937d5-45af-46e3-89f1-f9466b5b8410", "indicator--dd92c206-0498-4afd-89ae-aa420a104dcf", "indicator--c2a3bb4e-b192-4e6f-845f-5920ef1b908a", "indicator--40744f19-313d-4e5d-aa3a-9ffaeea73cb6", "indicator--64eba0f5-33ce-4e67-b8af-82935f63a550", "indicator--7678cb57-c14e-4c9c-850a-5c2fc564e87f", "indicator--cc1c1a5c-dc5f-4f4c-b3b1-15ed3f5641f1", "indicator--af005ff0-c02c-451c-8dd9-a90923e9e351", "indicator--ee2f0516-4375-47c7-b5c0-8fd1074fa215", "indicator--d3e02d36-4747-4489-a720-6fb8e5c03c30", "indicator--72312f41-f581-4645-aa58-00023a4ea61d", "indicator--8c3bad3f-4c48-4ad7-9b4a-296ad5cb81b0", "indicator--b6489acc-5511-49fb-8489-f99500ead43e", "indicator--6b4b28d5-a2b7-4d7a-81ea-964b92bdd2ec", "indicator--db21e3f5-18f3-4a99-a9a0-bed54948ceb7", "indicator--48efbb10-3803-4189-b430-905646c74cb2", "indicator--29371b84-7a85-4f97-a9ec-cf60fb69e106", "indicator--d86a76df-a7ab-4e4b-8bf8-55492b3556b2", "indicator--599811fc-dbd5-472a-8305-42fb2fcb3cfb", "indicator--3c9f6ae5-3394-4359-9005-45f5f9d9f4ce", "indicator--eb164365-6e9b-4957-a91c-88f091e0c4ec", "indicator--ad8a208b-569b-4ccc-88fc-34e6f58b901a", "indicator--310c076f-27ac-4ac4-afda-5e94d5440dcc", "indicator--84584ea5-55a6-4d86-b066-c8f80cb3511c", "indicator--50b53c73-b006-4687-9b61-a2df0e423f73", "indicator--a5bb151f-048d-4f40-bc78-3b4aaeb16f88", "indicator--c1373f02-6bcd-45e9-a02b-6a208e78a1b6", "indicator--9b06d262-5ecf-4725-925b-960cd31c5447", "indicator--f8a8fd7f-09cf-4f62-87df-a6272f945ac7", "indicator--a874eec5-4d04-4934-a15f-81e9537ba819", "indicator--621ceea9-b274-4a06-8fdc-0df98cb43c58", "indicator--59a45c9f-ed51-4b51-9228-7b0f42999a1d", "indicator--1492f105-795b-4023-9331-07e421e0b526", "indicator--39691d53-c713-46a9-8344-5ec3c2894d62", "indicator--ebc91ecf-6ccd-4840-a6ec-270ae60a8186", "indicator--2cbe5c8a-762e-49e0-a27a-7b773f38f0cf", "indicator--ba964e65-c295-4665-b619-01a819293fb7", "indicator--70b235ab-957c-4718-af71-d27752fbc8ac", "indicator--9d390110-4e57-497d-b2c1-bbdec8909d17", "indicator--bc311373-2de7-4614-8191-76f5a2422415", "indicator--e3523b5c-5aa3-4e43-bd6b-a4e549356686", "indicator--ba189423-2b16-4a13-9713-63651a22a1af", "indicator--6e8311cd-beaf-4728-937c-a590f53cf08a", "indicator--731b7d85-40be-4024-9b95-75454c2e2fa4", "indicator--52a2a866-5b94-4bb5-bf3d-0870c37fcd75", "indicator--14e15b06-018f-4cd0-8c40-0cf60644bed0", "indicator--af2c23ae-08d6-498d-81a6-13e7df34a621", "indicator--d7bf70b9-c1a8-4a48-999d-24397a26957a", "indicator--a8b5a1ba-3654-464f-90ea-eb215904adc5", "indicator--aa828dbe-71ff-4d2d-9a3a-8c1cf76f6d87", "indicator--93012a9c-182d-4ab1-92eb-2342805ce814", "indicator--8e455ddd-ae55-4767-bbba-e111ee0b2ec2", "indicator--ec22e423-b49a-4ec2-9c81-d1bd925e9a9e", "indicator--999d8cd4-cf91-420a-a5e0-e00d5e5cc421", "indicator--ba9bc100-4033-443a-8ac9-4ea07b264cfc", "indicator--0d558c52-17e0-4b7f-a284-67f70c39e310", "indicator--d8865813-fc0d-4ee7-9f3b-fe598846b6b1", "indicator--21a32e4f-0a3a-4f7f-bb2b-960ab1b399c1", "indicator--5fcda7ff-f8cb-4126-94f1-b49a4f4f08e1", "indicator--a9a7b4eb-9f77-4025-9e27-32d0275865e2", "indicator--54c06215-3188-4c30-8a03-d30c1395659d", "indicator--234e5648-6c2d-475b-aa2c-87080ff4a118", "indicator--68045269-6d9d-4ea3-8da0-42004cc9a314", "indicator--6ee248ef-2a05-4170-8ab3-3961f988e3eb", "indicator--7943804d-c9ff-4253-9a11-dd52daa805e8", "indicator--81a787f5-1d9e-45ab-9885-beab58e26909", "indicator--abf6ea43-a24b-4b72-8cbb-bd3216b1e02e", "indicator--f5f9cb38-5470-4efb-bfca-9a2afbe5c4e5", "indicator--1ebd6e30-5125-4f26-83c4-332a6556e931", "indicator--0ea2c891-23f4-4a9e-af11-9f6d17736b6b", "indicator--c927792b-7125-4557-95f7-d57e5f63e355", "indicator--6020bba9-64a5-4ace-8106-7209f3502032", "indicator--dcfb0dc6-65d5-4b06-86bc-145fe85eaabc", "indicator--4cc979b6-5b95-4ed4-92f3-8eaea9229ba6", "indicator--25d2b707-1b5f-4ecd-976d-7628020ccb3d", "indicator--81f550f6-a247-4090-8f69-3098f4aa96c1", "indicator--0c822030-0fdc-4d06-96be-cdb0222fe59a", "indicator--a49395e1-6195-4c82-96a3-250a1e0e2631", "indicator--558426cf-455d-47c7-99cc-5f58aee7c365", "indicator--7057ac72-4bc1-470d-9e58-c5a101578196", "indicator--bfd0d169-cd0e-4815-9d78-d3a56cfb995e", "indicator--02702f85-4643-4d6f-851e-336f7e73f877", "indicator--937091f4-5c89-4424-943a-abe1aeb04c85", "indicator--585dcb15-0eeb-4a2e-9be8-6b3cd58b5940", "indicator--f1ab058e-ba4e-4d67-9167-5a955219334d", "indicator--6c813105-3dec-45ed-a4ab-c1f406effba8", "indicator--bed0db7f-275f-4671-b7e9-fab077d91c2a", "indicator--52a18e07-eccd-49f6-92de-14498041b735", "indicator--d5549f4c-95e0-4f17-aee5-af2536c58736", "indicator--3e217b40-a417-4ef2-9252-f0f4069e2840", "indicator--939605d0-4807-4780-86b3-b0625f16361a", "indicator--7236b0c2-34bb-4c38-9e53-d237aebb65da", "indicator--606dd799-74e8-4f7d-93b2-99210a0cc5d6", "indicator--a01eb523-8540-4138-954a-0d86e2b07f1c", "indicator--f2eee915-4155-4482-a5cd-5a2f16a88dee", "indicator--5d3110bb-ae10-4f27-97a6-74088b7d867c", "indicator--1737d583-e853-40fe-b698-41d2eb9f2bb9", "indicator--59bf8dce-ab60-424b-8e16-b89fb3310f2d", "indicator--196ec169-3a73-48cb-8cfc-4a192a8e1c63", "indicator--251f2c22-e743-4c0c-8746-7047c04d70a1", "indicator--1e1bdd7c-0b09-498a-aa30-4fc6eb684f6d", "indicator--feacdc26-698e-410d-b321-92c11c63097f", "indicator--9dc8b69c-09b3-42b8-ba9d-13537de1e2ab", "indicator--57645bb4-0110-44fe-8dd4-c631cda0d336", "indicator--b549875b-6303-4b13-8216-1784730b5711", "indicator--4521a3b2-d1f6-4f2a-995e-47264487db13", "indicator--f418fe3b-b142-4200-82f4-766478774514", "indicator--0b40139f-adaf-42b2-b057-dec87841a1f5", "indicator--fffcfac2-d9c4-4494-b959-729097e24eb1", "indicator--0fffb658-e0b7-408c-9837-cd413a5a5ec2", "indicator--a4b24f87-60fd-4e03-a5aa-00452663706a", "indicator--4194fafa-8b97-4d25-b07d-99c83900d97c", "indicator--9483ac9e-0ae9-413b-8c5a-d0427f9256a0", "indicator--8a2b72bc-f072-4075-9ef7-96aaedfd49c8", "indicator--16b6c5db-60f1-494a-920b-23aa51df8ea7", "indicator--39f207b3-1c76-49d5-9376-738258a8314e", "indicator--90115047-78cb-4d3d-80c5-5e2171e2f22b", "indicator--00fe2cf7-74b0-4136-b4f2-e811f1dca9f1", "indicator--d4ccface-a221-43e2-a180-4b3282ef9005", "indicator--73e7ee08-b6a2-4965-8e49-457f82c61d1f", "indicator--54f118a9-2a0c-41e2-a8d9-6d75a7fde412", "indicator--aee483cc-bd44-454d-8183-cf9600f83030", "indicator--40ae37c5-b259-4308-98df-dcb811e2e178", "indicator--8528dec5-990c-4805-8842-c0806c0921b5", "indicator--05879306-59d0-4f7c-81b7-20b6958129a6", "indicator--969c8239-ea53-4282-ae3e-aa5ead5c7f87", "indicator--c34fac04-13f3-4d34-8871-6aff2ad2828a", "indicator--f33637bd-8f44-46f2-a68f-777bdbd3851b", "indicator--70bf27a4-887d-4ffa-9734-321c019b21de", "indicator--42bc23cd-0711-42ef-a167-1865efc2543b", "indicator--c461147d-31f3-49f9-a081-488cc852af87", "indicator--3f073013-8ed6-47b0-9239-17405ec50fef", "indicator--13f81898-1c3e-4d8c-928f-f499aef2f413", "indicator--4108e661-0bc8-450c-88c5-48543fc55861", "indicator--3320fd6a-1a09-4567-b603-f073f94a22ab", "indicator--9a9ad2f2-1394-4e4d-9d7e-c19a2927c97f", "indicator--ec2db797-fe64-43c7-ab35-a85849f5e0bf", "indicator--9b15b7f1-cca4-4868-b096-9d5ba8080842", "indicator--d61b04ff-8ddd-4581-908d-cb61b0fec692", "indicator--a504b585-5bd0-4ff2-b3f6-39caa50ca26b", "indicator--6963657f-80ea-4326-9516-d844413725a1", "indicator--eb2be7f2-b7ab-40a4-9b75-e8fad37d2b6e", "indicator--111b050b-5c16-4309-acab-92c78960a29c", "indicator--8e38ea70-e8d8-4a2e-aae0-32133b4a16e8", "indicator--243c1ea8-8189-48a7-a370-ffcde97356a9", "indicator--837d2497-e07e-4f7d-98bb-e40dfde3e294", "indicator--4c8eff29-4b90-448b-bffe-9844b100709d", "indicator--f1bfc056-f81d-45f0-8d2d-d360ca89fed1", "indicator--4bb608d3-e7d1-496b-bec3-d94f1bc3b040", "indicator--8118be38-c884-470e-bf15-19afa4d225e0", "indicator--6baf9f18-dc68-4275-ad9b-940a738a591c", "indicator--2b4b99bb-6bfb-496a-8f07-588718209a70", "indicator--5008cc45-25db-4f16-a583-8c4c8d4e677e", "indicator--4f247642-fe00-4cc4-a85e-0a97a1d79157", "indicator--e575a89e-37c6-4412-a516-fe792096bd9a", "indicator--4fab854e-2be7-4eb4-8da9-72173ca82939", "indicator--0341ba13-2848-4a95-9ede-4efd83e0cdba", "indicator--d3ad1019-aaff-4a72-be0b-9e14a422b9bc", "indicator--9dfcae6d-3333-4efe-a967-027cbf202550", "indicator--359af985-288e-4833-8618-ffb2b1715966", "indicator--0715eedb-8ee4-4731-b34f-5b8534a2f0c4", "indicator--aa6d6824-3936-4d84-a124-7bfca01c5b8d", "indicator--ef8f7ad9-f8ef-4f7d-8554-93037c4ee546", "indicator--482d48d8-7cbc-4131-95bc-06e66fd5b67f", "indicator--fd10ad99-1811-44a2-8590-5a2ec0e84417", "indicator--42e32628-0f23-4be9-bf61-58b3fd2a04fd", "indicator--05e8d771-3116-42d5-87bc-16565c7b23a5", "indicator--716a7906-bdee-4031-b97e-f118917ecba6", "indicator--d0813d55-95b2-4d79-bb91-7353d31a4d71", "indicator--3b8c2e86-7484-42ea-bb01-bdea2b3b4ad7", "indicator--40ddcf19-b920-440f-94bc-558476ac885c", "indicator--7624ce1e-4989-40b9-9711-559a8aa201bb", "indicator--6dda4623-2e60-4b06-9405-e198d545c2ee", "indicator--bc6afe95-84c9-4152-a5f7-b9cbbdc10db3", "indicator--f3229b49-01e9-4e8c-8f99-a8fda1c99956", "indicator--60d38dcf-c489-4704-88f1-4cdc15e3cf4c", "indicator--6d9fa70a-53d6-4b65-bb80-7a95000528be", "indicator--eb2f59ce-a021-4288-b442-4a48f9f1ab17", "indicator--928ebfa5-7209-424c-9972-d2adeb9e9071", "indicator--72fe89c5-f7b1-4190-a560-22d0719487b4", "indicator--d5823882-3b71-4d12-94d1-ac665fb0e846", "indicator--c5af4c50-54ea-425b-8a77-c6019e062e4d", "indicator--5c8307fd-8c93-41a8-b1f4-89f6422b9aed", "indicator--692b9b58-5ef5-420c-9748-0e333e773d79", "indicator--1a4614ca-c7a7-41ef-b44e-2dd672624a72", "indicator--d4bd76eb-f5bc-4c45-a99a-b71205f1dd26", "indicator--692c94c2-eb30-4db5-a3cb-5a1d0abd222b", "indicator--8e9db363-d65e-476b-9cdc-c8c58bfac589", "indicator--2e91d828-f87c-40ff-bcfa-47caef47e210", "indicator--bcce86ac-a2e5-41a5-972a-8be9ce4e6e3c", "indicator--ef691512-e285-4421-818d-b5c9e4e73320", "indicator--185957a3-46e1-4ddb-9247-deb459b1b47b", "indicator--12d3a199-0f56-403c-a362-70dc1be178d2", "indicator--de220c3c-9d51-4696-a503-f84bc009c1e5", "indicator--653d68f2-1764-4707-8064-aaa09d510c3f", "indicator--2abbc855-d498-4e0b-895d-b56bad78c05c", "indicator--08665a8a-2554-403c-9ace-d3afefb8b894", "indicator--86b73b18-0a43-4cb2-bef6-f6bdb5c4c203", "indicator--1f813f9d-5b3f-4571-ab5b-6f2a93a47453", "indicator--4ed51995-1bb1-4b9b-b830-b8a699ec14c6", "indicator--c80f3b18-3ae6-411c-8b60-bc053848a41f", "indicator--1ebe8eba-a71d-4d4f-9d23-6a313263b4ab", "indicator--fcf5799b-d43a-4018-9eb9-f4f6d68ed9cd", "indicator--ef0ae29e-424f-4e89-8523-33b930de931c", "indicator--d34339a3-9635-43c5-b7d6-c890538071ff", "indicator--6eefa21e-432f-42ca-aa7e-1e89a34bd23b", "indicator--72a3730c-127d-4242-903f-8ade2dda58d3", "indicator--2978ab39-5d0e-4725-85f0-5a4afb77b8db", "indicator--b19b609e-5788-48c3-a302-1602c9a92107", "indicator--f879a3f7-ec34-4aba-a54a-df6e3e679d96", "indicator--1becb5dc-93d6-4cbe-b2a3-6e1449708728", "indicator--8b3d3f75-bcc8-4c47-b95c-41889cbccaa6", "indicator--28a525aa-2b5b-4d12-8ab3-5e261e482eba", "indicator--d807bdc1-dc8e-4dcd-9daa-3ae4d4ee3604", "indicator--e2642e73-be03-4aeb-8cb4-105cb3c379d2", "indicator--6c02b4ab-c0cd-4b9e-bda6-6068a8454665", "indicator--17109e06-28d4-4f25-a89e-cb2934539ea1", "indicator--df68ee0c-f49c-4abe-a2f5-611ef49c0dc6", "indicator--ce98261f-75fe-484c-8fe2-23c6a4fe1caf", "indicator--f1717cfd-5a53-4542-8c8d-6c82c803be8e", "indicator--765711f1-c27f-4f94-9742-d6d2eaeebec8", "indicator--e1bbf92e-edee-429e-8b53-e8431635162a", "indicator--cdf6ed10-8473-4aa3-83a6-a24897787d3a", "indicator--bd0bbbf4-7a46-4edc-be17-3182ff15faa8", "indicator--262a1325-1b42-424a-9eac-1b411e396059", "indicator--1dabbef4-09b1-41f2-b672-1dd4e5726835", "indicator--ab8f5f00-2adb-4f51-b0b3-7209f2b88af3", "indicator--0528d56b-e69a-41ee-a8e6-0ee53ff6f691", "indicator--7aed8c41-1964-456d-b3cc-141b4a3a24d3", "indicator--cf6afca5-81af-45cf-841b-5589553d2f24", "indicator--d8cd373a-0451-44a8-aecc-a116b5391cd4", "indicator--3df7a840-aa6f-412e-b43e-85e300093102", "indicator--f362ff1a-ac0a-48a4-90a0-276c9e4b10d4", "indicator--8c66bdc2-edd9-48bc-b3a9-cdc33af7580f", "indicator--34c108fd-0976-407f-94c3-747b5bc13fbd", "indicator--229b7065-b8b9-4d2f-b05b-6bc23418c6ad", "indicator--e8191a32-e1f2-4173-ac18-57af4fd1db93", "indicator--c8b13e89-6422-4a77-bbb0-01abd0a037a5", "indicator--2b20a503-5230-46f4-94d1-a40baad51ef3", "indicator--dd5ab642-2dae-42e9-b156-ccff3bf32d9f", "indicator--34adbdc6-7406-43da-b427-2ef1bf888a6f", "indicator--99a6b01d-512f-4fbb-8dca-400127cd21c1", "indicator--28488f33-d25d-4396-947c-c20a0dfbede7", "indicator--a5d953c8-38a1-4292-af90-cdc385cc6ef0", "indicator--edd2041d-c1fa-4e69-8a30-f819c0552e74", "indicator--0c8d0357-2738-4fa2-8c1f-d4ee68f57beb", "indicator--29352c0f-0e63-452a-9627-20513ebc663f", "indicator--39e9689b-546e-4b24-b270-933e8a6fd342", "indicator--ce2ea57a-0f39-4042-b253-14eca7351b85", "indicator--4751020c-4963-4f29-8215-3e8eba632836", "indicator--71c9bd5c-27a1-4920-af7d-dd9ea9f34b53", "indicator--0bae0385-770a-425c-bfe0-f92db9cfafed", "indicator--45bc4ffa-7671-4f4a-95fd-56b2298dd865", "indicator--91f517fb-1a7a-44e8-bde2-7cfb8e109fc8", "indicator--6ec6638c-08bd-494c-8204-0cfb081dc6c2", "indicator--b720eab6-82df-4a03-810c-c66427a5483a", "indicator--45e3f493-f780-4198-b990-ca57ebffcf09", "indicator--50220007-4b88-45cf-b94e-6694178b6a46", "indicator--46ed5752-f271-4cd4-8fce-14f0ad238bb8", "indicator--8d64a1bf-e853-45ee-b5a0-9096d4f675bf", "indicator--a9b4d1a6-ed63-494f-a41c-520edce285ac", "indicator--00769f1b-7aed-420a-b88f-752406003a99", "indicator--8ef524bd-ee28-436a-9346-629f38ae939e", "indicator--a927890c-c432-4aaf-a3ea-ab893bec1a97", "indicator--8f3d56c0-9d8a-4742-a09e-0369d322ffe0", "indicator--b5e26cd3-f6df-4c43-90c3-097add22d57e", "indicator--8b330bc0-c1af-411b-b982-af5fb8a67069", "indicator--97fde660-c015-40a0-9e30-cb91b0445202", "indicator--213d8774-eeca-4ecc-9e22-6e19c0874e67", "indicator--e24b6eab-af68-4bc4-a004-53fb8e6051af", "indicator--e05a9847-6858-4740-a8c2-c4e945fe2de2", "indicator--ead0f5a2-b00f-4e03-bece-16381b9c3b46", "indicator--ad7754b4-9165-49b4-b80c-2dcbbd5d727e", "indicator--c18c88f8-bd85-4545-b35a-bd6eda62649d", "indicator--1c2d4b25-66aa-49c0-9173-67914262277c", "indicator--9cae819d-e547-4ce9-bfba-0103842431e0", "indicator--e18c40ee-af26-471a-8882-b8db9beb60c4", "indicator--915908e0-98e8-4772-9913-f50e02a2bb9c", "indicator--748f9176-4ee4-4325-a464-cfe760ff84e2", "indicator--7b17fc1b-2838-4808-9e6b-9d761d62a686", "indicator--55a39050-f6a3-459d-bf15-9b1ea498679e", "indicator--276594bf-c1a8-489c-aa47-ce701756e5c2", "indicator--a909105d-adde-4ce4-9524-c0222b1f714e", "indicator--308ee0a2-e8d4-45e9-9030-053213e343ab", "indicator--bf86399f-14c0-4e03-9261-1853af183d0c", "indicator--3c4c46d0-641c-4a92-ac74-3d8357e42b36", "indicator--460ea616-1bc6-445b-9704-52bdedb856d7", "indicator--7db4a18b-8e85-4ee5-a3c6-eda74b27ae48", "indicator--bd5129b5-ccc9-4a06-b04c-b3814793c136", "indicator--65bc4967-8db5-4b8a-80b1-9226643fb89c", "indicator--21f1ce07-edf5-4c67-9c0a-4b9910f09ece", "indicator--b1d5fb72-d777-4fc5-84c6-75f01e18b0d7", "indicator--30a928c5-e85f-491b-8fb0-05591329dbe3", "indicator--e70a56da-13fe-43aa-8563-5f2fbface5b1", "indicator--667ca686-3a50-4082-be05-a8b14243a3fa", "indicator--028f7395-e169-4496-8a25-96adecfbcee4", "indicator--e5502ee5-a4da-40e1-9f65-7d4010622c5e", "indicator--49bec679-8bcf-487c-b958-e15f95a08c39", "indicator--886c25c5-0aee-4468-818a-be30eab85a60", "indicator--22728968-c471-496e-87f2-8ee75c4b2bfa", "indicator--50f69f32-4bf7-4cad-9fe1-395e72a16a42", "indicator--f9d218b4-dd89-48c5-bac0-01f6ec1fb542", "indicator--bad835e7-2cec-46e1-9899-c8aa3ae002b7", "indicator--2992182b-862e-4078-8ac9-7c0a7908a62d", "indicator--b2fce54c-5f2c-47ad-ac6e-098474ff9f2b", "indicator--754ab9da-aa85-40e5-a327-8bf79b658ad8", "indicator--0697ef8f-21a0-47a0-9a22-5e771c77fc51", "indicator--8598f3c7-af61-42ab-86d4-e788507717ed", "indicator--e334eb21-40c0-464a-9e50-5bcbd17f12df", "indicator--3edca18c-d60b-49df-8573-03eabcfa1e1d", "indicator--02e4e720-2ab8-49e6-8d3c-eb77c839f219", "indicator--a5ccf15a-12a5-4896-bf07-392bd64f7edd", "indicator--c17e9046-d8bf-4d58-b18b-121d1b95db6b", "indicator--9854cb48-a3b9-49a2-83cf-78e364e8e86d", "indicator--f8f1a748-b82e-4a2f-bc58-f3e1a41a5c0c", "indicator--abaca373-4914-473f-9637-14955547fd44", "indicator--88ecd922-6eda-4a70-8061-16bd3458332a", "indicator--8cb94087-8e7f-4edf-9db6-67d4733c2d18", "indicator--c523c076-b774-45fb-8f69-82ef6461359a", "indicator--1872fdb5-7166-4771-b8e6-e8695293f17f", "indicator--05a7e604-c01c-477d-a2c5-ba97aaf6d24d", "indicator--6a332df2-b95e-411d-ad1d-849866439a82", "indicator--e2e8194a-e331-4736-b3b7-c14938b77012", "indicator--928049ac-ff3b-4bca-aec7-9dc1ff830381", "indicator--461d3963-d24a-4a2e-a39a-038decf56229", "indicator--0de38ac2-57e8-4226-8a3c-0ef801c7bef5", "indicator--845c0e2b-0e49-4ed5-8900-ba64450b7b6b", "indicator--99a8c6a8-971b-4b4f-9c9a-a5ed7ee8d208", "indicator--b703c3ee-5514-49e6-be77-fe6f9b0738f4", "indicator--2edbbcae-978c-468c-ab3a-d15d75e27fcf", "indicator--79c917ec-2769-4857-ad98-a1c4eb51e38c", "indicator--55ff7a72-24a5-4e74-af92-af7849ba0249", "indicator--8b876586-7cd1-4a4a-8813-985632aa7955", "indicator--f44cc952-2b15-45e3-9ca2-a1d0c804dec5", "indicator--23fee816-2fde-4dff-918e-1ed4d0b68b78", "indicator--6fc2af08-8d25-4171-8d36-4f1c121a8d80", "indicator--5c8315e2-26f3-458e-964e-458377c4936e", "indicator--61e22ddd-b74f-488a-837e-5d360db1d397", "indicator--2d20a781-480a-4fb2-9a8f-948d4546625b", "indicator--ed220236-33f3-4e58-9d32-adf69a313493", "indicator--eac34034-750a-429b-a70b-03893c95e1f6", "indicator--bd50d749-4953-474d-800d-e736058da06b", "indicator--09cdafa6-9065-4a30-bfd8-dadb40f818ad", "indicator--3f78b5da-fbd0-4f84-8e34-69d9848a952f", "indicator--264e2d3f-b87f-4427-b662-9fbc48957959", "indicator--3daa1c8c-444c-4849-bea5-c871e756b128", "indicator--c12ea4ce-146f-4c60-8ba0-f5449230affc", "indicator--96020dfb-e11c-4337-a1a0-23cc2bb67c82", "indicator--e1fb678f-d2d9-429e-a3e5-8ac570018e2e", "indicator--b48d379b-f653-4843-9f85-b556ac790c48", "indicator--226b0875-56f0-4adc-bd4a-f0bc91e17801", "indicator--3305abad-95fc-4cf5-bf08-9b1dd15d621c", "indicator--f074e681-3265-4641-b959-5ee2f48b4da4", "indicator--d3735959-da01-44b1-93a4-5a5d6a351fa3", "indicator--1eaa80c9-f7f6-442d-99b8-80e13105e99d", "indicator--ab240039-e3e2-4ddc-a092-1fd04395f717", "indicator--c650a10f-d376-4845-a554-dfe4f5160456", "indicator--05b8634d-183e-4948-bec9-e931e5dfa316", "indicator--b684d4bb-bf03-4dd5-831a-415240e12d65", "indicator--078f3ba6-23cc-4e19-9184-9f1e075474fe", "indicator--63c34fb8-7273-4ced-81ff-cfba754952ef", "indicator--0adf5bab-d33a-47bc-86aa-63dcbcc80976", "indicator--0db3a9c9-e589-4643-a63c-d70ce9fb5b49", "indicator--ccf4d386-dbd5-4205-8625-a43f545fa50f", "indicator--7192faf2-91e1-42c1-a120-dafdae646d66", "indicator--e9b830e3-b12d-4136-bfd4-c37b731c7f4e", "indicator--c947be2d-569c-4578-9c42-b08b2d4a8b0f", "indicator--abffb656-08c3-4cc1-a68a-3b99b8a72926", "indicator--d607783d-8eea-47d7-88cd-681d994dc274", "indicator--08c9b215-3a8e-403c-bd23-0cf5e34dbf06", "indicator--a3bad049-fffe-499c-875b-0835cf424aa1", "indicator--1d0869a2-2cdd-486f-8b1a-e01044eeadab", "indicator--2e7a9849-cdca-491c-afea-bb7c68caed10", "indicator--c693638c-52ed-4139-962c-225ccf032a97", "indicator--871f7f9f-2222-4130-927d-64b75a3569cd", "indicator--f8e8be93-16ed-477d-bb0e-fdf014060dc5", "indicator--1bb4d753-4443-4642-8800-2cb7f737e0b3", "indicator--0511424e-ad9a-45f7-9ca5-5e511672f070", "indicator--c0407562-e6e8-4bed-8d7b-867c43b9e711", "sighting--49ea57ff-6a16-4b32-97cc-c94d73b9db5f", "sighting--d5378017-7733-45d0-9e2f-e796760e8b19", "sighting--88dcbd85-a544-4542-b5f4-e1ee203db24b", "sighting--6f30c2d8-e30c-44b3-a401-d2a63a34e834", "sighting--fdee1d8f-e0fd-4385-969a-6260f2bafa8f", "sighting--966c4895-f029-4603-8d9e-d8715ea6a26c", "sighting--b82015e7-7ed1-4fa3-954d-b6284fa092d3", "sighting--c9daebb2-7f70-43f4-a15f-bcebd20cad3f", "sighting--c74e5bac-64be-4f5c-b7be-859d8d38ab51", "sighting--902a1da1-f18e-430c-b628-e03c3b7c42a8", "sighting--9067aa26-5f0e-493e-b72d-15ed97dd7943", "sighting--90478d91-52c1-48ce-aef0-ed8b002fbb80", "sighting--b1e9af6a-687b-42e9-b664-a4e560135596", "sighting--c70cd344-af09-46a2-8f30-fa16098b1359", "sighting--3fc96ee4-1edd-4dfb-9575-19c62fadaf3a", "sighting--9b2d40f5-b6f7-4aa0-95dc-f620aeb9fce9", "sighting--896c340c-e6ed-41a3-9d81-7ce7bd86c4a8", "sighting--1bedf548-4e12-4816-9df0-b27dab3f692f", "sighting--e9e3cbfa-dbf3-4962-b6cb-924544d6f01d", "sighting--a3d9a14f-93b2-4c2b-8e40-6fd309030aea", "sighting--11b76e15-20e2-4504-b3ec-fc4786243374", "sighting--4eeadfb1-3149-41f2-970d-947043d9318f", "sighting--d8907b74-e584-4ea0-8f20-c0921984bd99", "sighting--bf965068-a886-474b-b529-efeb069547a7", "sighting--117fdcde-1288-4373-a773-79a174bdb6b8", "sighting--b5e56e0d-3191-42f8-8955-f8f5ad289695", "sighting--53fb2764-4142-4bba-bb19-ae33d08bd178", "sighting--d813b65b-4bae-42ad-8902-973af1683101", "sighting--57da9e2b-3de4-459b-a55a-f09dc56be199", "sighting--4f1766f6-cdd1-44f1-8b97-703c4555c04a", "sighting--921164e6-4028-408f-acd4-5c7248323413", "sighting--870ce6da-833f-4b43-9fac-a314a23a6bb1", "sighting--d285d6b3-53c3-4adb-9252-7d78e9c054e3", "sighting--5cfde99a-3867-404f-95f2-0fcb789884af", "sighting--df0eff69-57dd-4ec7-9835-212fd25d2ea2", "sighting--dfc192d8-9d2b-4390-b481-cef18014ac11", "sighting--7f9f0789-5f65-4174-b472-31bbde6eac40", "sighting--1ec2e04d-547d-4dc1-a2c7-ea422651cf0f", "sighting--6b1f2553-b94e-40a4-ac5f-ff08d8c13305", "sighting--bccae0d4-33e4-4d82-b72a-619079d4282f", "sighting--c81a5930-abd4-4955-b769-272324fbe849", "sighting--daf2fa4b-ee69-4c2c-a794-398335e69009", "sighting--3754bb83-d2c3-453e-b0f2-40fcc0fc9cf5", "sighting--0fe640cc-a256-4e98-bdb0-9b8cd93a0e94", "sighting--418d3941-9bf5-4618-b172-37d89d9c050a", "sighting--ce3161e8-6eb5-4d20-a7ba-2e1537c8990f", "sighting--c80e0e6f-4849-47ce-bc58-7712755899f4", "sighting--b4020656-838a-467d-820c-746eebcdd3e1", "sighting--367b4de7-34eb-4f51-9b76-71b3d9bea7fe", "sighting--9a5da2b4-2167-45eb-be6e-c101b0881c29", "sighting--d3fee87d-e6be-4f25-8794-2b50d33ac4b8", "sighting--17c8f310-251f-4a66-a896-689c29107c0a", "sighting--acaa3343-ce2b-4af1-a39a-c9d51729d066", "sighting--024741e2-9e6a-4bda-80b5-44f416da0cda", "sighting--9f918fb8-1d58-40de-9095-b663d10efc7f", "sighting--5c564db5-3287-40e8-a438-33ea07af5bae", "sighting--f3d211cd-a5ea-4541-9474-4c810376d335", "sighting--be7ebc45-d184-4552-9b66-e13d2b0b8b07", "sighting--f449394f-b409-4372-a8e6-3a6a5b8ef8e5", "sighting--2c5deaef-3341-45f8-ae85-874065d58feb", "sighting--6bcd7a05-cb7f-4143-ad32-4c255f398ffc", "sighting--adf32c9f-1747-4454-8d7c-f6a2b0fd55b6", "sighting--265467da-6491-493e-a57b-35665ff86c2e", "sighting--f7f65999-7508-43e9-a0f0-8dfc6490a57e", "sighting--ae69b349-5d99-4963-a762-961d9bdde9b5", "sighting--cde86253-a664-4091-9fe1-7cfd943efd67", "sighting--f601d397-4180-4255-bb15-550edaf0ba04", "sighting--06d24351-e293-4c7b-abd0-bb1cc2e57189", "sighting--ac213523-1b1e-462d-b991-de7a200e76d0", "sighting--d2b77043-e7f2-4944-b02f-53955aaad094", "sighting--565ebea1-0936-41b2-b46f-af8af9258965", "sighting--a15312f7-3f7c-4e4b-8585-69dccea2e2a2", "sighting--ab2b5446-dac9-432c-89b4-e473dc698e5a", "sighting--1a83aa8a-ea50-4ce7-b473-8a476c5cfda4", "sighting--bcec768d-fd96-405a-b551-3b2e72db5652", "sighting--2fbf8771-4739-43f6-abc3-cf9c8c735349", "sighting--8fe59b6c-7ebb-45df-bb5c-f01676a51436", "sighting--5bfe1cd2-01f0-424c-a867-5c106a605d6c", "sighting--22d27f6d-12bc-49ba-bbe4-44587a9ee638", "sighting--cf33f30d-3e9e-4b4b-8dea-37f8d91063ac", "sighting--99babe5a-0d86-4046-9369-7bd5c745a291", "sighting--d1b55626-356e-4ae9-b97f-68211744356a", "sighting--5ed382a0-6f50-40bd-b1d1-81a8effa66d5", "sighting--00df50cd-5954-4d9b-bd01-53d02fceef9b", "sighting--d0871939-5855-47f8-befc-2b98e4d2797d", "sighting--06246c09-3c03-42bf-b626-51fbb3361a68", "sighting--fbcfda55-8233-4a3b-850a-85a333f21bb7", "sighting--badc0ef7-c1e9-4218-9abe-2540c02335e2", "sighting--575996e7-91ce-43a2-b78e-748101f43196", "sighting--b639bf8e-a569-4719-b376-5aeb13e92a34", "sighting--5c7b1b95-6054-4fb7-8feb-8f4240a56dc1", "sighting--9724a6d3-7c34-4d07-807e-51bf24ff3832", "sighting--e1974684-c65e-4596-b0cc-20876f239c67", "sighting--23c04352-ef28-4513-8a63-a6d867c97f81", "sighting--afd23772-00b4-4599-8a0c-b95a428badd1", "sighting--458a636c-4fb9-4470-8359-1068f8bd0ce2", "sighting--27bac033-c7a2-43d0-9a53-4665a7f020a4", "sighting--022e2505-7cdb-4ca8-b03f-b24090e7025b", "sighting--0577153c-0728-43f1-b720-917ecedeaf7b", "sighting--f1661b79-4dfc-4dc6-acd7-20f3b665ebd8", "sighting--dc993f92-fa3f-4979-ace7-2b96c143432a", "sighting--9ca284dc-93d6-4074-8ede-a2f391ea7ed3", "sighting--627013c9-15a1-480a-bdd4-7f50da2a9560", "sighting--9db34489-e8c4-48d9-ba82-ab55da9af37f", "sighting--369a07cd-84a9-452d-b049-8f98541455cd", "sighting--a4dacdbb-ca59-41ca-80a0-83316cde491a", "sighting--b4357e0c-cfa9-4b35-bf90-61553141e531", "sighting--4f2d6974-bfca-4fe4-8d92-b7562c024732", "sighting--970c5b0a-46ad-4061-bb17-17c13c22dfd9", "sighting--39482416-5fa5-48ed-aa61-0008398c8562", "sighting--6be5665f-8309-4281-ae87-53790ec8b7bd", "sighting--2ffb4c56-ef27-4a3e-9bd7-e795bb8e4a12", "sighting--0975a374-dfcd-4f21-87a3-765cf624633f", "sighting--7e4851db-75a4-4afb-a48b-2426b5ed5160", "sighting--32059bfd-7c83-43be-b86f-a61b8d7e87df", "sighting--8f4ea07c-20ba-42e6-b210-03cb50452e83", "sighting--f15525e0-16ab-4d3c-9fc2-c9d5a8970230", "sighting--b687e638-9893-4ffc-b2e2-48b35530c8de", "sighting--ac6ad281-878b-45b4-b6a3-106d2983d61e", "sighting--e0c58443-3606-4eef-90dc-ef973f91ff60", "sighting--4212894e-b3ae-44a2-af43-11aee2856b23", "sighting--e6cf5f7e-14ea-4441-a7f3-c7248f30d236", "sighting--909e0e06-d197-453b-863a-6fb310316c54", "sighting--2b040e37-20b4-4bb2-bdbe-6ec52ed53ca7", "sighting--04730c10-3e73-48b5-a9ec-dcd28c785784", "sighting--a5fd2a3a-99a4-418d-8bd6-09c6cbe54374", "sighting--36b99df7-8204-4041-b0df-d6435c79fde6", "sighting--a843d428-9977-4d69-bc20-155c3fa10cd6", "sighting--baec87a1-85b3-4ff1-95c5-222c0bb90c0a", "sighting--dc116019-6288-49c7-bfc6-ddd36af2c239", "sighting--b15e0ba0-8007-4b99-8346-bcaf13842463", "sighting--eadc6fc8-8f9f-4a57-9a15-a4306b55e830", "sighting--227dedb7-ee12-4a4b-9cdb-271721679b00", "sighting--ee2dd7e3-2c19-4fce-9bb3-273630524545", "sighting--b5b1296b-5eee-47db-82dd-62335a5514ed", "sighting--a84a91b5-62c2-4258-8f0c-0d6bb169345a", "sighting--8acea477-10f3-4fed-b2ee-0e8b45426a5d", "sighting--22638ed1-f508-473d-998c-0398a6feb21f", "sighting--a49ce687-f46f-4bac-b3f6-1d8a35074819", "sighting--08a5015a-dccf-44d6-8ca3-a30b02f005e9", "sighting--c0bf67b0-5167-4ce2-9c60-ed5f7c7ad5db", "sighting--acfef85f-c535-446d-bcac-7be1516d8dc4", "sighting--f2ee8857-b8c2-4773-8db2-8c5ddd8bccf7", "sighting--d8d88c6c-e2f4-4855-9efc-eebb6ceac166", "sighting--f27a196e-3813-41b5-b77c-b541e25ca350", "sighting--89072fa8-8b04-434a-8254-90df3b0d2889", "sighting--bec03c45-d104-4ae8-9ed9-c9dfbbf5a3e6", "sighting--aec99dfb-8256-4595-becb-a32461308773", "sighting--f5ec800c-6556-47bf-8038-a200087dd5c8", "sighting--a30ee30b-3144-4285-9fe7-c9981606f7de", "sighting--73cc6025-2a39-4094-9bf7-67ab2c8d2102", "sighting--c4fa89ce-3755-4505-aa41-8a2dcd75b7fd", "sighting--6f00d336-9fb7-4e34-934b-80017477256f", "sighting--77d01cdf-fed6-4abf-b2f3-0b9f4ee50cef", "sighting--89dae52a-46e9-42fb-b674-d2861f002e49", "sighting--f797776d-a7f7-4a24-8108-4d380d5b299f", "sighting--32ac51d2-0217-419f-b99e-303a5baab885", "sighting--9fe1aeae-6c26-4438-a769-68255d035a4a", "sighting--48695293-298c-434e-8648-40bae2900284", "sighting--87df4003-1443-4d52-bc99-424888c7e4f3", "sighting--40a83668-8aa0-4c88-9e36-5b0cd538d8a8", "sighting--622d2faa-2c57-4a7d-b595-efaaf399924a", "sighting--dec708de-d6ad-4a68-a991-180e8a62a160", "sighting--33b8c5be-6d50-4acb-ba53-0ed01140251e", "sighting--43b9afd4-09a1-40ee-9b18-3ec91bab1b35", "sighting--66cb8a57-d01d-4e8d-b408-7dc376ee1b28", "sighting--1ead38d4-71f2-4c88-9818-4ac47220e816", "sighting--463c650b-01d5-4b34-bc91-d751a44ca30a", "sighting--cdafda84-9dcc-4521-acc3-4fc42ca67899", "sighting--b1614818-09ef-4854-90c6-8246233c3b06", "sighting--7c438991-bab5-4156-9372-fba3dc682507", "sighting--fbd12fa1-4e85-4afe-bed0-3c0226c6ed75", "sighting--a9500e09-ab99-429a-a8de-5a7dbe9138e8", "sighting--76131d1b-4ac7-43ff-82dc-1cbb3786c694", "sighting--a8ebd8d2-0707-495e-a505-cf8e76bbc028", "sighting--b7d026a3-360d-4849-9df2-5838e2c8fed0", "sighting--84d110d5-84a4-4201-b1af-45072d0aa0c9", "sighting--039143d4-83dc-49af-8241-673fab2df27d", "sighting--142eb318-4682-469b-83d2-42af9631ab68", "sighting--337016a5-1a73-4a27-913c-4cb7966900f5", "sighting--b3bd8f43-2a04-426c-b7b1-8e29186543b2", "sighting--01e8cc55-3af7-4ff1-8eed-7e424ba9cd67", "sighting--5f335584-1858-45d4-a3a5-d8487147e0a3", "sighting--0512bf87-0468-47de-8e63-e5b75a56f3c4", "sighting--f3fe6fcc-047c-43ed-ba3a-ea3d54142318", "sighting--287d7a34-c9e1-4950-a951-be2b6e6a51cd", "sighting--bac4023d-f2d5-4016-9bea-64c8e8195525", "sighting--526ce971-d402-4e49-b52a-0348b02edf44", "sighting--d1ac5eca-a8cd-4411-b881-19a4f3635a57", "sighting--39f1f106-75a6-4aa6-bd29-56d864da9dc0", "sighting--543dc008-b754-42dc-a8cd-66cb86cbea26", "sighting--e1b7b797-0a12-4735-87db-6edc62a10970", "sighting--3cd56f2e-da88-427c-aedc-6ff886ae6040", "sighting--de96b8a2-e0fe-495e-86f5-ab9fc33055ef", "sighting--33f250d6-3a50-40ed-baee-9fd4a24129bf", "sighting--9e49787a-5833-4698-a2c5-704007067b4a", "sighting--e0531921-c720-4509-9df1-526191e034b4", "sighting--174ba75b-6c89-41b2-b4e3-caa6f80c5eea", "sighting--7264422a-a0a6-4a30-8a28-6417576cda09", "sighting--7695fa4b-b787-470e-83ca-755953b475e0", "sighting--9c7b30c6-63fb-427d-801f-225ad65afaa0", "sighting--bef73202-98c5-437f-ad2a-9918dec1c2c4", "sighting--bdfb9cb3-bab4-4815-9ba0-27bcf6c5d8f6", "sighting--ea9ff03b-befc-4f41-a7d3-f4366217656c", "sighting--cc7d59e4-da51-4057-8fe4-05bc0b3fc5c9", "sighting--c4e2f74c-3b38-49a2-a4f7-93a1c65b0489", "sighting--53b6845d-58b4-46ab-9e14-2e7b666926d9", "sighting--752239fa-bf18-4764-b18f-f8a4f349871f", "sighting--58f0c3d5-c35d-4220-a5e1-99c23ed23219", "sighting--7af8e7e5-b20f-420f-b185-dea9f68530b0", "sighting--e97f455e-2f8e-4e24-9a9d-e33dbadfc302", "sighting--8e47fee5-1ad6-4102-852c-573fd7b3e349", "sighting--556b02f8-6193-453a-8823-4746a4e7f93c", "sighting--fc7a776e-ebe0-4044-bd54-a2026d4aa76d", "sighting--ef1ae8cb-d563-452e-bfd4-16a6f14df42e", "sighting--536e11d1-9014-4334-ae0e-c01f4e6cf1b0", "sighting--694f4a6d-51c6-470e-878f-5d5b16622de0", "sighting--a2525e0c-edec-4d4c-8c44-f6e69bfb263e", "sighting--7475f3af-b4dc-42e1-a003-c11a782dcf8e", "sighting--d4008c17-cbe0-468e-82bb-634e2ab90c6e", "sighting--59883d53-bcc4-470d-a2c9-a934d866e3d0", "sighting--962899b8-32c8-4836-b66b-8f2f81b85d28", "sighting--6c93e5b5-8218-4c53-a5e7-07b1eec1ec64", "sighting--7a9d8432-5187-42d8-af41-b6da2083f35f", "sighting--6044103f-7bc4-4965-8129-c093de94cebf", "sighting--20902ab3-8b3a-4852-8e5b-70ea5b0ec685", "sighting--e32ae0d6-dbbf-4eed-9a7b-b00fae70446e", "sighting--7fa924f4-500f-4785-a626-ffcd6cf0c457", "sighting--42d56dd7-996a-4787-933e-99fd7333642b", "sighting--929b053e-cbfd-4787-9f1e-3bd99078c795", "sighting--73baa36b-cc61-4d7e-abfb-f12550490909", "sighting--502e088f-2994-48af-a42b-d5cd266e75ec", "sighting--8207dc72-0148-4985-a6c2-1aa1c380a58f", "sighting--7bfc29b1-e85b-49c7-b1e7-8d159e653202", "sighting--c41bb54c-e2f1-4c49-96cd-17b9c6ef6039", "sighting--df2425b0-83d0-4647-918f-db2e0a88c695", "sighting--bf30d963-13ff-423a-a7b2-c20e2fa41bb2", "sighting--8a6c4a38-a87d-49d1-ae77-f9513e3a5b5b", "sighting--68accf7c-c06d-48cf-b5e6-375aa0b93c83", "sighting--0c1ebc9b-9688-4005-9d43-cc4f4d4452b4", "sighting--205d38c5-d755-4993-aa81-3d01be4ecfe5", "sighting--9c8c0e05-18d9-4b23-b32f-c70d72f33d8a", "sighting--5e4961fb-ae6a-43f1-a350-d0829de7bb15", "sighting--661226aa-f5bf-4610-94c8-a7adb622e076", "sighting--67d3c63a-d849-49c3-a3a0-23f37c0b01a4", "sighting--1d11003d-2409-4e35-b2ff-1e10eb367396", "sighting--4f4fbe71-bd47-4d08-852d-f637af543ba4", "sighting--5fdf1456-6b68-4b3c-bfa5-05c93bda5912", "sighting--880dd107-ea93-45fb-b060-d8089c160703", "sighting--2d0b75d5-9397-498e-b895-672888ce1aab", "sighting--a05f9c14-38a9-48d2-8292-dd21c9e37349", "sighting--787d4e4f-3509-413e-a9a9-d513bafe67d5", "sighting--7982351a-ef86-4002-8590-e4e3656e1db5", "sighting--34d2715f-7f36-4ffa-bcb7-dc6affeb8d8d", "sighting--0855a914-b958-4b10-9fff-e67f56a7fc76", "sighting--0d769d51-faa7-463c-b49e-e1fe2bbc775d", "sighting--12457b53-f14b-4a1e-9795-acd7d8f6daaf", "sighting--a91a6844-0175-430b-83a6-b6336381cb9c", "sighting--a11a4ca2-9c03-4d86-b7e9-f0c846a1376e", "sighting--98e0c6e9-f568-43f9-bfb9-5de08840f9e9", "sighting--9cdb5b91-3454-4332-a9bd-fd90642ad664", "sighting--77b335b3-b18e-4ade-89df-1bd79b1117ca", "sighting--d69e4250-e3e7-44f2-87a6-3c81cba26786", "sighting--1444318f-c7d9-45b9-9881-c09ad97b49c9", "sighting--f58e4246-13c6-4442-94fc-0b7e72b3b832", "sighting--105ce90a-5d15-44dc-9ca0-58d59c871e92", "sighting--18294a9e-f47f-42a1-8a86-db6d805e995c", "sighting--82eb985b-ad3a-4bdc-b61c-d871d58dea57", "sighting--d2012f90-ae9a-4094-bd77-68c1736599e5", "sighting--7a429ca5-c43f-4e3f-92b6-0ec22bd87463", "sighting--8d4613e0-2268-467d-acbf-60464cabf242", "sighting--1719a76e-5cec-4431-8dee-7a9004451a16", "sighting--ba9cfa59-05de-4722-a116-e6d57042fa11", "sighting--215cf123-f1ce-446d-9e89-af92736dc138", "sighting--aba96270-9b89-4f38-90be-a81bb0048c42", "sighting--592b9d89-86cb-47ce-8585-e9081d26f000", "sighting--804ad910-79f5-4068-a8f1-59807023dc68", "sighting--f705a67f-a8fd-4126-917b-9692fdba16d2", "sighting--d295a479-cb66-43ab-9a26-58f6a15a700a", "sighting--3a9501ea-1589-4292-b019-7e38506296bf", "sighting--4f56257f-f881-4fa3-a440-ab92bf2145bd", "sighting--79ef0db6-12fb-4fc7-8747-a08ff5a48bd9", "sighting--e79660f2-b801-4c00-9893-7a34ecf695d8", "sighting--8584dddb-95f1-42df-90d6-6b78509188eb", "sighting--a6078d5a-5c64-4b5d-8777-6b78010a3354", "sighting--c2f9617f-1ffe-4dd0-ac81-06ba87d106b3", "sighting--3c4cf2cd-bd40-4961-b421-763ac5558569", "sighting--4641962a-8229-4334-ba29-21f5854bfef2", "sighting--fbb0bdac-8db0-45e8-aec5-42c98af8d792", "sighting--030dda05-9724-4570-9973-16c036ff88b4", "sighting--46ffc337-4bbc-49ca-b719-8d6929aae764", "sighting--06cda6b5-b9b8-46cf-a985-c16c6ff075ca", "sighting--15df78f0-78b8-4ab2-8f33-3e09476fc67f", "sighting--04b9b7a7-3437-40d1-9e3f-7abc8b38982d", "sighting--e1f41071-3b96-43f1-9216-fef5d8879308", "sighting--4d6cc30a-16a2-4dfe-898f-f4ccf3598a9b", "sighting--5157f44a-9953-49c4-915b-cca398b7f406", "sighting--4b779eaa-c02a-49c3-90e5-8b15246a1075", "sighting--05fc9d9b-6ece-4a27-91f8-2bf73308f9bb", "sighting--a2cc7f48-8314-4b68-8cb8-936cfaa2e0e1", "sighting--fddd4ad7-c7d9-4cfd-939a-d4cce6c89c1d", "sighting--f3cd0944-4a98-4be3-8d5d-6cf3e1a506c1", "sighting--7334d863-cb41-4101-92f6-ce749793274f", "sighting--ed74582f-0c20-4f1b-b700-6a780495cd9d", "sighting--cc9e1111-f43a-4e2d-9a0e-3ac774a59aea", "sighting--a23c0dcc-c262-406a-a601-1ebba4608a65", "sighting--98814373-a8ad-47b5-8419-97ef367df3be", "sighting--7de885bc-cbc7-434a-91bd-a6cd8b32cdfc", "sighting--eb024aa6-1f89-4519-bd2a-a660bd13d92f", "sighting--6b9d58ad-b56e-43ea-bcba-4a5dca690364", "sighting--990a9341-1b02-4092-abd7-95ee449ea436", "sighting--125fba03-71e2-46c5-aa1c-b87ffe34451d", "sighting--78afe6b2-ce7c-41ff-9be4-3ee4a97dd127", "sighting--8a5b4a89-8a67-44f2-b1d3-aa10b3ab1f62", "sighting--e744d4a9-65b9-4f30-8ed3-d5364f273a34", "sighting--188d1815-10b7-4cdd-aee5-21ae38444e61", "sighting--d118c705-9646-4c7e-9be1-919f180acf75", "sighting--98e05c54-cca9-4506-82c1-9a01f41c80b0", "sighting--406c8936-9e58-4a33-a5f9-c4f48b1ff99b", "sighting--c08b7ae1-ba70-459c-8ec2-817ebadf48de", "sighting--e5e72dab-315c-4f98-acde-5fbaefed16f2", "sighting--f549ec9d-49d0-41dd-b722-ff639a9d9f97", "sighting--89d732ba-5fe8-40eb-b902-1ec3e76b0c57", "sighting--29bda178-4c14-4d5f-9bf2-5eb27b447995", "sighting--2a7ca256-009b-46a4-a1f3-acf456f7a233", "sighting--8b6d0713-53a9-430f-a107-889adcea3b42", "sighting--4c1dd40b-953e-4a3d-914c-a2a78c20de9b", "sighting--06cb0392-731b-400c-b946-d11224df1c77", "sighting--afe60d79-d398-49dd-b05a-71d91a3b8baf", "sighting--72aa3a9a-f91b-4713-90ec-546e668b5b72", "sighting--d72accbe-716a-4569-85a6-837ddbd03c92", "sighting--11ea2ffc-7451-4f9a-abae-3771a327c5de", "sighting--adada3a7-3f9f-488d-8047-f57fa0dac3b3", "sighting--2e3d954f-db19-4ec4-9ed6-9b0be270fcef", "sighting--f3b2621d-a321-493f-b2f1-8af29167e221", "sighting--a8a1e8c6-0e0a-4721-ac3a-3b959fda3719", "sighting--658c4428-8a87-442e-93c7-2dc026f71197", "sighting--e34d5245-9fa1-43a5-bad2-4925997f9cc9", "sighting--5a2d84f9-f038-4660-806d-8a8c602dab44", "sighting--68e54a09-afa5-4931-8c49-3e0ad599a19a", "sighting--10495ed1-82da-4f34-8065-4c003e9b7b3f", "sighting--f5a09253-143f-440b-be15-74337c9bf11b", "sighting--d79693c9-8d74-4580-9951-39c0d926c10b", "sighting--8e042136-96fa-4956-b4fc-395748078d1e", "sighting--1d9323c4-d707-4b2b-89d4-3caf039e6ff3", "sighting--9674a555-7395-4287-af23-9354596c94e7", "sighting--70e42458-21d1-4a37-b8d5-f486cbd4c642", "sighting--10a59480-8bc3-4695-b45d-a5deb16fe0c4", "sighting--cd423fc2-6bae-4684-82fe-66132f7db64e", "sighting--6afa0715-eef7-4361-8532-4ef9e2576e38", "sighting--420858cf-3599-46b0-ab7c-288a5ed460d2", "sighting--21ab649e-b91d-4242-83ac-f93ffe7965d3", "sighting--48b70ffb-5a59-44c7-a6ab-4c12b80332e8", "sighting--bbbe0d82-a979-4889-859a-2a15deeb867f", "sighting--48c03a4c-e09d-4c8c-8459-b763789cfaa6", "sighting--034d259f-ba44-401f-b326-d438c4119cfb", "sighting--5bd7996a-ebcb-4735-9935-50e277c21c1b", "sighting--e38e8a5a-95cd-4a73-9d37-c3401a6dfcbc", "sighting--1fd6d873-403c-4eb9-ac28-4d6054a1a4d1", "sighting--a31e80c5-027f-49c9-b007-b1fc12d7bd73", "sighting--7f00cb21-4868-4e06-81be-9347af932129", "sighting--f17e7671-1b27-4289-829e-7b7f09df75e6", "sighting--fda9de94-c34f-414b-9693-aa3273a56e7f", "sighting--56be65ab-5ae8-4f48-b4f3-72a004bda224", "sighting--e00f2635-77ad-4307-9dc4-d612f8628126", "sighting--2f602df1-f0e3-4a1d-84e2-a342d2ff3e90", "sighting--f052c8d9-4358-4b7c-aff7-8d785fc9af75", "sighting--161e5af7-5ae9-462d-8052-6d6b272a3b17", "sighting--f39f23e7-cbcd-412a-af95-fffa4207b24d", "sighting--d50ae099-2448-4d46-ab14-2ebace716511", "sighting--e69bf609-4b0e-4bcb-af1e-cdc3c78426f3", "sighting--c7dc86ea-b78f-4f48-8701-008c540bcdf1", "sighting--1bc7647b-e1a9-4cf6-bdb4-545181ecf3da", "sighting--71248397-f09c-4ed7-afef-e0e6bab01052", "sighting--b9ffcc1b-b109-477f-b385-f14417db4fbe", "sighting--7c015134-86de-41c2-ba5d-5a15ef61cbde", "sighting--b0777587-98b2-46c3-ba99-687010535216", "sighting--57fea71d-8861-4bc8-b93c-c00735819b01", "sighting--958a5505-06af-403f-8fe1-4045486aa49b", "sighting--dd35c3e2-cf10-416b-a6b6-af2864d8ba5e", "sighting--2a5aacde-9b2c-4b37-b713-ff74b9883918", "sighting--4b36ea01-27d7-485b-b0f7-f714c3cb2a89", "sighting--027a1ba5-2c18-4c88-a083-5fdd8a3f2442", "sighting--73b06d2d-eb21-4aca-a4e5-8b1858958978", "sighting--a21c4835-5aa2-4ca8-8744-42e5de00a7db", "sighting--b95e2764-8228-4be1-a74e-cbe9b44fd761", "sighting--a813c69c-ca6b-4259-9673-98d822ee4e96", "sighting--178507d1-70c8-482e-baae-020846554bcc", "sighting--12d84a67-408d-4f6b-9093-c1017b950285", "sighting--ec29945b-db8b-4b56-804d-3e4bc738b4d3", "sighting--5e687f26-ec5b-4900-a88a-282bb7417174", "sighting--3d3e298f-324b-4ee3-88cc-928e0c4b4db0", "sighting--57f435a0-8941-4b99-990f-cc116e81cacb", "sighting--a5fcd925-3380-4187-998e-e29be6817564", "sighting--360c8578-e6ce-4fd0-a95d-f91fea86f1a1", "sighting--f59298bd-c0d2-4c67-ae34-ab79f18d4f57", "sighting--a90a51e3-8caa-4604-8937-fc442b78d002", "sighting--ede16486-633a-4255-a4d3-33dd9e18f935", "sighting--3a911146-2ef1-495d-a146-2a7b5fe808c0", "sighting--c582546a-98f8-4c55-af70-bf7c398e21c1", "sighting--64c8d5a4-d1ed-40a9-9b77-becec75f8c24", "sighting--8b47613b-0c4c-4258-be56-6f41d4deadae", "sighting--1fd4339e-e5e5-43b3-bc06-579e2bf41ea8", "sighting--6fef7f34-b363-4b1a-bb6b-9d3d811622d4", "sighting--0ed87b6e-e08e-4d14-b718-b9c31906e2d4", "sighting--106424b2-b4e0-478e-93ac-4f8b73897845", "sighting--67d4ba53-1a2f-47c7-96bd-cb7cd654e461", "sighting--8d8ea2f8-679d-40af-b2cb-19b93fae4311", "sighting--201c1a35-9833-4126-8bdb-874734e18579", "sighting--6d2f78e3-6963-47f3-bfe1-c617dfafdfd1", "sighting--5b1ecc76-4b0b-42ce-8f86-44ae3611ca0e", "sighting--c601212a-08be-4ade-8ac9-8fd30d2968e9", "sighting--249bf3aa-df81-4a49-a4c2-09ef791c4dab", "sighting--5121ba8c-f2a9-4611-897d-6e985a8684e0", "sighting--e27f285e-87e9-4316-9263-e68960e59574", "sighting--7a59267f-3e71-4a97-854f-60e4bbb9c1db", "sighting--3312c63b-4ca0-4730-9348-6cf9d57bee88", "sighting--f1a3fcc8-9122-441d-96d2-38bb3988f167", "sighting--6d98621c-3dd8-4675-be89-5d7a22b7b862", "sighting--60024622-f0c8-4dae-8d22-c8b66ce27c62", "sighting--b0d778bc-8c44-488a-894c-6081a9dad41a", "sighting--6dc08036-995b-4b40-b5de-0b037090fa35", "sighting--cac3d1d3-1da3-49d4-ad96-7f957d74ec24", "sighting--be5eb54d-7b9b-4355-ba42-868b892c0426", "sighting--f7122f34-d9b9-4b5e-abde-ca3aeca9806a", "sighting--536d5097-50f8-45c6-815c-083788c99099", "sighting--d2ada72d-be12-431c-852a-d245476b6962", "sighting--2ba52c01-e6b4-4ef2-a98b-1dbdb39f24ef", "sighting--720a94c1-97fc-4cde-82c7-d6c42d79c1ee", "sighting--3e886c5d-37e1-443b-8df1-75feb2f2ba5e", "sighting--3a165cde-bce7-438f-b547-ce4c4aa98ac7", "sighting--9aab1bb3-d1b2-4cc1-932c-b1fa6ba2e066", "sighting--c5a7e70f-c1a6-4c11-b00d-c34a18df2690", "sighting--7b441dd3-a84f-437d-bb8f-a16088c1052d", "sighting--b0b7b320-2341-4c85-a098-8eb00102978d", "sighting--8a81604b-45b3-4c35-9911-4c35dac31e73", "sighting--096dc57e-5422-443d-a810-799966920a26", "sighting--b0f855ef-b17c-42d2-866b-486d51a10c5b", "sighting--1a75f7e9-80b3-4574-98f7-77d1b0dfdfe0", "sighting--c5c753ff-f96b-4a4c-a21f-5243f731d7ca", "sighting--53d55e1b-798b-435d-bad7-d26ce1fa457b", "sighting--a43ad224-52b1-40da-bc01-bfa3d71b138e", "sighting--f300b8c6-964d-4b18-8f71-49c8d0b2cb70", "sighting--ef81778a-7141-4ffe-b44e-92a2119ad4d1", "sighting--11abfb1a-e95e-4a34-8ccd-caead97abf92", "sighting--b799a232-06b9-4a32-9324-63605af0145c", "sighting--0e300369-bec4-470d-9b52-29651a57aff8", "sighting--61f238a3-13ad-4ad8-818c-f7d3f1318d56", "sighting--3885da8d-119e-4add-a60b-d0f2b8041b1b", "sighting--82932aa5-99bd-436c-af71-1de52ee04882", "sighting--a76912ab-4fee-4fd4-a1b8-5076d40fb06d", "sighting--f225e354-2c88-40b3-91d4-d2113e743378", "sighting--aabcffc5-ef3e-4a6c-adff-4fd823295f70", "sighting--10c265a8-1e6e-4592-90e1-230d0c57b213", "sighting--dce02e49-8909-492a-80c7-dccb9c545be4", "sighting--71969009-c662-4ded-9c84-98685f91c3eb", "sighting--c3c9c842-70cb-42c0-b9ad-9eb26aff0d1f", "sighting--016539f5-2e5a-40e9-be2e-9bd0b9dd38e3", "sighting--e4e1063c-a17c-4abf-b587-f28cd9f28989", "sighting--b37906d6-ba80-4d24-9532-fe72e9ae19d0", "sighting--eb4639a3-1c8d-49b7-8ea0-f9daf09769b9", "sighting--249f2f5b-db13-4811-abc2-d2a7a7c2706b", "sighting--6fa19252-16c3-4476-8931-055318b39c81", "sighting--237daa25-d3a7-49f2-8b77-a38a541d5917", "sighting--c0835181-2240-47b9-9e54-77cacd2f374e", "sighting--192c3591-9463-4bb4-aaf6-da1337f7fbe6", "sighting--cacad0b0-6dad-4e24-9d06-414aa644c343", "sighting--8b5817e5-4f04-4532-aaf1-142ce86f13aa", "sighting--5554cf3e-0d32-4217-8838-542e8a4521f2", "sighting--c78186ad-8394-4a3a-821b-2e10e0a20379", "sighting--7367bb5c-cd2f-482a-9d68-37674cf8c3c0", "sighting--5def05e4-ef7d-4cb8-9076-be6927d9a98a", "sighting--6e75ffe2-246d-4f2c-9468-23f444dfbd72", "sighting--ecd90960-af56-45c1-86ba-503359028260", "sighting--d108e3ba-3f92-4af5-a8c7-b49814e0f827", "sighting--823c8041-64d5-4c45-a1d7-08dc61e6b9b3", "sighting--d9a6665b-f7b9-42e6-b508-de3bc278026e", "sighting--a6a052e7-ab34-4efe-9fe4-bf78533467a4", "sighting--fbcec9bc-f2b4-4ed7-ad75-3888225e888c", "sighting--57ab69c0-fc74-4ffe-8186-2cfc3190f865", "sighting--8b399196-6486-462e-a6df-c54a5714eae3", "sighting--a25c9b43-a7b1-4100-abe7-a343f6f9990b", "sighting--8e9185d6-ac0a-4a27-8b73-da84b7be27ee", "sighting--64f17438-c6b4-43b2-87a2-cc9863bd937a", "sighting--d12c941b-5d20-47d5-a21a-de2aa6a6a7dc", "sighting--f4f0cf9c-b371-4cf7-8555-ba248dd25f23", "sighting--c8dd1988-09bc-4035-8d85-77de83f2bd30", "sighting--f81a11a9-8f0b-4ba6-a1ae-ebdc6ae4480d", "sighting--973a7ffa-e85e-4184-b070-d885024b224a", "sighting--40572f5b-01a4-4573-b815-ea18fe24ec6c", "sighting--b84a5c2d-3c17-4197-ac58-98b6eb747bac", "sighting--8b183e6c-789c-4b1b-8af2-38c9a463d1ba", "sighting--de5830d8-dd46-43e1-8087-70a07f80d586", "sighting--6df4577e-7041-4ace-b90f-4852f21b5cce", "sighting--adadfc1c-8f91-4763-8a23-0fface3642b3", "sighting--f1b59b10-d95a-4d6d-9fe7-00bc8dec4a8d", "sighting--bd745efe-a176-49a5-9508-6b4c3160195a", "sighting--cb1d7555-3e6e-43bb-96ab-e2a37fea6b5c", "sighting--05352e43-f07c-4d0f-8e62-6ca871242ce4", "sighting--7329a832-d770-4691-af7d-8011d10eaf24", "sighting--8e900e68-a763-4c17-9c6c-57b1315b658a", "sighting--4683bb22-e0cc-4637-a06c-f403f13d4fb6", "sighting--af2e050b-bf0a-401d-980b-90528dd3de1c", "sighting--ffaaaff7-9120-428e-83fb-e05aebf8898c", "sighting--94d9079b-3fcd-49af-9446-21a2d7a915cd", "sighting--b916475e-1e18-41e7-ac41-3c95df78fc0b", "sighting--4dd42948-7fc6-4d57-94ce-c2daf893c807", "sighting--0c08ad7f-34ef-4427-a9ef-7cb3244ee2f1", "sighting--aa15f53e-cd8e-4536-af69-a3535179c534", "sighting--7df86ea5-c180-49f2-8b65-3973dc0bd7aa", "sighting--f033a76f-fb3b-4ada-8736-494378137d8d", "sighting--1a5a152b-9453-49c5-bbd1-0fad15d33ab4", "sighting--d9cba125-e9c3-48b5-bbde-10d125947fb2", "sighting--5cb5f52e-0d79-43bd-b0f8-0d904785ee42", "sighting--24a83d2e-dd50-4b81-b68c-e3e7cb279d92", "sighting--a21f8965-ea68-42b8-8c0b-53bbe8d5460f", "sighting--3bc4df1c-8f43-433c-a95e-8a2391c902a8", "sighting--cc2775fc-5439-4f48-b11e-61359c279b65", "sighting--974b19d0-e275-4e23-8d8c-f25514cb2727", "sighting--9a5cbdaf-027c-4523-9425-c33e03bf31db", "sighting--9cff424a-2c94-4c26-aee6-ec78a72f73ab", "sighting--043cb906-6b13-4e88-98e4-a6b18bc53c05", "sighting--5de3eca7-c1d1-4f23-9f4c-a7f3d124db65", "sighting--c5c6609b-8c03-4a99-b9da-0be344edb892", "sighting--4b3cdba1-25e9-498b-9cbc-e05ed64b98c5", "sighting--b4966fdc-5ca4-4cde-bb31-01f94e990531", "sighting--264eac0c-56f1-408f-8bda-71b50cca7110", "sighting--6b84ff8c-fcf8-43ed-8364-5165d265459e", "sighting--2a38ab55-a8aa-4f27-9774-6cd1997547c9", "sighting--276cdb7e-bcde-41c8-84d4-0ff5ffc53c28", "sighting--5e686fd3-fc8a-4de5-bb64-78a8882acb4c", "sighting--d03d7cc6-9a6c-4ae0-877e-a27fc734e630", "sighting--c11aa924-9416-437b-934f-168abb7c52d7", "sighting--69722467-fe37-4655-938e-5bdd56938c7c", "sighting--14744faf-b613-4a06-b63b-b9ddc73f626f", "sighting--df08ad9d-dd6a-45f6-b7d7-9b5707c23c99", "sighting--92cf3800-c507-4613-822a-777122c5b5b8", "sighting--3526f027-5c50-4bd9-8dd3-380bf93a40f8", "sighting--ce6183e1-deb2-43ec-b3da-843447e12ebf", "sighting--4e3bf9c3-046a-4bad-b887-3da41ebe1763", "sighting--7d646954-5bef-4551-8ae8-58654ce73543", "sighting--dd2088af-464b-4c97-813a-f105b097d1bc", "sighting--cb34b733-336f-44bf-a3a8-2c893ccacc59", "sighting--0aeba479-fd23-4c91-97bf-2734edf9a973", "sighting--7953124d-f058-48f6-9f22-61176f546f06", "sighting--9f812d0b-7615-4748-8ef8-b9093375caa0", "sighting--cf931bf8-f7d1-4dba-986d-fcef946121db", "sighting--7aba3f69-d05b-4ad6-b4f9-45dfbf76f782", "sighting--fad615ee-e829-4186-8871-3e89392034d3", "sighting--164abe45-67a6-4a24-8809-192a249d27c4", "sighting--303f37b8-45f2-4ed9-965a-4f3381c35248", "sighting--d99bf019-57b6-48ba-ae15-b771388ba719", "sighting--a229f325-f1f0-4bc5-b360-4b218bdc6425", "sighting--82c35bec-48ad-4899-83a5-cb0f7a2cd6b4", "sighting--2bc723f2-b48c-4fa9-b5b3-3ec0f6dfecf2", "sighting--03ebedb8-f24b-42b2-8e4b-fff31ee44494", "sighting--ca041a00-6dcd-40cd-88fd-07564513c7ef", "sighting--634366cc-5cd3-4b5d-ab32-3c55440b014d", "sighting--1ff3953f-efc6-454b-824a-633aa74a63d0", "sighting--ff4f75a3-cbe1-4409-8622-9e678700e448", "sighting--0a0196d1-05e3-4ece-ad45-fe86c351784a", "sighting--1a49dcf7-6464-4f2f-9e4c-a388bab4e684", "sighting--b1a3457a-6a4e-46d8-90ca-833769e10acf", "sighting--c954d668-e0a3-41e0-a793-f9abf0ec1d5a", "sighting--98f4743b-951f-40ad-9db6-849889ca2975", "sighting--01e80791-c3de-481e-a6c8-1800b2361a93", "sighting--cc2407ae-e408-4798-9729-6ca81361ed9d", "sighting--1d3a034e-3be8-4276-9744-64c9c35184a3", "sighting--bbd1d406-d465-4066-bafe-94cf08240c29", "sighting--6eec342c-58a2-4563-a2af-d8b32464bcb1", "sighting--54e9b7c9-73b0-46d0-a0a4-967d56772a8a", "sighting--896e3ea2-d0d6-4848-b42c-3fbb871c03b3", "sighting--596f4071-d2e9-4337-9a21-d06416e538f5", "sighting--2e323ebc-bb9d-438a-9904-09f84a6aa2ef", "sighting--2450ff85-13e7-466c-a94c-5e7ef44dd4fb", "sighting--a9d05de3-51e5-484a-aab6-a049fc579840", "sighting--2df173e6-1f3d-4666-ae03-850d0979dac9", "sighting--e568ebef-9fde-4188-a6f3-74b76ffa27e6", "sighting--9a17bdcf-99a2-4aa7-93a4-5cca9d04d077", "sighting--e220dc0b-c1b5-4e0e-abc9-3dc8a06f53fd", "sighting--69cd59f5-0f1b-425d-b183-d7bd84ceceb4", "sighting--59954e16-3dd7-4438-993a-bc24ccce0a4d", "sighting--423111be-eb1a-4965-8170-ba53129ebdcc", "sighting--53aa65a0-7797-4137-8a7e-a00d8c89cad8", "sighting--44a11993-5d63-47ad-a04a-261d493426da", "sighting--faa64562-3f81-4940-9adc-36f5d56a192a", "sighting--02fccad2-15d0-4ff2-acb6-437b49468657", "sighting--ff9e47ff-14bb-4c52-937e-4cf932acb5c6", "sighting--3d9c49ed-e408-4984-8019-844f0f873d8f", "sighting--422e66b3-6670-4436-9c3f-70230c78cf3c", "sighting--b6143065-7dab-4ad2-a7fa-fba9779fb66a", "sighting--bcde2963-634a-47a2-b8f0-ce1be00551c8", "sighting--d7f715a2-f132-489c-b454-e634baa8138e", "sighting--a1706724-867d-43b6-92ec-798378d62fbf", "sighting--5df5e488-95cf-46db-b45e-9054d8450842", "sighting--55ccafb3-6dfe-4d86-87de-4fc0a05747ed", "sighting--110f99b2-b5e4-4d0a-9fb2-f8d8cad4e8d3", "sighting--fb4b8bd6-1182-4531-8082-d29006305ea7", "sighting--9277eded-8004-47fd-ba0c-d13fafc2fb18", "sighting--f44aeba5-525a-4943-bb0c-c240bda63381", "sighting--dc19a7af-be61-425f-833c-0705ee84f17a", "sighting--ab058a20-4c0f-474b-9728-4ed26dee6fe6", "sighting--f0954fa9-bd48-4f0d-b835-7128b5489417", "sighting--8b5c65f6-f09a-4250-b02f-811ee2cda443", "sighting--a25f7f0a-87c3-49d8-b92e-4c72ee711f11", "sighting--6e636cbb-19f3-4fa9-9b3c-964ff5f0489d", "sighting--441881c9-4fcd-4144-9145-10229d90023a", "sighting--4fa18a88-bcd7-4c97-9e01-2f8b38601449", "sighting--d2112a80-4192-4388-be5a-6a6ffe59f67c", "sighting--45f06e6a-3a2b-4e38-be65-73efc543c0c4", "sighting--cfd647df-4d92-4399-9df8-57498304316f", "sighting--cf98d621-1a68-4564-8540-639fe8888f3d", "sighting--d1098354-b453-4076-9a4b-c4c406f82f3a", "sighting--0f9d61b9-9847-48c4-95e9-de2219ce7b84", "sighting--b32e296f-e0ca-4428-ae8d-3791f67e3a2e", "sighting--5366cc97-649c-4b11-bd63-40b460fecbe2", "sighting--cc04b924-a79f-4153-8413-5491ab1334a9", "sighting--d7ab65d3-d69c-471a-a9aa-5ac9b3b65ba1", "sighting--9c51314e-ae10-457f-994e-273183aa1b97", "sighting--519cfbbc-f10b-49df-a3b9-0fc2c5666a0d", "sighting--3daa8dd6-cef6-487f-b00b-6811632f7870", "sighting--bcabeb74-7fbd-4066-bd20-6f17b493780f", "sighting--5643d754-10e3-42fa-9ba0-eeb9292f950f", "sighting--775b7ffd-9254-4a72-a1c4-bc45449e6d63", "sighting--c7a5df1c-ad53-4ab5-8ccd-c4cb726cb444", "sighting--131b5776-6f3a-410f-87df-c5123d9a05bb", "sighting--75a999cb-6487-4887-85a7-8ce049b05b33", "sighting--07b5cec9-f737-4bc7-b097-1f36fb20603e", "sighting--49c6cf41-47c9-485a-b2d0-11a3b8f0d4ac", "sighting--7056930b-79da-438d-945c-9b2dd3d69d28", "sighting--07892fde-208c-4aad-bc0b-803b5bd575e8", "sighting--4c9951c2-fd8b-470b-94f4-86d59b71dc78", "sighting--544125d9-ab4d-481b-9fb7-d4096661ab07", "sighting--7f10245b-a750-4fdd-b9ce-588389884744", "sighting--2138a678-1ff8-43ba-a69d-a11f21dfc535", "sighting--36fc812a-7266-4a6f-86a7-a4a19eb4ddc6", "sighting--2cb979d7-59ba-40c2-87ab-b946bd9aa7b1", "sighting--292986ac-32af-4c99-a13a-66ce47fa8d9c", "sighting--ffc49790-9213-49b6-a47a-a999e9e4303a", "sighting--84f1d2f8-755d-4bb6-98d0-1cefe838760c", "sighting--5a2a2b41-ee3d-43fc-a1c8-e27e5112b481", "sighting--0ad2cde3-0a03-4d21-b83c-50ea82e834c2", "sighting--117bb7ee-efd7-4692-8de1-9212c1bce582", "sighting--6e16d752-0d77-43ef-93d9-a0419c76a0aa", "sighting--84d73a52-4473-49a4-89da-8bb011d80fe0", "sighting--091edf04-e994-4da4-9f0f-c8d9db7aefc6", "sighting--8294bbda-af4e-4d71-8d7c-ef6ecda08869", "sighting--d9ef5f29-05d8-4a51-a610-1c2cbe275036", "sighting--1c856374-c3db-4fa8-a7ae-5fd55d47a171", "sighting--65eea421-f283-4df7-ae65-b4ba82c84920", "sighting--2f514c6c-295d-4618-81cf-c96c206130af", "sighting--d02a8d6f-8b08-48dc-93ca-a0b1aa1cd49c", "sighting--b1aaee7c-1de8-4056-92d9-1108a0f1879c", "sighting--18c417ac-42ff-4b9a-97ad-2fcc788ba182", "sighting--ffabf9a2-73f2-4471-9812-24735e8800a8", "sighting--6d03211c-c1c1-460a-8cdd-af8948944b47", "sighting--ed6806a6-46e6-461b-910a-043e0a8593ab", "sighting--8c0812bf-c2b7-4a47-bb54-56f0926e8b50", "sighting--9e0cafac-23c8-481a-a283-ec7bc56fa2d8", "sighting--e415d326-1576-4a6e-a779-11d06e6a2668", "sighting--044c1fac-31ba-44ba-84e8-1e2fd1c5bd17", "sighting--fc57e905-9368-4208-985e-39bbe9f48050", "sighting--b1c05b10-4fba-4543-b398-733bef9b1b7b", "sighting--2a6365e3-7bdf-4b6c-a091-70f965326c48", "sighting--ee1832b0-1052-4610-a587-23300e5bc129", "sighting--be7b2eed-634d-436a-9d69-4501c3fd407a", "sighting--dbfd2279-d6a6-46db-9319-c3eb59f5b381", "sighting--ad8fd93a-027a-4855-a9d8-0303e7d5c92a", "sighting--51ae2944-e225-4759-b964-46ba6296dd87", "sighting--8d6e8a3e-ec26-4558-bc0a-37ed719bf956", "sighting--6d480d93-bd6c-42ec-a869-11486d97e571", "sighting--6b8e04e5-03e7-4255-a9aa-8af7bcec37a8", "sighting--6b867c16-26e0-4f97-9742-de5dd9b1dc8e", "sighting--d8117ab9-66f3-4a1c-8358-d3536cdc96df", "sighting--ba407900-4fec-4ea6-b1f6-7568c23cfc61", "sighting--718fe0ff-940c-4d4d-a265-5d0af986151f", "sighting--a897ac94-a40c-487e-9fe6-651f56002e1e", "sighting--515ee98b-9201-43f8-acb8-4e57b4fca4d7", "sighting--262ab84c-fd55-4e58-8ffc-8d7b2ce34daa", "sighting--ea3a8b22-271e-452b-a893-02814d2aacc2", "sighting--e5a907ab-6386-4898-ab21-c22946afc5cf", "sighting--702cf2cf-2c22-4612-a13f-30d0a571606e", "sighting--97ab2b36-b828-416e-9b02-8ffdd659e004", "sighting--95925000-0bc8-4c97-aa13-ff13aff0c654", "sighting--03efc8e3-ed3e-44ae-b7db-dbd02ffa0a46", "sighting--ddf5279e-811a-420d-9671-d40c225354b7", "sighting--08ec41d6-0634-4959-a401-f1a4fbe4dbcd", "sighting--ae63e7eb-2cea-416a-9def-71fd852c4901", "sighting--d4635ccc-e9e9-4258-b66f-ab70b2420102", "sighting--95fa0f91-b076-4233-9989-a6455c24f3e2", "sighting--471e2e3f-b1bf-4a28-ade3-ae84a4714423", "sighting--79b479b4-2e43-4957-9759-079a5972b452", "sighting--46153ab3-8806-4ddd-b575-7d22cbd19906", "sighting--726a5098-6452-4053-9b9a-a6aaf277954f", "sighting--17a3c383-ca57-491f-b08b-5a15c4daabb9", "sighting--5e079920-4b32-44f3-85a6-0e0fd019e4fa", "sighting--d4569818-9906-4aa5-987c-b122b870fdea", "sighting--f1ce0162-c5f0-47b5-a9dc-67c924edddc3", "sighting--34bacc21-dfe3-4be8-aa03-e60f450b6229", "sighting--5c853cd0-2391-4fbf-bb2f-544345bcc4cd", "sighting--bed86b96-2eaa-4f76-970f-fd62830d5f57", "sighting--9507ee13-75a5-4fc9-a966-10f8f855a60c", "sighting--48d5d753-54eb-4ca2-b896-9b8dfb2e5261", "sighting--a1b1d7c8-ecf6-42a0-95b5-abfd5f2f5160", "sighting--b8456e31-e16c-4b0b-b53c-779ecee01307", "sighting--b54fbc54-210f-4c85-999c-ebeb35c42f96", "sighting--026dfd51-99ee-4490-81d1-2a351aa51b6b", "sighting--7021b9f2-9d9e-478c-946e-55cd09d588fd", "sighting--475b973e-5adb-47e6-8fa1-718c447a4c94", "sighting--f63b8f3f-f665-4828-9a3b-017c30c1b6ac", "sighting--1b8d8b4e-3416-43ad-9d10-ab45dafb4679", "sighting--61b590f1-d842-453a-9dda-0a81d9631021", "sighting--845d2a00-3ca5-4817-8e27-d98e84430581", "sighting--eed69d16-cae4-4e90-844a-fd43e55bf67a", "sighting--539a706f-91cc-43b4-9e28-31eefe833621", "sighting--2a97f0e3-3e59-48a8-9895-878972b1e756", "sighting--4b5e4113-2109-4687-a2ae-d3e7116b141e", "sighting--7b5d2d10-28bb-4b5b-a91f-121a78688789", "sighting--7fa8145e-d420-4723-9406-f683b8449af9", "sighting--57f4435b-0bdf-4975-ab62-189c766a8f77", "sighting--a6c774d5-b4ae-47db-aab8-28a1b7361261", "sighting--5086c333-0e24-4186-8264-8a3052df1527", "sighting--c0209393-5167-44cc-b152-4746b2abc004", "sighting--77221b1d-8de7-4350-b55c-c8ac0f82500d", "sighting--7ff82fcb-51c2-4f4a-9f83-04482a8344d7", "sighting--e10d5916-143f-47d0-b05d-c2f32bcdb1fa", "sighting--7a6a93e9-a43a-4557-9853-7fd935d629f0", "sighting--a9cb6b7f-241c-4f9e-94fb-08b1a858677b", "sighting--60db5941-a6ee-4054-87f2-c375918057b8", "sighting--800a9bfd-2414-4845-90f4-0c1246a7334a", "sighting--0a8b3706-b660-4b8d-9a22-7418b17ebb6e", "sighting--a0074c9c-decf-48cc-bbb6-20d75c0d222a", "sighting--32aa38ca-252e-4d15-a16e-5fed592798e8", "sighting--c4800bd1-847a-4c51-acf1-72c5a98372d5", "sighting--835fb3a3-4686-4c2d-8a55-96f9c871ac30", "sighting--1347a0ce-954c-49ab-bb37-5d0719c8084e", "sighting--f8c7acc7-fde5-44aa-b9bc-2128640a16c3", "sighting--4c9c9f65-c03e-468b-9ce8-a3d9984e7c80", "sighting--7d73f5d7-97ed-4836-898d-e651d1465c26", "sighting--9bc0e22c-9c00-49e4-9487-2d3591b83074", "sighting--85952527-900a-44e2-a7ab-9ca40e888689", "sighting--f6dec3be-8024-44b2-96e5-82a759e4982a", "sighting--ea3549cd-fb86-41cb-aa6e-1913e17c385e", "sighting--7b0ecbf4-d7c4-465f-ae7c-d4f49b8f9dcc", "sighting--b2493abd-90cc-400a-8bf4-9cd6c04bf62f", "sighting--cbc863a5-7170-4d14-800b-f85a6dcc6b20", "sighting--28b2cf05-71c7-47f6-9e4d-522bfb275d64", "sighting--cb0ad99a-30dc-43eb-b1b6-7734755750f9", "sighting--265880df-0ed3-408b-9bb8-f53d48e16fdd", "sighting--8e3d9d8c-59bf-4129-aae8-896b434b1673", "sighting--c9901fbb-e85a-45f0-a8dc-f83ac0db90c9", "sighting--39364928-07a1-462f-a1bf-75e21f806bd5", "sighting--19fa2933-c5a3-4085-8e98-f4114acfe452", "sighting--34702e5a-be71-49ff-ae9a-9318432ea361", "sighting--83fd3f77-cc42-4f30-9f39-7a167f0fcbb3", "sighting--f7228679-2c71-4bed-8746-500c0e4d900e", "sighting--c91fbca2-31e3-49d2-bd34-10e5a6598345", "sighting--9b908dec-6e32-40bc-8244-6ad23203660d", "sighting--6a5b03ed-ab01-489c-9f17-ba702beed4a9", "sighting--a606e9c2-266f-43f2-beb9-105d6ecdc678", "sighting--f4c63fe0-ab0e-4f8f-9cfe-ea0eb336ac77", "sighting--78356459-db44-42dd-889a-0382d4d21a7b", "sighting--6f5a7bf2-6afc-4b48-845e-fb4fa7150e8a", "sighting--ce7425cd-01b7-4aa2-baad-b60f5e9fb942", "sighting--ead317c0-0fcf-4f65-801d-a81daa819d58", "sighting--4601fca5-1529-4de8-a118-750ddca4e748", "sighting--3459317e-4346-47d7-8474-bb5ae610cff9", "sighting--68870e03-2fed-4a17-ad94-560ef065923a", "sighting--8d9aecf2-2632-47c1-b534-a1e549172d7a", "sighting--b98a0e9c-0ea7-4843-ac77-c2e26bac146d", "sighting--2ccdcc84-000e-4593-ae92-91e017ec92aa", "sighting--b02d7692-89b4-4ef2-8e4c-d2e0e6a6ee52", "sighting--2abce6ff-2d94-489e-8359-db26b6643e50", "sighting--e2b7fe1c-3e9c-43f2-9b8f-5176017537f7", "sighting--430e31be-ce8e-47bf-bf78-072d4e36749c", "sighting--113e6400-05d9-4134-a1cb-c76a27c4be49", "sighting--7d358046-f1e6-42d6-898d-93ef01254969", "sighting--d7eca4a5-2c83-4c09-8aa1-870345df3d3d", "sighting--19e7405b-6804-4af6-a160-3323730ddcb3", "sighting--83d0bd6d-120d-438c-af5f-e09439999250", "sighting--7577108c-79eb-4f49-9355-a40b4ea58617", "sighting--da12945c-86f2-46df-83e4-8d02aaffeb28", "sighting--b3716865-e6b8-400c-9e70-6fa3946ab33e", "sighting--aef30fcf-0ea0-41e5-883d-a4731f1efc2b", "sighting--6bbeb1e0-394d-409e-b0d6-dfc9455d9b84", "sighting--133884a1-f460-4e87-ab0a-41669adb1a44", "sighting--24b27c55-9ca2-4e16-bf70-732dcde09695", "sighting--9fa0bb84-8525-43d7-9559-10716663a698", "sighting--27f18cdf-9922-4843-8cdc-73d3d01104c8", "sighting--374306c6-2a77-44b3-9f19-d3fa2c6c76b7", "sighting--57963139-8260-46d0-afc9-520c4e822002", "sighting--5a3a2307-07f1-412b-8875-424a6d872079", "sighting--e336cd88-e8b3-4944-9bd4-e93c3824b6a4", "sighting--04db552e-961b-44e1-9c8f-93697acad8f5", "sighting--0822bf8f-d4c5-4352-870e-a0266688e130", "sighting--e693d1ea-3e6b-43de-be05-75d472712036", "sighting--d6baed15-ca27-4488-bace-e5621d774acd", "sighting--4959c9cc-93a3-40a3-8a1f-ddfcaa49de2d", "sighting--3e3e0240-457b-42a6-934b-b7802baeba47", "sighting--5010b13c-8bdd-4404-87e8-0c5032580d34", "sighting--3cecef33-0bfa-42d5-85f5-577465bc8dcd", "sighting--18906e10-50d2-4bff-91b7-5cd044d07d9b", "sighting--07e1a3c7-f431-4e6f-a777-38504c85cf25", "sighting--f2ca8ec1-4df3-4cc3-b897-5454d25241a2", "sighting--b9f69f89-d6f6-49bc-ae8c-92d698cc261c", "sighting--d66ab8f2-3769-4967-9161-23192a59987f", "sighting--761662b1-5252-4fc0-a939-a83a7e44e9b2", "sighting--a9a4be81-9ce4-48f7-8eaf-d0714ba8c40c", "sighting--02dc7b5e-f556-433d-b094-869399685be2", "sighting--18adae09-afb2-44a5-b455-268628c7e47a", "sighting--f822414f-392d-4f79-8aac-896a875191c1", "sighting--7fc1ecfc-0130-4de2-9c6d-d69009ab6178", "sighting--248a47c1-803f-4622-ab24-59b84cc2230a", "sighting--27fd5657-d063-4176-aa29-98ae347b5298", "sighting--ef55ef3d-b5c0-4343-8eb3-384085b76aa1", "sighting--00c716b9-4488-4f9b-83ab-b66bf803f207", "sighting--455f140a-7584-48ec-a906-b8f87046dd2d", "sighting--b491219f-c09c-4324-93dc-1ccb61927854", "sighting--e2675e24-863a-4cfb-95a6-c08881e13073", "sighting--b0998436-38f6-4865-b42f-fdfecd25f70f", "sighting--d1d12657-50fd-4ba5-9cea-897dd4efccfb", "sighting--4ffe9b87-2205-4d4d-b367-5904766efebd", "sighting--7df06cb8-3cd9-4924-8a1a-b58262b69df0", "sighting--ea395133-6a6f-4e60-ab4a-fccf4f055646", "sighting--44e5fc38-3238-4786-ae4c-c672d19bbf22", "sighting--ae3e0fd7-53fc-473f-a0bd-a9364a50ab12", "sighting--9ca82e1e-5980-4465-b370-20de97e947c6", "sighting--95153ce0-3b4d-49b8-a650-c34789ffa50c", "sighting--8007b916-9c23-47cd-9e7a-3c54b103c4f4", "sighting--c73a8845-b74f-4f29-a247-7c02402d8235", "sighting--4f197765-9d2c-43f7-bcbc-2644c1c319ad", "sighting--250ce0bb-bcb6-4094-97ba-51a8c1dfaf64", "sighting--7294c95f-16d0-44a8-8547-c1a8393dcdcc", "sighting--7442ea78-769a-4daa-9373-fee839f8d05e", "sighting--193b99dc-5b8e-41cb-8e54-3060d47127b4", "sighting--4eb263e7-8f86-407e-ac01-c0dc8e027b79", "sighting--ddc76ff4-02da-4549-9c6d-d35d97ea23fe", "sighting--20f1d489-6f58-4637-a501-75439ba995df", "sighting--f89c04ad-8ecc-4078-98e1-aebc88a684d2", "sighting--45b06cff-37fa-4a5b-82b9-e89a2ddadeda", "sighting--54312be1-d871-486e-9bd3-26c4cbacb26e", "sighting--a8284e2b-ac00-4b04-969a-a73f92edb5e0", "sighting--5eabdaf7-a9c9-4f65-ba85-203350233f32", "sighting--780ad6a2-c813-4fb6-9b83-15d224168d28", "sighting--279fadbe-38fa-4402-bbea-92185542f03f", "sighting--53e4a4d4-39cc-4953-9f90-56fd5e63983a", "sighting--952f30ab-b834-477b-be72-9a00de7f2ce0", "sighting--28aeb186-0811-4ef4-8342-f4c217ca8aa0", "sighting--24947585-e46e-4836-a2fb-3641201da7c0", "sighting--390edd24-3b26-4e34-981e-b757fac8d9ff", "sighting--b56295d1-ff31-436b-b33d-4b52dd7a41f5", "sighting--5321e680-9632-4f58-b6a5-901850ef5542", "sighting--b5ac9ebc-d9b4-4281-8f40-75f0c623a737", "sighting--5d940e5c-6604-42e4-b5d2-d65a36b32f32", "sighting--bb900903-020f-405e-894d-d5b3c274d01f", "sighting--33138e13-a2fe-44fc-bddb-45e352053fbd", "sighting--56852226-b2af-4860-b688-e5eda89cf314", "sighting--96a4d645-fb41-4834-9b3b-ba7759230ce2", "sighting--9b89d2c3-d6b4-49f4-82ab-65f7ecd8653a", "sighting--05059c75-49a6-453c-966c-ce58a46c2e86", "sighting--aab8f67d-a0b6-41a6-b8ec-483b362d00f8", "sighting--dbf8a98a-024e-4f54-bb97-6b3e374869d2", "sighting--69b494e2-8fbc-41f7-866e-e55bcf37c0d4", "sighting--f619de12-ce22-43a6-a159-15e0ceca93db", "sighting--fd7f82e3-babe-4c2f-8e54-2caf93c9ae5a", "sighting--71f5dbbc-cb26-4041-80bb-1161e52358ed", "sighting--7ab2a491-950c-4783-9d60-2f13fa08beae", "sighting--9479e681-0fc4-4818-b38d-87161bcbe1b9", "sighting--716b2a96-e445-4b10-b8d2-6a6be0f44083", "sighting--b57c5c54-f90e-403f-98e8-a81c50253f4e", "sighting--34b3185f-206a-42f1-84ab-5f850d9ecd5c", "sighting--60e35f60-ff55-44dd-89b1-073a0e94c75f", "sighting--9fc314ff-6900-4887-9810-6ac66349dcb6", "sighting--8ade0752-4a04-41f5-abf0-2b4ddadc7f22", "sighting--a5d8f0b1-2385-4809-9e35-81601082cb1e", "sighting--05ca3785-ad39-4f76-8c31-740fd1841752", "sighting--5c058779-1ed4-4c20-8265-abc3a38e6b2c", "sighting--e64dda3a-34c0-4af8-b4a6-3d954a907c14", "sighting--372d16fc-ce90-407d-b94b-10f8e6c67669", "sighting--2c093bbc-762d-40aa-b50e-ecbe33152d7f", "sighting--0687f0b7-6c23-4ecc-8cda-d8716b3c3c31", "sighting--b2d1623c-a477-4276-9021-d2ce0dfd4082", "sighting--efb23798-5a7d-481a-aa53-7c7fd5aa47d3", "sighting--09f00370-4b2c-4faf-ad5f-fc77d08415df", "sighting--2a7b4bf1-e0f5-46dc-a306-a62926cdff07", "sighting--ff754435-8af4-445c-9b22-d80238bb7c2c", "sighting--adecd600-e3b2-4a09-a163-7081c845811b", "sighting--a8923b0a-3962-4213-9bfe-6b78e1464af9", "sighting--f9da0011-98f3-48bd-9c7a-360d81fe59a8", "sighting--5971eb9b-46e2-4183-a39a-0898e9c8bfff", "sighting--c1494064-c644-4e07-b39f-fc34e67ea9cc", "sighting--993b5c06-e355-47b8-9067-cba4e1842648", "sighting--51aa99f4-ae9c-4100-bb61-836913653ad2", "sighting--d488467b-43e2-4a6e-aff9-09caa83b70f5", "sighting--3f029421-d4f9-4293-8a18-d4e3b3677ab9", "sighting--0e6e4366-1931-4e97-b3c5-07fc6fd9be8c", "sighting--38a61192-d8dd-47da-8fe5-9e9551287662", "sighting--3c752787-d4ca-40a6-9f97-97cb4c42113f", "sighting--b38d8727-5018-43fd-bc2b-c8c80eb0c254", "sighting--1442660d-7571-4b6a-b103-43abab22f894", "sighting--4968610c-092c-473a-b032-f9a2af019494", "sighting--85f1b8d1-23cd-4003-bcef-5bf3d9c59248", "sighting--049f2e31-e2e7-42eb-b52f-9a18a35de87c", "sighting--7787b635-ed19-4d03-ba38-2104153629ac", "sighting--06b392e0-53ef-4aa2-9a78-51440f6080cc", "sighting--c0b7f0af-57aa-498a-b1dd-7557483e0448", "sighting--0dd740d8-c026-40d0-9774-def865f9cf64", "sighting--d58f1376-48cc-455b-80ba-272e43b4c7f4", "sighting--5422b939-04c6-453c-9bdd-eb9caeace4a1", "sighting--82795fcf-5f73-40bd-9a8d-4edd62b45e02", "sighting--a8325a26-aed4-4816-a5cf-2019702410b6", "sighting--0c6e160d-e8a5-45cb-9156-4140deb95b9c", "sighting--383c2004-b891-4a88-bfac-f7f0116f13af", "sighting--46e95a7f-87af-4ebe-87fa-72cd98055c33", "sighting--33337aa0-d6af-4a58-8617-ef371518f0eb", "sighting--19694aab-bc1e-4d1e-b201-f18d8ad52cd6", "sighting--5ba5a31e-3185-4464-8d0d-6764d489443d", "sighting--76343753-b766-4974-8882-6c9e2c11ad18", "sighting--9eec509a-3c8a-4972-af17-b16b629c7098", "sighting--f467a45e-688a-4441-8a5b-94f13d347b64", "sighting--cdec7b2e-b49f-4bfa-8470-50473c26eb9d", "sighting--b5e5ffdb-282d-4364-a999-af7f6b36364b", "sighting--41e85609-2490-425e-97a6-e2e260f63a6f", "sighting--21e66145-c568-4e5f-8a2a-9c9a2d5fb949", "sighting--d9de9b9c-4dc9-497a-ad9d-b94c57696ad6", "sighting--f3683d7c-4f51-4236-8332-0f3465a01fc9", "sighting--c2161a00-43d6-4891-8206-40fab2689547", "sighting--94d98fcd-c361-4906-9b66-19bbbc4bd8ad", "sighting--c1959dcb-24c4-46ab-8b02-bb10fb6af89a", "sighting--75ea1ffa-27e6-4d9e-939f-ddcbc57a47cd", "sighting--ee46af88-c475-4a0f-9ae2-a1df7c288c8f", "sighting--5d26af80-b30e-4f42-b8e3-4b1d5765efec", "sighting--655588e5-023e-489a-a7ba-ec4d2872b777", "sighting--b2c97847-6546-40bf-aeb7-d74bfd14cfc7", "sighting--52dc8e1d-2a67-4aab-ae2e-8703d6e1ad4c", "sighting--8f36a395-5b05-415c-9ca7-9d2a1662bfc1", "sighting--110cdec6-36d5-4f3e-9a27-b904b4333d85", "sighting--6a540bd2-8cba-4159-bd62-54c911eac5e4", "sighting--8779a7b3-a61e-4b47-9858-45cdbadf0c22", "sighting--70920510-fca9-4654-8fd6-faeecef4253f", "sighting--551b1ee4-ed81-4c74-9b07-945c95db0576", "sighting--5a1c5c4c-ca9a-45e8-bf31-e54580370aaf", "sighting--06a3e180-ab4e-4314-b9b0-6db5aabe1634", "sighting--13f861da-0111-4c1f-8f96-04aebdd41ce8", "sighting--a30d5265-7e1c-46ce-a2de-232c7b7efe2c", "sighting--fa907717-bcf7-46e3-9db9-68bcd9cf9fd3", "sighting--dea097b3-c6c1-4f47-9f00-fe9df788493a", "sighting--a367e34e-b53f-4283-a679-d21988d74995", "sighting--facaeaa2-6049-4477-bed3-ce3ca169f498", "sighting--650ce058-12ff-47e0-a5f8-ec34e6b92b9b", "sighting--c84f88cc-91fd-4118-b2aa-ace977413404", "sighting--f482c068-ccec-4432-85b3-2fdeea753916", "sighting--f3ddab4f-3da0-43c4-9652-1cb5f1c679ce", "sighting--d13a09b3-6cd2-4cca-849c-b082c785bae0", "sighting--c2605244-afc2-4932-9bfb-9ca51493f6a8", "sighting--9935a8f0-7b35-4631-ba60-5498d4471259", "sighting--c59e24ec-2eda-4ed6-a564-6f1fa5b82d0c", "sighting--3f112a2b-641b-4727-ad0f-69f0206f2a3d", "sighting--4f93de79-b097-47f3-b36a-727371a98fdb", "sighting--315ec4e6-c20c-4772-b6db-509fef60d852", "sighting--e9a11f7c-f2b4-4d94-9065-00bbf7704c8d", "sighting--e1aedeaf-ef02-495c-8b62-4577b219b3ad", "sighting--bd47254d-1f83-46f7-b21a-29c055f71a63", "sighting--ac1652a6-f229-4739-8470-59b22a38fc66", "sighting--8e85670b-44c5-4e56-b655-7920b0919597", "sighting--a86bb58f-981e-42bf-b465-5de364bb922b", "sighting--e92442b9-9385-4793-b164-7185e5670077", "sighting--2a5fd7a5-4266-43a4-99a8-6910ec17e2e7", "sighting--facf81e8-019b-4e5d-938c-436023c97f2e", "sighting--93e325e2-10b0-4b5b-81bd-64eecbd099e0", "sighting--997979b2-4dd7-4608-bb0c-6cfa9de532ab", "sighting--bcdd7c68-7f83-49b4-ac6e-fdd9714570a2", "sighting--c6bc4e97-2f93-4aee-8fe0-76c0019049d1", "sighting--6c4320af-e94d-4555-b742-5d5cd78d8e5b", "sighting--8f54cb3f-b50a-4898-8fcc-b3b882583870", "sighting--d5c847a9-2dcc-4bcd-aba4-26173133f2da", "sighting--5c6a6621-acd3-4d2b-a1e5-1d80d5979619", "sighting--81baec05-a957-4a2c-ab7d-0736b2539094", "sighting--2d494f9d-04eb-4aac-8c1f-7cf7b66b8c89", "sighting--ced2474c-e338-4cec-b45d-acb6f6924c6b", "sighting--85587755-0be3-492d-8dde-9f3548c16a2d", "sighting--87f40b8f-0dab-4d84-b431-01a960f40d09", "sighting--09d1d55b-050a-4bf8-b302-c1d797f7b66d", "sighting--c56a2022-580b-47ff-8239-664b853b5114", "sighting--5ddba798-8a7d-426b-b49c-2b6b1d9d20e7", "sighting--efcd7a6f-a9f4-4c75-bf09-ea50d71e4cd3", "sighting--325cb74c-22b2-4062-a7b4-b6c48ba3f60f", "sighting--5ff0e950-7f84-4ef9-b62b-ed040e79ac5a", "sighting--d9922a48-3c1f-4617-8bfc-742d36e553b2", "sighting--9856dc3a-cf88-4971-ab56-c856ca8be77c", "sighting--45413a59-be33-486d-b7af-0988ffd4786a", "sighting--e9bcbcdf-5518-49a0-a684-33da5c299749", "sighting--4c581d6c-55a4-4b07-bbfb-f95aa305735c", "sighting--82fd8fb3-ed3f-48da-9f13-e35b9cbf246e", "sighting--da53ef0f-2e7f-4da3-a1df-5bbf8db6d0dd", "sighting--c918e603-af95-4d4d-9b79-4b07f0de551c", "sighting--3a77b922-635f-4399-b752-6acee598d875", "sighting--0cf6a91a-7138-4161-9e2a-562e1ff9d344", "sighting--04005d9e-02cf-4d81-a2ab-9b787461b19d", "sighting--c688d941-fe59-4b14-bb6c-b615aeddd312", "sighting--ac39900c-c7c3-4d78-b87d-0babae804212", "sighting--3dca6f2c-5081-461c-9f77-006fcc3286e9", "sighting--64364f15-f67e-4e06-b650-f154fc0d4dd2", "sighting--8414a6d4-7fef-4aee-992e-41640ff17f82", "sighting--099761b4-7cef-447c-a7e5-e3bf49fa0300", "sighting--966412d1-d846-439e-9ffa-c30e71461528", "sighting--28058935-3d0a-4035-85fa-99f9ae0127fe", "sighting--b5b3e71c-80d8-47e0-a24d-61e9c608ccd6", "sighting--5fbed1d1-1be9-4f4c-9fa7-be00d88e60f1", "sighting--75d27896-8beb-43af-982c-c2d89694c2c3", "sighting--309a2698-a9fd-476a-8209-c880623c0112", "sighting--e8cb07f6-99e2-48af-ae96-3d5580e63e06", "sighting--b10df068-0a70-4427-92ee-116562e03d63", "sighting--93b88136-6490-4402-b1c9-dc2beef093a5", "sighting--66715949-48af-49ab-84e6-210e701126e0", "sighting--08a1113c-9b78-490b-9e60-721106bec104", "sighting--c188bc1f-26df-416f-a62e-f653832533f0", "sighting--e2ec1024-78d9-49f1-ad0d-fd5130ce8f43", "sighting--5051a199-b302-41ab-858f-262bdc10998a", "sighting--a7f4fac7-c35e-4c39-9e8e-d18608c4a008", "sighting--464b3d21-46e5-4b3d-a7f0-dc2e590950c6", "sighting--659e2f0b-c9bb-4cb5-b956-c47944c92c99", "sighting--2d2135c8-81e7-4be4-bcd3-4335390768f6", "sighting--740f004e-89c3-49b3-afd6-faa2f5ccec77", "sighting--44373c00-0d6d-47df-9d5b-961bf63ffff9", "sighting--1741268f-4bdb-4fb6-8809-d819ea6a6d4c", "sighting--e3e6d412-7670-4b87-875c-bd3e540d3eeb", "sighting--6c6aec40-e637-42bb-ba67-7ac6822f8e87", "sighting--9b4dd805-316b-4530-bc98-a32980d8d7d7", "sighting--f2a41f8f-9b7b-426c-8773-6198a6cf0d16", "sighting--0dec9dad-c6f8-44d0-9957-a8300075e081", "sighting--e0e4bd62-d6e5-4d3b-b262-39e40f2dad09", "sighting--364ca22e-ecef-4607-b1c5-c72d4e333f7f", "sighting--96124e15-4227-43dc-a240-46f560e45c36", "sighting--063e5d20-9e1d-4ad8-9c2c-5042eccc8246", "sighting--02824954-5072-4caf-9872-8da6f55f6f94", "sighting--99e6fd5b-1ad3-496c-8ede-32a38a20dc47", "sighting--9370a6b9-ca9b-45a1-b975-8cb6d0cf29a3", "sighting--61b7a5dd-5914-4797-8c69-843023a7e7a3", "sighting--16b9880c-bd3e-48e7-bfa9-097d4ccc17a5", "sighting--aa34da13-66a4-4fb1-b221-f39702927366", "sighting--311a2cfd-65bf-4819-a3ee-15dd56154464", "sighting--95632ee3-c3f6-440e-8a68-043ce7e4c8db", "sighting--50058a53-4a63-48fe-878e-3f217aff9817", "sighting--b277328e-e4f4-4cb9-80db-0b66a1e37b42", "sighting--8bf44f2b-6611-40bc-9e4e-7f2b762b353d", "sighting--59dd1c56-2782-4e79-8843-dc9ed78f93df", "sighting--30951bc7-eff2-40e5-b4a1-8aa3a656ad68", "sighting--7aaadd92-3538-4b80-8eb7-afe58e261ebc", "sighting--7b9396bd-f0d2-46b2-a1b3-587936662450", "sighting--62f68292-3b04-4545-a64d-c2fe055d8cf3", "sighting--963517e9-d450-4b23-9778-c4664af3fc33", "sighting--2ff99296-35a9-4f0a-8d19-91a5874bab43", "sighting--64bf339b-ffa4-4658-9aab-165631d7eeaa", "sighting--3cb87279-48c8-45ac-af27-3432a4cb4485", "sighting--d1344ceb-52bf-41fe-835b-e09e8eb30142", "sighting--1f07e4a6-4410-4977-9334-1a88bedb43d2", "sighting--33a726b2-3f14-4942-b70a-a219dc32bf0c", "sighting--46d760f9-dc4b-42a5-9264-a2515e1e522c", "sighting--6b661758-1d94-4551-b553-996ed8e7cbd1", "sighting--42f1b37a-43bb-4b75-a832-7bfeaeafada8", "sighting--c42cc3d4-bee5-403e-9f60-007fd45a6f2f", "sighting--399651a8-ed6a-477a-aeb4-20840bbc200d", "sighting--bf4f62a6-e8e7-40ec-9c95-fa7734a01eab", "sighting--05004d14-c47d-4cfe-91bd-498584940d78", "sighting--a742d8e0-ecde-40b2-be26-cf2eee9543a7", "sighting--23c39578-ee01-46f2-bf37-f9c091b77725", "sighting--f5446c6d-1511-4f44-bd28-2db3ea5b0cea", "sighting--2a75929d-f471-4a96-bdbb-f44060cca583", "sighting--a100ec5b-2855-484d-a723-ac2824216811", "sighting--b51237f4-be2e-45d6-8713-87308eb3789f", "sighting--719ceeb0-8d40-4443-bf99-c7bdff9343fc", "sighting--4facb733-ca6a-4b52-9fe7-4cf6929b6ad7", "sighting--bb54da31-e383-4294-9bcb-a5946e15f854", "sighting--dde4aec7-5e17-4dd2-a604-91e90a58362a", "sighting--cce8ba7a-086a-444f-aa67-618556fc8476", "sighting--ad7a7825-509d-402e-8d36-2f792c420dc5", "sighting--45808de7-edfc-4ccd-b2f9-0909ba0c409b", "sighting--0dc5fe51-df08-4609-9cef-efa451ac9fdd", "sighting--52b5681e-0130-48a3-aa70-6adaca76e714", "sighting--eaa22995-c411-4a5f-ab2c-c0843304416e", "sighting--bb55aa89-c40b-4150-9289-19233c3f702d", "sighting--e8daf520-19e2-43b6-89e7-5cb6899ceab1", "sighting--c5fef830-5d63-41bd-a6a1-df44683d5f14", "sighting--30639def-d78a-416c-92d5-127ad047fe02", "sighting--dd46fd8a-a2d1-4533-8662-522d41ec2455", "sighting--14a1cdb1-105a-41f8-b704-ccbfb33924dc", "sighting--6ccabfee-d93e-49f0-bbb2-fe667282a235", "sighting--babeaf4c-4f31-437e-93b6-b2ab9601647c", "sighting--e53ec9a1-c140-4a50-9182-02132d0b8c05", "sighting--bec13a2e-b492-4571-a182-5b72cc83a5db", "sighting--5e9b085c-0a0c-42c7-b1a3-0651c4d3ad3d", "sighting--1fce9e07-13d5-4aeb-9956-8f364efd99ed", "sighting--62db856d-0fc8-4823-ae07-2dfae4ef6215", "sighting--b39341da-caa6-47d8-b06f-7c9327e4ca7e", "sighting--a7606ded-dc61-41de-b1d2-1ac616b326a8", "sighting--942b7b72-438e-4446-b4b2-04f1d827fdf3", "sighting--dbf6227f-9f29-4574-93bf-46b4bdfe0def", "sighting--7b53dba8-d9ac-4399-a563-cd95c625c02f", "sighting--ad84583e-1919-4357-97fd-98e6cddca883", "sighting--3fcba577-0900-4d4e-b117-79a1a5131d66", "sighting--756f931e-67da-409a-a987-2d302f6f2046", "sighting--92ceeaef-2d35-4222-bc98-d2e08c9a7bda", "sighting--7fa8772c-2d85-4081-96f3-eac524e616e9", "sighting--6c0d7291-ff7b-462f-bbfc-a1ce5e8bfe79", "sighting--4e3b01c7-058b-41b6-99d2-e97fd4d34320", "sighting--dc396fdf-b9c2-4ac1-af59-3e9fb4e1b3a1", "sighting--081df37d-e7a3-4085-8938-108d16a1613c", "sighting--afe2f381-56c4-4a61-921a-919f655a3c3a", "sighting--421102a2-67c3-45e8-8ee7-718d0b9f7f09", "sighting--4fcf748a-a200-4339-a023-a8c70d3bf0fa", "sighting--24f1406f-055e-492d-b605-92190f2cc4c3", "sighting--f4d60a9a-c92c-46bf-8b51-e91dada84209", "sighting--419c59ee-e6b0-4711-911e-ead933fceaae", "sighting--f89695b0-9ef6-4d0d-842e-04077b04031e", "sighting--7167ff9d-0c67-43d2-94c9-224e745fa492", "sighting--70198952-d94f-4605-ad69-a54abe37d1c0", "sighting--1fec4d1b-9bd0-4b28-9aaf-7fd5fae0e5e0", "sighting--501de000-c1d5-4f21-b674-8c8ea306df8a", "sighting--b305c9ad-887f-4315-9a75-ece6e8179958", "sighting--fad877a6-5365-49e4-8f9b-ed9c120c8234", "sighting--0173adc3-d48c-45fa-8a57-7f8bddc1de97", "sighting--2360a661-bf4c-4dd1-9470-564b5442bb09", "sighting--9b90b4d7-7e78-4bd8-ba28-06a28dd50afd", "sighting--fd222ebd-b9a8-4f93-b784-5b91eba762c3", "sighting--3ac08cce-7060-4701-b3ab-1b69e011e9be", "sighting--9e1dad5c-4d35-441b-bf5a-67c0c77f4573", "sighting--41e7c8d6-110c-447a-8059-7446878e332d", "sighting--8d3afddd-aed8-4099-b557-bb2d1c70bda2", "sighting--0d91ec4e-801e-433f-9250-4708b4707d61", "sighting--91a78ccf-d630-4fac-ac97-b8f2fab0586f", "sighting--4fc9e2d4-00c6-47af-82bc-4f6e94d9ad13", "sighting--666875d5-bca4-4495-ba54-8c01a0d1f0ca", "sighting--40d0bd2a-e6f3-4ba3-8537-5f31212bdcf9", "sighting--76f47d58-1c8c-4487-bb91-d2933f9685a1", "sighting--c0d095fb-f518-485c-aec0-0640b00bcd5b", "sighting--6df1b90d-0214-4bd1-8bb0-55ed06150cd7", "sighting--c71ac4b3-6b28-4810-89d3-62d328b16ec0", "sighting--2053d258-942f-4478-afaf-f8d5d970e722", "sighting--af6fae14-60aa-489b-a9ba-cb80d180386b", "sighting--786be24d-4739-41f1-8831-ca92f22ac61c", "sighting--48e6bf99-4630-4ad6-92c4-6ef0e91e1275", "sighting--4f8c4f2e-0fe3-4d7f-aa6f-0452f3f17773", "sighting--40e99c8e-932d-434b-b1a5-f50576aba7c9", "sighting--1a9d278a-aafa-45a3-8bad-daf7fca0f3b5", "sighting--bf64696b-c635-4a7d-9e3b-9c8bf6715327", "sighting--b4826a4d-40c4-4688-a353-b9ee5c87821e", "sighting--46a252fd-c43d-47dc-90d0-583fc26990c3", "sighting--3deb424a-57d9-4317-8e7b-d7fbf712d5d5", "sighting--87d21bd7-de89-4e1a-ac31-ef7a84102188", "sighting--50b4725a-5175-43a2-a60f-1e299364eaa9", "sighting--d471d664-62b8-494d-b3a1-61877c7e63fa", "sighting--858463ed-9cf1-4b07-8a9e-5016a1ad0165", "sighting--0079513c-ddba-4bc4-ba67-7553b312a19f", "sighting--65a8ca27-8d55-4627-973e-3b0c8127a71d", "sighting--fd3fa732-3fb4-4e26-83a0-6f06319eacad", "sighting--859322d7-b03e-42bf-945c-1cc9e8dd6845", "sighting--1885e607-1f31-4168-a899-25c85fe37685", "sighting--0fdedbcf-d439-4a91-8f29-828edc610f5b", "sighting--4e0b009d-2f91-4501-b21a-22e59227e5f4", "sighting--7bf204d2-49d4-425d-848a-dfd1fc984c7e", "sighting--9d44583c-e204-456a-9092-c91f1d7451bf", "sighting--80153344-0ca1-41ef-ba2b-5952c7e304b1", "sighting--fee25e89-073b-4bd0-b722-ca8f181ab702", "sighting--bc01af8d-9f25-4ced-b163-9caa2be4da10", "sighting--fd76a617-1e38-467c-85b5-ee10171916fc", "sighting--a3740591-6209-4c75-964d-265e31f3110a", "sighting--9f1746ff-7ba4-48f9-82d2-ee4a428d2506", "sighting--fab65a6a-7a90-49b4-8702-e1d6bbd439bb", "sighting--f3ee3910-b19f-47e9-a046-bb2283a1d232", "sighting--d4b35b75-73cb-40d5-b14d-21fd9d6e62ed", "sighting--d253a981-74b6-408b-9656-148440ce78cb", "sighting--8da2fb98-4720-46a6-93b0-749afa1d6789", "sighting--c5592951-3cc2-492f-b8f7-70b6925ece5e", "sighting--a20c2dce-1fef-48fc-abed-a90b5b75af4c", "sighting--c27b7743-fd62-4170-8c40-9b2b85baae25", "sighting--35d2c12d-58f1-4718-9a62-7bd14607eb6f", "sighting--c8bd9039-8091-4e6d-b37f-65d211eca43a", "sighting--c19f5a89-d00b-4a9c-b4d9-f34d2755c0c9", "sighting--af3354c3-278b-458c-a17c-dd6cb2bfa16f", "sighting--360976e0-9ae9-4514-94b7-d26f481f869b", "sighting--1b06fc29-10cd-44d9-92d5-34da0ba668e2", "sighting--4ef8c3f7-9342-480d-a090-2df2852d140b", "sighting--68b6cb70-8aad-4fa8-818c-3076b07cd219", "sighting--a5e61580-64e3-4ce3-9e30-cd592c678db7", "sighting--5c9a4dd2-5cc5-4dd9-90e6-fd45785e73b0", "sighting--9597b5f5-3d8a-41d2-ba04-c6d92a4aef61", "sighting--b4eb4dab-7e62-4f12-b3d6-615aec2c5eba", "sighting--daf3f1a5-673a-4398-b3ba-488becb2c8eb", "sighting--b04fed05-29d5-4817-a237-1b711d447dc5", "sighting--90d1d6fa-2d62-4a2a-b907-1827907ac94c", "sighting--ace4c3f9-f395-418d-adbe-f07d8869d7c7", "sighting--56d1d79e-4779-4d34-a243-0976a7066283", "sighting--c8ea3eb0-0a8e-45fc-b722-8f4f10b9ca7f", "sighting--179b58d2-43c9-4bf1-bc37-4589fb50c0c7", "sighting--60964d00-49b2-4bc8-912f-324d0047906a", "sighting--38d856fe-9635-4fec-948a-2a6fb6d3023a", "sighting--f6cd7e8e-9036-4b2d-92d4-491f87458a4d", "sighting--6beece3c-e8da-4de5-a45d-0285953c6ff8", "sighting--1cba5a77-7a35-4620-b022-7b2736d24575", "sighting--0d9237dc-0625-40bb-88a6-d06495629f19", "sighting--617ab363-a0c1-434c-9562-cd408e139d63", "sighting--0817c735-aa6d-4855-b101-b99a314e5440", "sighting--ab47457f-6920-4e47-93ec-4bb0a77bd232", "sighting--c4d3384d-2aca-4b57-a33d-464382c08cba", "sighting--682a1a25-93e5-4f4a-937d-49eede8e3ec5", "sighting--e86cc178-7010-451e-ab4f-e93a19dbb331", "sighting--90ba6566-121c-4654-a51c-c4ffc6340665", "sighting--41ec217e-514b-47cb-8791-962a59ea2896", "sighting--f6241817-0a5c-4d0a-84a8-1ebe2cf4ed8c", "sighting--d9d73ff2-0bf5-48f1-adc2-191641b8e7c4", "sighting--a04511af-0647-42db-baaa-3a07240358d2", "sighting--ebb45ab7-de2e-4e03-85be-dfbea5321ccb", "sighting--6e257bc0-613a-4635-aed6-ab2395df07b9", "sighting--69d7ea4d-e1e6-4eba-ba53-dd3617a41d2c", "sighting--3b435e53-2b06-4f80-a04e-26d6398256cf", "sighting--dc47516a-3806-42e8-b74b-c03e6e3ef6d3", "sighting--2868eabb-874a-40fb-ba75-2026aab9e60e", "sighting--67ecad05-af16-4b4f-b95c-b07e87bbd4b4", "sighting--2cd5606e-c920-42a1-8ee3-72dda39172ef", "sighting--e45bd455-1625-458a-9814-61a2b4d12db7", "sighting--0c6711e1-95c5-4ea4-9e12-54b64357bff0", "sighting--cce43931-3e71-4438-a3e9-2f60c5757552", "sighting--5bcb6391-8b21-4116-8e0a-431bc876f276", "sighting--e7d655c4-3726-462c-9209-7ec8f7d55972", "sighting--010d6fa4-b831-4042-9dca-efec6df0a7a0", "sighting--611adefe-11a3-4cd2-a898-17baace92ce7", "sighting--c80e491d-fcd2-421f-9d73-a5031d56217a", "sighting--1c26dc96-36e1-4183-9ce4-0ad66517d5f7", "sighting--fe0bd1cb-e199-4b0f-8680-23621fd441a9", "sighting--0c5ecf92-31f4-4dd0-9afc-955af35fc69d", "sighting--6a0d1503-23c5-4357-8086-9b1524eb289b", "sighting--0845bddb-d046-4c01-b215-630a91299872", "sighting--0582da98-9a4e-4906-80a6-582d1b405689", "sighting--90192fd8-0c95-4bdb-850a-7b822d45eea7", "sighting--a67fa84b-f5d2-40bd-94eb-144e5178b8ad", "sighting--07d961e7-1bef-44db-acb4-fc65e90257a3", "sighting--62101689-0f8a-48f6-ae7f-f0bd2915aa18", "sighting--7bfc8357-a583-4db1-82d6-ff79a37e944f", "sighting--50388099-1cc2-4e6a-9b1a-07fe690f21b0", "sighting--f2b7ffe9-e60a-4178-9b44-1ab4bdb5f506", "sighting--8d210bbd-44f8-49c4-9c9e-bee2ec81373d", "sighting--339c3cef-cfa1-417f-a2d2-46a0fb8b2746", "sighting--44bb5630-5671-42d1-9f05-ad19d50aae15", "sighting--0b16c402-a289-4363-8110-94f93b0c10c9", "sighting--9477368c-eb71-4528-b299-5ed2236c7fb0", "sighting--546efb2d-4f06-40ea-9f2e-95c6b6874e66", "sighting--e22700b9-386e-41c7-bcea-98c232cccd8d", "sighting--4729bc40-06f9-413e-a3d1-630411e89f49", "sighting--57765178-ec6d-48d4-9ddc-1a732ad80be3", "sighting--af8521a5-f943-4598-8b39-beca1d00c52c", "sighting--de4134d2-81d5-46d0-b141-27b00ba80064", "sighting--0b8e5341-b9b2-4424-9060-2837908dd491", "sighting--f87ee423-2f6e-46f8-9735-e62309f00355", "sighting--7ca30fef-e9dd-4998-a7ec-c30f4dde48a4", "sighting--9dbd7626-20dc-420d-a0c6-7fc223634402", "sighting--82d3f3ac-3f44-441b-bb58-667c6cbe0194", "sighting--668db25b-1365-4ebc-a1ed-ce3cfbb342fe", "sighting--6a01f365-3242-4d07-966c-0145b33a7582", "sighting--405943f3-73a8-4527-b374-fafaa2c58610", "sighting--24bd25ec-242b-40bc-9e36-209af5984903", "sighting--4523de9b-bc55-451f-8ac6-ef50e64d2536", "sighting--a37b3daf-e7ed-47fc-97a8-7d627358b422", "sighting--481dfdeb-dae8-4804-90ea-c888fb83bf17", "sighting--1652203e-2f6d-48e6-a97e-87b0489358a3", "sighting--1cabd6b2-d817-434f-a9bf-512e2601f1bd", "sighting--d694073b-f094-4482-a9cd-a2f25a2e17b1", "sighting--84dc69a1-95c4-4917-9539-96a7388a421f", "sighting--c5135f80-a137-4a13-acec-bfda92998f8c", "sighting--41222cc1-7e60-4f43-a6c7-690e7c2593a6", "sighting--64a0f718-8f6d-422a-8ac4-7afc67bc93a0", "sighting--94770853-36e4-48f4-aa9e-a84caa85f05b", "sighting--32ddf980-1016-46a9-9399-47468dd14f95", "sighting--d7e179a3-122c-419b-9729-209a63b5c0e5", "sighting--07253488-5492-4b0b-924c-0425f1f68a6e", "sighting--dd5078b0-d3d1-4d40-9951-a4649508454e", "sighting--f6543c54-d30b-46c5-a7d1-da46fc192464", "sighting--6624700a-18fb-476f-a7ca-1d757f990490", "sighting--7cd5efa7-6759-4a78-b309-05f46170c741", "sighting--58a8888f-a71d-4c4e-9c4a-52729b796f07", "sighting--10072f5b-6e46-46ca-8e4a-194e52346023", "sighting--4afe4fa1-31a4-4c5f-bc22-122bbd7048e7", "sighting--d3c66a1d-f693-480d-bb2b-c373d0fdb915", "sighting--2158c85a-6dd3-4e35-aafd-a78947672d21", "sighting--385186a4-2388-4d65-878c-759892b5297e", "sighting--39789cab-4542-4d51-97cd-192b61880194", "sighting--9a38b50e-5d57-45ae-a856-3f0bea82af18", "sighting--e742be7e-ddfa-449f-9fdd-799b61e9fbec", "sighting--0dda9298-7205-470f-8825-65ee065d2c8a", "sighting--b75785c1-1e0f-466d-a132-ca31e1e4722b", "sighting--894fee26-91b7-45e4-b766-a156f59a8560", "sighting--362f5788-7b2d-42ef-9eaf-f6243936252a", "sighting--ae31b791-8402-4837-92df-37d2790b6e94", "sighting--805a4fa4-bee6-4869-936e-69dbe0ea6cfd", "sighting--f07c334e-cab8-4b45-9bd2-a26faa96a816", "sighting--82279d11-b957-4128-bac7-05504ec9d36a", "sighting--3a8ad76e-a364-401f-abf5-a89747fefaf8", "sighting--d4b64733-26a6-458a-91b3-a1b59f8eff33", "sighting--50608add-1669-43bb-850b-58ed53b5013d", "sighting--300480e8-f100-407a-88c3-dc00bab395c5", "sighting--aaadc6a7-9eb6-4a2c-880a-99ac5dd4267d", "sighting--ba897b10-4fe8-49ce-bbbe-0edaba798f0e", "sighting--3faee612-e38b-4d1e-ba47-7a08592ca626", "sighting--dbb8a8e5-afcc-443c-ad32-fcf93495b19f", "sighting--b9b3d8df-02c8-4fe3-9090-22bddb8f9bb2", "sighting--9a6999c6-b94f-48d8-9d4c-73c9170611f7", "sighting--e6216f7a-feda-4109-8d1f-9d669cb1928b", "sighting--1e6231a5-7cbf-4181-a1be-deeed9c9bb94", "sighting--ba36c052-df34-4d4e-918b-c01cda270f56", "sighting--9af9eff7-01d3-4f48-9168-71509ced31f1", "sighting--12e7e696-c792-4a45-a96c-f94ffb774ce9", "sighting--e76d1447-3b33-4123-b8fc-829a336425c4", "sighting--a1d42df4-f895-4675-bd4d-234c98079e53", "sighting--13de153a-898a-47c1-9550-1ca5ccdd427b", "sighting--5dbed864-d4c1-47ac-9baf-3c325e47686c", "sighting--4d8c03ba-bc8e-4e4f-a232-5417d4654c2e", "sighting--cd2d9444-03a9-4d2e-8cb7-4dc90286f933", "sighting--5e9966a9-49c5-464c-be04-4062d80945ff", "sighting--b39f8a79-e2cd-4b2d-b120-9ee41a81495f", "sighting--1b4aa1f5-cf88-41bd-a9d1-0cd6ddd236b7", "sighting--9c549535-b5f0-4889-a239-612526471b4f", "sighting--cc64d37a-d8ca-4128-86d7-b28a1ee22dc9", "sighting--f289f161-30c8-4459-bc2e-2bf1a7df3a97", "sighting--7f6ac378-9cfc-439c-89f2-755e72222280", "sighting--6f4ac743-e16c-456f-8905-4dc70f87b3c8", "sighting--0f3125ec-fb7a-4ad2-9cd2-fa66b91dd99a", "sighting--87bd54b8-6e1c-48c3-90af-4aa2ba964ac3", "sighting--5ba40063-3390-465c-83f9-52d87035a947", "sighting--98b3f237-9657-4757-9f84-a70fc1b8dbf5", "sighting--efab816e-794c-4606-b7e7-65ff0b902fcd", "sighting--ae2ca8bc-f034-45a3-b8f2-a915f6868cf1", "sighting--5fd20b08-d5dc-4283-b659-1487f34a17f7", "sighting--cd62c546-ad65-4817-b0bf-ab3102577ec9", "sighting--637d4edd-43d5-4395-806d-6de9a41dc093", "sighting--7f297148-6de7-461a-934c-8bdeb3cf55da", "sighting--2e397882-5467-47ce-9586-5e2f365a4c7f", "sighting--d1cc694a-a272-46c5-845a-daca2ce47e6f", "sighting--5d2ce0f8-4596-45da-bc11-93d497933683", "sighting--9d8e92a4-a030-49c4-bc0f-5d1d124bc9f3", "sighting--523d018f-46d8-44f3-a5ec-f1def40ce504", "sighting--f54ef7a7-6c38-46a3-b92b-b00d2f51e7e2", "sighting--02863f46-ba69-4b92-bcfc-7be8c8ed1f1a", "sighting--ab9b6757-b170-45c6-81d1-097ef6735e1a", "sighting--cd900385-d91e-4464-9c79-53ee544e0578", "sighting--425e74ec-afad-45fb-8e61-f854db293286", "sighting--191a9952-94c4-4f3a-aedd-58eccc8ab691", "sighting--ec6c45b5-1977-4b58-8385-e02752177245", "sighting--4337bba9-2a15-4a15-899c-c2e136d4f220", "sighting--5ef5d6db-5a35-4806-a88e-1f8c5d57bae5", "sighting--b5c4fa49-71ac-47b6-9cc3-208428c95d53", "sighting--aaa0a0b4-1e4a-4507-94c3-e79c6c66c7f4", "sighting--c05572e6-c7f0-40eb-bb25-d9f15f556fd7", "sighting--6e66a0c3-7410-4618-a063-ec9958beabd2", "sighting--23216aee-b16e-43eb-b5ae-52fefb332310", "sighting--9354ba98-0781-43dc-a014-fc21f8f0e736", "sighting--509a52f0-853f-4c5e-b424-ffba2f52f4d2", "sighting--414f7d18-0471-4a55-9a50-77582f7b8613", "sighting--32d1e75e-09c6-4b3a-b4d6-92b6c086d4ef", "sighting--6e2b2569-b849-4779-96b2-a17e4d2e449c", "sighting--cd418de5-38f4-4426-adb2-3cc0844789b9", "sighting--6e1317c1-c899-4ed3-9c96-0df55fca6e9c", "sighting--552b3249-4703-47ca-a4cc-389b3503996c", "sighting--b68355a8-400f-4862-9e0d-45ddcee96835", "sighting--be001921-aca3-43a3-bc57-699c62d2d680", "sighting--c0757051-62fc-4a46-91d9-606c8bb6e607", "sighting--f6eae3db-7d1f-4906-82e5-57dff844c694", "sighting--927b477e-79c2-4887-a20f-3fb7b79f3724", "sighting--3a1254d1-4035-4a9f-8bf1-13ca80dd92a7", "sighting--0c373157-bc4a-4166-b54b-2099fb4b8888", "sighting--790a30fb-7a4c-4856-a611-2cf3067488d7", "sighting--3aa1dda3-9b38-4c49-9fdd-7176b4c5beb3", "sighting--11ffec8f-d01c-4636-b292-8edaeb2b3089", "sighting--11c54a04-a0d3-4611-a123-d3da5feb432a", "sighting--294b8e05-74b0-430b-88da-37ad3f85acd4", "sighting--63977dd6-9829-4cd3-95f1-a7193c6bdf5e", "sighting--1e038aa0-7a0b-498e-bb99-2d8854937594", "sighting--b94a82e5-2cf9-4e87-a5a6-a5481646ca05", "sighting--05717cfe-02c8-499a-b0ee-00c89d66fdff", "sighting--391222d6-b7bd-48fa-b249-9ea0f43b6706", "sighting--ae97ea81-bbd3-4e5d-b0ae-ac81be77c077", "sighting--c6bb95ff-4dd7-4ab6-99cd-940f5057ba54", "sighting--d03a85d3-793d-406d-a52f-b16e5a454cd5", "sighting--2fe554f7-82db-4765-ad3a-8dc601319024", "sighting--b899d132-d138-4bf2-ac91-4b7402b9ad29", "sighting--f08f19cc-7ed9-4eb9-9550-2176fb332736", "sighting--32bf3942-4568-4296-9004-13a73597b1dd", "sighting--31976c32-12b9-415a-a745-b7fb05b86889", "sighting--b5639c3a-5b4c-427e-b757-79885e3c99be", "sighting--74aed4ce-2498-44eb-9998-373e0925faa7", "sighting--4d920273-7096-4637-8120-4a5e0d7da0a0", "sighting--eab5fcd7-48bb-4ede-95b1-85644aa72f27", "sighting--adb8ab8c-68df-450e-8fc7-5231299b1332", "sighting--cdf0236e-fd2f-4f6c-a4c5-dad75a1c4dac", "sighting--cc47fe24-6828-47a2-8e85-89e46cd570b7", "sighting--67ebb23d-14c4-4b1e-90c2-e549c4f8cef4", "sighting--76c509d6-469a-4945-91d9-51c7d244a18f", "sighting--1c46ef62-d82a-4338-aadf-50170c2309c1", "sighting--85ade6fa-d2e4-4e12-a9c2-b4407f0aa51a", "sighting--b44b4148-1db3-4879-a1c8-1b6f7574b226", "sighting--d6cf9b36-0e58-4f1d-9713-ed561a8973f9", "sighting--73ed8bdf-b138-439c-af49-b2b021627cc3", "sighting--01ebaefd-70d5-474b-b597-59734424d0c1", "sighting--fff7959a-bafc-4fcc-a78a-b76cc52498b1", "sighting--591aab93-f1d8-47b7-80f8-d611061f6718", "sighting--ec6b3e4b-e3e9-4682-a233-ea428dabf78b", "sighting--359b5ea2-6ac1-4ac0-9b4a-300b63dfec7d", "sighting--0734bd5c-1d02-4687-a408-a01b15e3a725", "sighting--b8f0c73a-88b8-496f-93bc-0b32649e472d", "sighting--8ee7c09a-1fa6-44c8-a2c4-08719e221830", "sighting--4ce74abb-9ae8-4c80-9239-1a5c13fb5d0e", "sighting--80b1d6f0-20ec-49b8-95c0-36cbce7e8c81", "sighting--de0337c0-7a85-481e-8b81-63d67bf3d912", "sighting--b4de8433-70fe-427a-a162-74995108b299", "sighting--da76d01f-fbbe-49db-b958-2fd3f8b76946", "sighting--51e81b5d-0b3e-438a-86d8-5d1958ef060f", "sighting--8f99d98e-ced8-4e84-8901-0e8b294a95db", "sighting--7de85c44-9508-4fc4-ac70-e2ec1b65574e", "sighting--8803d9cb-88f0-4bd7-879b-9ab1c96c2246", "sighting--cba23c05-548e-4460-ad84-a17874ed46a9", "sighting--089fd4fb-2a4b-48d8-a2e0-9c7c88af9c7f", "sighting--a5a45c75-3b77-400e-af14-a21fcd13d329", "sighting--b862f549-0a2f-44ee-91ba-38ebcd61c79d", "sighting--b52c5e22-0fb4-478b-807a-c46ff2219768", "sighting--8550b858-cac9-4f7c-8b5f-f78ad42286c5", "sighting--18d9d929-302e-4aac-a066-4adca2a343f7", "sighting--476d923d-1824-4c90-87f3-75aeae6c3a93", "sighting--d96fc5f2-3f42-44b6-91a7-851449cc55b4", "sighting--358a439b-ed9c-4cbb-9c39-2cfc6c8ff733", "sighting--82056a72-981d-4291-baa3-2ec4e4367f31", "sighting--022c866f-bed3-4704-92d5-e1e01ef425af", "sighting--ef5e4a10-0b85-47f1-ab46-4ca9cbb5ebd6", "sighting--15d4c83c-d9ec-4014-b0c5-91219da39d99", "sighting--0de19f51-fe36-4b80-bbba-0857d3e33a1f", "sighting--5e3621d9-4f95-4568-85da-7a0d1a0b048b", "sighting--721c06f7-8334-4b74-868d-eb4686d06661", "sighting--314ac08f-a59f-4958-92b0-3fa248594aa5", "sighting--6582c51b-6319-47fb-be75-0d1568de8c47", "sighting--f7f71c66-7567-4589-93bb-11cf32241cb4", "sighting--041accd1-1bd4-40be-850f-5d241d753697", "sighting--831b8cbc-a4c8-4f46-81e0-487d847aa63b", "sighting--34b052ce-65f9-475d-b61f-a76883ea3e40", "sighting--710a2fd4-7b16-46ee-bdf2-af4c7df0a72c", "sighting--9c46b3ac-2fca-40a7-a784-758cb97d6af9", "sighting--43a020b0-9f9b-4d90-9770-69b175bd16fb", "sighting--d362752e-7337-45eb-9f22-d040cfca0821", "sighting--b6516517-f59d-4378-81d7-aed7732e53c7", "sighting--4901f54c-c8ff-4016-b26d-5393c20c4690", "sighting--83acbd3d-6ab8-4a2c-a3c4-580c7d6c2e79", "sighting--a3e49887-6f16-4aae-9717-5703798f5e48", "sighting--9d2705e0-9a16-46cb-9935-a0749fcbfe24", "sighting--20bacd8d-57ef-4630-a5ff-944f8c6c1766", "sighting--af2c36d1-d0b0-449b-9fba-c5db1aecdad0", "sighting--184ffb15-8d87-48aa-a22b-22394e51f225", "sighting--040d91f4-4a71-440e-b692-d9c044d2e01b", "sighting--1938ce85-6023-4300-a1eb-e834e654b93e", "sighting--706fadae-3067-4c1d-8a42-92373cbb562e", "sighting--62549f8f-a1f7-4463-9419-81c21c1b8d3d", "sighting--ce725b5e-7ffe-4211-9f24-3d5c62d63ab7", "sighting--03cb95c4-4a31-44c0-b095-cb7208f656f0", "sighting--89dd1a63-10bb-45b2-a062-f46647cdfaad", "sighting--e80b989e-6b00-4f29-b3f1-80e522ffd22f", "sighting--7495edc6-adbf-42e5-9b9f-a446baecc3f0", "sighting--7be326f9-e6fc-45d3-a1a2-3a079dfa2702", "sighting--14b74e48-fe37-4645-99ef-3bcab5ce95b8", "sighting--a69b905c-a033-40f5-bd11-dbf1e3fc4ba9", "sighting--d5f33ea8-885a-4f0d-9725-e9cc6eee755e", "sighting--413a2c0d-6433-4666-9259-763e737a1570", "sighting--07f966e3-cbcd-4ba8-b70f-ddf697eac0e8", "sighting--762b46a8-cb8f-4ab4-9134-0bf0817db8d6", "sighting--2f1139e8-b7e2-4399-9775-eb1920c1225f", "sighting--d1fe3e60-a85c-4e54-a647-ae3ee4fe7428", "sighting--8584c360-dade-4725-9ecb-99d307902368", "sighting--31085da6-60c9-4a26-b23b-33dd561730a6", "sighting--ae1ea3e2-3c79-487f-be49-8e4df6f9c6c8", "sighting--c3d36e84-d91e-4b9b-a3b7-51829e2d7090", "sighting--cde0cc4a-77a0-437f-b775-03672c8addc5", "sighting--862e4e3d-5a31-4374-892a-f71172545c59", "sighting--5a93612a-90c2-4dd2-8231-a453ca790ef3", "sighting--010ea1bb-d34e-4b46-b91c-91faf78de4c4", "sighting--03db8f1a-0c2d-4491-af28-60835f143d00", "sighting--5e8852d8-2e50-4956-a78b-f2eb165c8c85", "sighting--cb30577c-1aaf-401c-a58d-d10f229c57c8", "sighting--a4b84d6a-a644-4da3-9cb4-d0de781efbbc", "sighting--17e16b8d-f2a7-4cc8-90c5-76d368cdc75e", "sighting--1a9d9f7a-76c2-411e-9ad3-7d911bb6e932", "sighting--b42460e3-81f5-432a-b625-98b5700db06f", "sighting--c9e10951-a97b-4f6c-873f-25744a659368", "sighting--0b924413-58fa-41ad-a81b-c5206adff1bc", "sighting--01936a75-bf26-4dcd-bb47-4c3661364ef5", "sighting--ec667264-9dab-4d2e-9aad-bbbf6b6c65dd", "sighting--affe8ee2-8c3f-40ef-b813-9325b8d616d4", "sighting--86005071-65a6-4b17-b5d6-c388164d0cf3", "sighting--b2b03ccd-84be-4eef-8f7e-4e84c357dff9", "sighting--ad0ded8e-5838-4c33-be2e-4cfd1d2f1e6e", "sighting--62ef534c-2090-49c3-8116-d821fd2592f0", "sighting--e9e73d9c-2597-48d0-b1b2-b850865209ad", "sighting--a33d59e2-d57e-47d7-95db-c184d20f78d7", "sighting--dfeb8466-fda2-441c-9b41-7fc08ee50ee8", "sighting--aec8b2f1-e76c-4943-a9e6-8b799b0456ec", "sighting--ebabd5ce-3fd5-4c7b-ba2e-468dee6c2f7a", "sighting--3c0c4763-fd63-4ced-b605-5def2bd5f40a", "sighting--20f5fef8-6266-4674-8db5-054bc89c41b8", "sighting--3463d4df-140d-4e99-a8c6-1b244cf77230", "sighting--2cdaf0c5-1a26-426e-ac9b-110e42a2c0d2", "sighting--7b1548a2-1ae9-41dc-b5e1-2c0bf8993b39", "sighting--d7869d72-502f-48f2-ba76-da548deea525", "sighting--1373c4da-ce5c-48d7-a6ea-b46386fa7096", "sighting--35278d13-7401-4010-82ff-e4bde17161ad", "sighting--0b715865-c991-450d-b04f-7369f2adbf43", "sighting--ebf79a60-fd1b-4d5b-bd52-a9014fdf7f98", "sighting--bf7cbe57-aba9-4185-85c7-09a672722311", "sighting--9677c7e8-9a63-4e72-bbcf-c55700a25f30", "sighting--5a7e7236-cf4e-4808-ab04-922834d3e54d", "sighting--4504b140-7e93-4a66-9167-0a3fa74c53f2", "sighting--f2053fe5-c56b-42a7-bbcb-ebaecdd92042", "sighting--554a3541-ee43-4464-b8d3-71d61f221133", "sighting--c61015c8-1640-4aaf-9dbb-8a87d64dd73b", "sighting--4da47984-a0f7-443f-98c7-30993c3b02ef", "sighting--2f375701-3066-49c3-80c1-667e64c6a8cc", "sighting--6fa80249-bc7e-4c81-a4d4-854172cd8228", "sighting--aa56fc80-03a5-4464-9056-ef3948f909ad", "sighting--34534816-cd37-4a04-846d-297f8448c7c6", "sighting--97530b1b-6a70-4bfa-9363-db8b677dc6b3", "sighting--999c84b0-8000-427d-a1c5-19e611b1ab0b", "sighting--336fc754-9772-4afb-9965-d9eaaa1715aa", "sighting--757927d9-1321-4582-b3b7-5bc742c31504", "sighting--0608cd22-64b1-47b0-9610-5840c734b622", "sighting--9272c65b-9302-43b8-9e44-0b15545063ad", "sighting--4adb008c-f44e-4672-a6fd-d4acdb4fa495", "sighting--9e062d81-bcf8-4b0e-a493-deaa0477f2b5", "sighting--27fc92c5-40ce-473c-b088-2d35229d8d56", "sighting--7beea65d-2da3-4b4e-a795-1d72b416b669", "sighting--27a4f1c0-4454-470f-b09e-3a021d7bc6e6", "sighting--6736a630-30e0-432e-b520-95f29a994255", "sighting--8c8bd733-7870-46d1-8456-e5e0f2fe1d21", "sighting--db42f105-32f6-44c8-9f30-2d565b706894", "sighting--a57889c3-5e07-45c8-a4a5-593473f51c6c", "sighting--87f82fca-fb04-46f3-8289-b3810c295bb0", "sighting--8f622e02-2686-4b0b-aa5d-3022e6a48ee8", "sighting--59a91540-58a0-4a0a-9c07-5a66dfa2b889", "sighting--3b4c84cc-928a-425a-8965-bf386fe3862e", "sighting--ba4a446c-5514-4b85-8612-513674ac058f", "sighting--e1220ea9-fd78-425c-9db5-fd48822014ce", "sighting--fa0b9674-447d-4e13-bf83-7c5dc4107d3c", "sighting--21ffd0af-f577-427c-bdb2-bd74611495e3", "sighting--133ebeb4-9c9a-49cc-a6ad-611c157c9f5f", "sighting--0bb82e19-bbdb-449e-a914-0e4b7d567232", "sighting--34f02156-7ea7-40f2-9fdf-3ce038081cd4", "sighting--e10c2100-52f9-447c-be43-bba5440410c9", "sighting--a48cc957-f296-4bc7-aebf-3263eae1098c", "sighting--a1d1a170-db6c-467a-812d-45e94fb2a0a7", "sighting--fbd79e4e-217e-4c39-9604-be6c8cbcac7c", "sighting--d87366a7-9d02-4733-8e18-55e638797172", "sighting--1f64dadc-688a-4583-b94a-f74f2d450fc3", "sighting--70c3651d-a59b-4a0c-86af-ca60824d3778", "sighting--d6743f5e-f906-4bf2-b537-84d94ab5ce64", "sighting--76f34c73-f72b-4e27-aa60-5c7f43740af2", "sighting--ea88fe9d-40c6-49c0-b2c0-34d7c6e7818f", "sighting--4dd80fe3-c2bc-4d09-8da3-ef0bc769dea1", "sighting--edb670c9-4828-49d6-acb8-31759e4d9939", "sighting--3504f19e-8e75-4451-ad5b-eaf0fb6d9e01", "sighting--a353d688-cafb-4e6b-b4d6-b3543a4b54bb", "sighting--b1699b10-37e9-4572-8bdf-817ead199025", "sighting--2536ba8b-fdd1-4343-ac7b-96a96cc5bdee", "sighting--b7490a77-36ad-476a-a8d8-95f35971e895", "sighting--fa10e13c-5db2-4710-b379-4836fb8a07e0", "sighting--1956ef89-fa4f-4b40-bf2a-0bae286d787e", "sighting--855d72db-9599-48f4-bde8-cb03b267c735", "sighting--41234cfb-a915-44b1-8cbc-fb50b56047d4", "sighting--db2b2b25-7e13-4d1f-a891-8ccd840b1e4c", "sighting--a64a21bd-e1a2-4bef-b923-d78a5283b486", "sighting--2bcb2cb1-a232-46eb-ae00-08067c58d793", "sighting--0d12adea-eb54-4395-8ea8-b7c0050ca7f5", "sighting--ddf9db51-ee3b-4646-afc8-36f6c28f51ae", "sighting--6ed6b38e-6936-46f1-830d-79085b0b1c97", "sighting--227da53e-a161-45b6-bb04-c5a6a3ff3a66", "sighting--bdbe8604-719a-4a4c-9d10-d5ec52867a06", "sighting--09c31403-5d95-4c91-b363-5487b9bf90b9", "sighting--b619acc2-bde3-4b4e-a99f-ad3090136d2b", "sighting--4eda1c5c-39f3-4916-abc4-ffe53a449abe", "sighting--b605144a-1344-407f-9439-b038665c7e79", "sighting--33c45478-d26d-46bf-8b38-6f81f791a09e", "sighting--0f0da8cc-6de5-4970-8b60-0903934fb4d5", "sighting--77f0254e-a64a-4ab6-83ee-7dd87a4f19bd", "sighting--1d1d94f6-89f1-4a3c-b416-0dd0ed7f8c7c", "sighting--56951a29-c099-4b60-8407-a998aacd2b06", "sighting--76b61df6-44a2-48e8-9fcf-06b9a5839198", "sighting--99f68575-d212-4eec-b3c6-d8b9647b370c", "sighting--d7554586-8d13-4aa8-9c8c-4f2b632752e3", "sighting--d90a8dd4-cf61-42b8-aab5-f290222bc2b3", "sighting--6c03416c-abb9-4c6a-93e5-659caa03d12f", "sighting--6d77b39d-b9af-4188-be02-2e694cac3aaf", "sighting--7af9c57a-6883-4c88-bc84-9405437ec6a2", "sighting--768b0c9d-08de-45ee-ae34-983cf1a625dd", "sighting--a4434b0d-7295-493e-a4f3-3a7c4f5f2697", "sighting--f8752d76-3a7e-4036-9435-1f4b2d8b40b2", "sighting--2ee320a1-a858-4da5-a4f3-4007d65e83ed", "sighting--2f07c146-7a1f-40e0-9c6f-08f184700457", "sighting--67ff293c-ebd0-4809-8e25-994c1610c4d7", "sighting--962a4502-1291-4be6-a358-d8a2faa94709", "sighting--0ff22330-f8ec-4482-9528-7700051c085a", "sighting--7dae64a7-5685-4c84-a5b9-5094bd990b50", "sighting--09278363-4189-438e-b9e1-9185619792e9", "sighting--97548bd5-06af-4bfe-ae59-b2f064f7def4", "sighting--4b94a492-f987-4424-8cd8-fb3c5ba73541", "sighting--009a7c22-0b19-4579-8292-68222eb88de5", "sighting--e32fc763-5480-4b3e-8db7-8d075b0ca096", "sighting--847b6ada-927a-43a1-937e-e6091a203a3f", "sighting--e299f021-a98e-40c4-93b9-d20da22e8c27", "sighting--25016b2a-e5dc-4e4c-b4ce-1252023b4577", "sighting--a5cf1e93-ea98-4226-b154-6bf541a1db1c", "sighting--cd7538e5-78eb-4428-bb90-638fe21a0d0a", "sighting--337ffd7a-3832-4561-84c6-fa2d034e7c0c", "sighting--bc8b7098-9f0e-4462-9099-420371e702c6", "sighting--eb80607b-0942-4432-9a40-e86b6664f25a", "sighting--6fd4c922-e7b5-4460-a6d2-40364d1a62e5", "sighting--749bd88e-e47b-4a2d-aedb-ae576d33d8b8", "sighting--917a8306-5947-4ea0-a143-cfc860fbfdf2", "sighting--d64b11c1-f38d-4262-8c4e-c06c4d8f76d8", "sighting--d1ae2710-3155-4b7a-8a50-32a90791f99e", "sighting--e4f73aa8-9dd0-417b-befd-9113f879f885", "sighting--a285ef83-5a54-43af-aa96-138cfa908501", "sighting--b5a8a780-b75c-40f8-ae34-a110f47386a8", "sighting--644818af-86ab-41dd-b0d9-aaf8100b3ba7", "sighting--a044f9ab-2ea8-4819-986c-6c87ead82135", "sighting--9eb7443a-8d77-4b64-a09f-a9ec622f1575", "sighting--a9726e7d-7945-4f96-a0f5-9b298747c4a0", "sighting--cd9ad681-7815-4950-aa59-8385c8433a33", "sighting--0920df27-24a1-43ed-b99a-affd828dfe13", "sighting--31db65a0-3f80-4dc2-b189-62234c2bc4a8", "sighting--5ca7713c-6de0-4810-b1bc-64b1bc24880f", "sighting--5d69893e-b1a7-4c5a-b95c-6fed593a9469", "sighting--362fde7c-af3e-4030-9fc6-fd0ca9429177", "sighting--7dc5dbe9-d2a7-4cb3-9c74-7dff76abb150", "sighting--41f59916-017f-4f2f-a716-a46f0ded92b7", "sighting--85b046e1-37d9-471a-99dc-deb4a3ea09ff", "sighting--4f693eec-df77-4da8-bdcd-624afa18ca31", "sighting--351186be-af29-4e6d-915c-38765cd8dac8", "sighting--a877fc18-c29a-4e10-93d0-abceec0e7600", "sighting--38b938bc-283e-4544-be5b-ded855b93182", "sighting--ad7ba7fb-2f7a-4ca0-8d15-e5f9c40e0685", "sighting--5bdd98d8-ce5d-4b28-9024-1241bec272e7", "sighting--facb6ae3-ec6f-44d0-9f88-721a2fedcbec", "sighting--bf627001-b313-4ff6-a3b1-b31a6905e644", "sighting--99c93208-e7ee-4546-873f-164dd692e67c", "sighting--fe008b4e-1caa-43fd-b59e-e6c0cbb18a42", "sighting--92abd821-b38e-46b4-a148-f25bdaaad38f", "sighting--2825c317-0135-4d90-af59-045d89d90f33", "sighting--9324b51b-61c8-4081-a14c-c384005952a1", "sighting--7aed0c58-fb92-43b4-b557-8914931a962d", "sighting--28ea1fae-d35b-46ac-9415-9a873cb117f5", "sighting--200957b6-3610-4f22-a848-e37c6d10d368", "sighting--61ccca3f-9583-4d69-80b9-311c00ca99ef", "sighting--8898fda7-3504-4810-982d-16d419a65af2", "sighting--e933ac8a-4148-45ad-8b13-c82c1379d398", "sighting--a1029d4a-6889-48d0-bb8f-8d83a4436ebf", "sighting--4a1dae5c-2de7-466e-9639-f547f48955c3", "sighting--be0901f0-f211-4101-b7c1-c410f6813e1a", "sighting--e32d2d65-9a6d-46f7-9511-5fe4bf6ec4bc", "sighting--b758972b-1eb5-4ac6-8e9d-2ae12244daaa", "sighting--00ad3b15-acc9-4193-b993-8367c11e964f", "sighting--a89b85e2-41e8-4962-a250-fb6171cc7669", "sighting--b2ae3eab-db28-4de5-a195-2399a7845c75", "sighting--ccf12b13-5730-46c8-8843-8e5e50fcfaa5", "sighting--9b2bc690-bf1e-4266-926f-f3c980da19d5", "sighting--47af1c15-7a39-48ae-840d-ca74937b9607", "sighting--56e5df93-68ab-4f1f-9394-8abc6ff8a934", "sighting--ac0665d6-bd8e-42e0-a18d-871b36fed504", "sighting--f83404b1-c7e9-4ff3-b883-e6ae6781491f", "sighting--e441a293-e96f-40d0-934b-f425cb36983d", "sighting--7b96f797-6ba4-4fa5-b5d0-493c9c40a33c", "sighting--7118dcdc-79d8-4bb0-ba81-94bde1e29469", "sighting--19d76a15-4743-4b7c-9b4a-eb055033bfc9", "sighting--95628b9e-7bd0-4c14-9e16-d0ab555c589c", "sighting--130e77ab-e51c-46a3-b83c-8d7906582b60", "sighting--e184abdf-b88a-4f9c-84bd-9c8a7ca2ea21", "sighting--6c0c1134-4b94-48a9-b3a9-771ea7105789", "sighting--33f55972-2012-4c1a-b090-0126fe168eaf", "sighting--61e5a224-d269-4b46-9442-1c3c74e2cc17", "sighting--46ec5497-8f59-4998-84bc-ce586d554510", "sighting--a5b719c0-f0ff-4ce6-83fa-78c98a9aa0c9", "sighting--7b8f1427-1540-43c1-bb7b-ba26a4610937", "sighting--7cf35ed3-ea88-4279-8693-78ca175c3d28", "sighting--88b6c4e2-2f52-4f76-abd3-5536fd7d1cd0", "sighting--a51dd43d-3491-4bef-bcf2-6dcda2dfe090", "sighting--9cc47065-d311-4ef7-a212-eb8b92505a61", "sighting--425a2d8b-89b1-4083-94bd-ec71de83365e", "sighting--e30c5784-f3b3-48fa-bc4c-c72bd3f1db37", "sighting--d134ae5a-674f-4bfc-ab40-75844a80a73a", "sighting--485e307a-ba22-4ebe-adcf-9771529bb452", "sighting--ad2d8ce1-98f6-43e1-a4f1-d0053dbacc4d", "sighting--174a5a45-3021-44b1-adfc-59d2f2b4adda", "sighting--be5bef26-8dd8-4409-a141-ac9781ecf8f9", "sighting--be31b063-5a7b-4083-a059-87a3444bb1d1", "sighting--9d2d084f-6197-44c5-8cda-78ccf0c2fd40", "sighting--6c913a41-110f-4b69-9bc9-1b5b17070b65", "sighting--9ca5ef3e-70c0-4bd9-ae83-00ddd3ae43dc", "sighting--be3aa786-a58f-40c5-8580-d47bc672a1aa", "sighting--43946395-1795-49ce-9afd-96d59828fe01", "sighting--d67266aa-9c5e-47af-9f63-090358227ac5", "sighting--46e0addf-049f-472a-b058-5e00d879c35d", "sighting--1a78ec8d-e31f-4689-923d-c5626b2cf9d5", "sighting--4c12d2b0-ed63-4a42-bae4-67413a2df1f6", "sighting--464da484-f74c-41a1-a155-e699ce784368", "sighting--06f750b9-c5f6-4e47-9d3c-f9f6f7bd790d", "sighting--f8dc783c-173d-4139-9c6f-8fba3872fc25", "sighting--3d0c9f4d-8199-4926-a87c-5fbc447ce3c6", "sighting--f9140c71-6158-4db4-8607-258f79fe005a", "sighting--31cfa286-0b5f-4768-bae9-4d6fabef5755", "sighting--da4451cb-3a67-4682-8dee-2ed75480b2d8", "sighting--b02f9176-3871-4dc0-8f0e-b154e88be958", "sighting--a9fcebe0-ccdb-42ff-8e5a-c6f786c9cc67", "sighting--e400a794-14b7-46e4-84d3-440f7df73dc7", "sighting--149d5311-e417-4808-8226-59343d2ff15e", "sighting--883f384e-fcef-481f-8af1-5f5a68269fbf", "sighting--92485955-006c-4257-9287-13cd1f5b19bd", "sighting--9688d9cc-abdb-4662-a74e-19749c296249", "sighting--654ebfe9-9c75-4b6a-af75-0e00d3ee5669", "sighting--ae3241eb-9e32-4438-8e9c-595bb21f965b", "sighting--f9b1e0f5-3894-4ce6-b49e-cb3eed5750cc", "sighting--8c6ed401-a17c-4dcd-935e-c43127fd59b1", "sighting--8ddfaac2-cd44-4867-a6e2-9aae013c8378", "sighting--24c19e0e-9829-4ae7-ad24-f25b9fce6a71", "sighting--75fdaf16-0be6-4a66-85e7-3d7837891b8b", "sighting--123082d2-83c8-4a02-9593-37b345f45c19", "sighting--08dc9966-3932-4abc-adf7-9ca35a5d494a", "sighting--601e26ea-1fc4-484c-9704-8d4f1568512c", "sighting--e5ad9d91-470f-4664-9846-ed9b06c6d21a", "sighting--5c1eccfb-665b-48ef-83c0-750cfa7c0083", "sighting--a819f3a0-ca09-4e72-bc3c-a8bac50e687c", "sighting--26ccbe25-17a6-4f4c-b9aa-7d6443be37c8", "sighting--b8a362a4-e767-4c1f-a2d5-8853963cee56", "sighting--8f289f1d-e30c-4229-8b1c-35d6b3f4efef", "sighting--d0b3e3a5-b58b-4c39-8402-d010e7141d83", "sighting--dd64755e-b0df-4711-b470-4ce3c1ed807b", "sighting--f053c610-d92f-4a15-baca-30ad91fed2f8", "sighting--7988c4ca-d581-4635-a2c0-223d029c09cc", "sighting--80cefe01-5e40-441e-b2b5-23966472da05", "sighting--906189b8-a8e1-4b17-9656-75c48275f802", "sighting--c4de5df9-2b6b-4741-86f6-6f0b633c512b", "sighting--89190dd9-998a-4921-b625-a83ae7c256c6", "sighting--bf8376d0-29a2-44b7-952a-86cc8de54402", "sighting--6b12497a-8976-416a-b957-a0fb7d53b21a", "sighting--d5d5fe2b-ac9e-4d1b-93b2-5f334fe579b0", "sighting--5111b938-5248-4a8a-b545-f6c8d3f3c588", "sighting--84104ef5-a735-4ca0-a0bb-029b8a46e1b8", "sighting--dd0a36ff-68e8-437e-a17f-d450cfb65f4b", "sighting--4afb5f07-6316-47fe-85cf-6a023a1ebdfd", "sighting--c90c96d3-d100-45bc-a129-634c6008b04f", "sighting--88522e7a-ba08-4b90-8938-8c175a5708da", "sighting--96fea3ad-dbb4-4d55-9da0-bccea140c386", "sighting--73214a90-407b-41b0-8128-1fc056392216", "sighting--c6febf4a-fd33-4209-b4c7-57c5a7d039ad", "sighting--e5585b95-a871-4576-b571-5b45755a9fd1", "sighting--18c3c0a4-204b-4bea-984c-1ff589ad29d6", "sighting--08fcfac6-e992-483b-959c-ec3bad86fdf9", "sighting--87e6fadf-2031-4c63-8a52-13b45fedd3d4", "sighting--ba1809ac-5380-495a-bd68-95a3052ebf2e", "sighting--12be5448-6fb9-4ab9-b517-957dc9121381", "sighting--2841ae0f-190c-413b-b78c-23f6de23df5a", "sighting--c7d65a41-4750-4e3b-af20-1031a2ab9a4d", "sighting--b9f24e92-3b9d-4e53-be52-eaa82231c88f", "sighting--85a738c7-92c2-46b9-960c-151cfba07166", "sighting--d4bffd75-27aa-4953-b092-df5d67b026c6", "sighting--5e7da093-7801-4578-953e-cc61ed96fd41", "sighting--37857abe-c3a0-4d9b-a3af-b01f6c2a7eef", "sighting--a340d478-d6eb-4469-9b2c-3cdb0c01383f", "sighting--bcfe74ac-f86f-40d8-869d-e908611be77c", "sighting--47fbd4a0-ab0a-4552-98bf-8d48a89ba5ef", "sighting--3b10080e-6779-4a80-b3e6-6f06d55a9444", "sighting--777be6b6-8344-4112-ac43-05c88c590360", "sighting--1e322669-cbc8-4dd8-a9aa-19469d0e948a", "sighting--c75b1d6c-df32-4d71-876b-1f8ad658107f", "sighting--046598a6-3abd-49ea-904a-a09e3e4b10e5", "sighting--bee458d0-8fea-4b08-9cf9-e5c88e3d8fee", "sighting--7bcfd6dd-1b0d-4e78-9052-b89379b920c9", "sighting--43bd645d-4a12-48b3-b636-2acdfbe88c64", "sighting--59dbe031-a0e2-4526-ad93-00d177017e73", "sighting--3730ef71-a5b7-4cb0-b8cd-5d7659289baf", "sighting--8a7cd592-17f7-43a9-b0cc-30e4f8f48852", "sighting--3d08c812-a4b3-4b6e-b954-81cdb84e574d", "sighting--4c70877e-83cc-407a-aa0e-696d508c71a0", "sighting--e4774a18-285a-44b6-bb5c-c0921be3d507", "sighting--dc05c0e7-2aff-432d-897f-7e9c35e6e7e8", "sighting--fdf9a454-ee5e-4ea0-ae33-d059b9840363", "sighting--aa35192a-3b2e-4c5f-92c8-b03015a48df5", "sighting--f96212fb-4d5b-4810-be5d-9f02848ae3c8", "sighting--337930f3-9d8f-4a19-97a4-a6813ac9816e", "sighting--81809e7f-27b9-4f1d-ae26-b524b5a53e0c", "sighting--3ec3240e-e9db-4faf-85a5-6e335602fd8f", "sighting--f0e3258d-a69a-4402-9c4b-d62c20f52560", "sighting--29e7296d-f99c-440d-a0bd-b7fa38aba1dc", "sighting--ab173faf-64c5-4a45-bd7b-b84d02237130", "sighting--7142c462-b2a5-4477-8141-1aed772bd16d", "sighting--cb39cd92-5442-4d56-b3e4-6dd511c0ea26", "sighting--f693a16f-8519-4a07-9761-85b7c596939d", "sighting--a5ae0cbf-97f9-4a43-a740-e9814c8f5e03", "sighting--0a07c888-17bb-45ec-aa96-ae30321a608b", "sighting--b379d71c-0520-4e10-855e-38a358a0b1eb", "sighting--f3a2e9fa-c7ec-48bf-8c08-02f96f6df083", "sighting--5b335a3d-0e7c-4c63-b505-16efaea23c1d", "sighting--4133cc05-458c-4b1e-8bf3-a318860807a0", "sighting--de94244c-b79f-4c81-a7f8-ce60a301725c", "sighting--b60d2cb1-631c-4493-937c-97c0c75438c4", "sighting--2c437935-bd8d-4d04-8aa4-5fc6005de507", "sighting--9a1cfbfb-d501-470c-aa33-55a14b63879a", "sighting--513412c5-b609-4a7c-8a31-eeec56f7ccd2", "sighting--fdd1a73c-31a7-4f1e-b9d7-ae2d9284e125", "sighting--78026786-d3f2-487c-9ea3-6aaf47f7381c", "sighting--1dd7d53d-119c-4b50-a592-1fd9febbe18f", "sighting--4fd270d4-307a-4221-be79-7689c80b4d57", "sighting--1a2e117e-9f67-499e-a5fe-9566de979c63", "sighting--68a61cbb-ac8f-4fe6-9522-71899b2aa3e9", "sighting--b56132b9-742d-49ad-addf-2bd86e6cc0a5", "sighting--f23ce8eb-91a4-4060-a62c-04889df17776", "sighting--890248ab-5799-495b-92d7-0b24d309f5a6", "sighting--61f59384-e9f1-4167-b0e1-a69367a13d5e", "sighting--b2b18a06-1239-4e91-9683-804a5ad48ee1", "sighting--225c1935-a894-47d2-b3f9-f6ad87472836", "sighting--c31f6b22-1cf0-4ed0-9f38-1947b2de585a", "sighting--fcb6cc50-51b2-473b-abd7-7cff65813d0b", "sighting--83335874-2770-4c2d-9063-8cea065e05fe", "sighting--811f68e7-7077-43ed-bb8f-bdfade99f5dd", "sighting--3a718de4-08fe-4595-b61a-d55dd38aa802", "sighting--24e60297-31b5-4ecd-86dc-384297caf8f5", "sighting--9219c3c0-d757-422b-b8f3-d8c33cf84b73", "sighting--09b979ed-1576-43af-9320-bc30221dfb3a", "sighting--b72223df-b31d-4c3e-a502-32157babf4d1", "sighting--8ce2863e-c74e-42cf-a49d-054fc5242c5f", "sighting--e936cf5f-eb05-4348-81cf-f59dc55f3049", "sighting--bb2fc8c3-b990-429b-9826-3b9a84c29855", "sighting--bcef4132-3b9e-403b-9b97-7b49da7f4d66", "sighting--d55a487a-4b7e-45b8-89fd-e294753c7dff", "sighting--fc2579c1-6599-45ee-a19f-b34b97e0d9d1", "sighting--51b50d1c-0d7d-43ae-a588-d1143b70de78", "sighting--3276e24e-25d8-405c-b4f5-1afb8c20d28d", "sighting--2aea04a5-52de-48af-97bb-9f7d068fca5f", "sighting--eaa28c9e-ad9a-4634-897b-143999458f05", "sighting--0cb819be-b2d0-4f1f-9a52-1f7bc433aa8c", "sighting--af24d99a-8561-4f25-bc78-41615dfa928a", "sighting--41195ece-b56e-4c38-b30d-c787ab128144", "sighting--bf176e45-c42d-4701-b448-066b644fba00", "sighting--afc16a72-0309-4c0a-a5cf-c32985857d43", "sighting--90128f48-a444-4aed-bb1d-47ce5921f9ae", "sighting--222d4d73-6cf2-46fb-bc31-77de58a89e1c", "sighting--856f6496-280d-41bc-9927-c67a324ff185", "sighting--d6cd2913-2225-4470-b3dd-bd30508f991c", "sighting--db779f94-4b69-4872-84ea-76f5bd781a30", "sighting--17740e3a-4f77-45b7-935d-7ede2b2b1406", "sighting--a061c4a7-4db1-46fb-8376-dec3d9ef4e4d", "sighting--7a778318-4b45-495b-95ef-cda140ced642", "sighting--256ce2b2-2689-4cb4-adea-3acee067bfbf", "sighting--51a82e15-43f0-43a1-a901-3e00ef28e844", "sighting--c42c849d-643e-4973-bfbd-e9d11494cee2", "sighting--33ab1025-aa3b-4b9f-aa23-1640770cf5af", "sighting--9ffbe35d-0fc3-4c61-8665-d63efd3086a7", "sighting--79c8ab3a-30d0-4526-9135-88996616a581", "sighting--f5f86ad3-48ba-4746-b646-582ee7ee6842", "sighting--0383ca60-01cb-4062-bddb-f53d6fbe26ee", "sighting--0593c032-156d-4396-852b-1c9d5d528087", "sighting--11c02a53-8d9b-4237-828b-f5f695d8bb50", "sighting--53865ba3-65bc-4e18-8ccc-89dd448d43ae", "sighting--95a9d828-d17a-4c9e-90e9-11bb24d0e0a6", "sighting--124ba6e8-8f81-4b20-bb67-6468629a98be", "sighting--08aced29-6b4d-45b4-ae0a-9ce99310292c", "sighting--b9a26909-d33b-430c-afb9-c4423a8c31b2", "sighting--f38a3804-5997-4bfb-a70c-cdb117fae194", "sighting--92e84be2-31dc-4b26-be0c-b5baf3c8581f", "sighting--f0764f79-2808-4343-8e0d-2e8ced5019e0", "sighting--0c45e082-a90b-4084-a330-494aeb26b35c", "sighting--8cb030de-4ff0-46e4-aff8-fd0dcb8dccdf", "sighting--621b619c-f55b-476f-b800-807df09bd336", "sighting--2d227a75-e9d4-46c1-9775-2d461d924500", "sighting--9ccf7367-0f85-4908-9a02-7a0ffb9999b3", "sighting--edd3e411-7341-4246-9d5f-c603aeb3e24c", "sighting--4eac0d3a-ba21-4b3c-a588-d3359525089d", "sighting--02d886c6-c55d-4377-8d0d-b9a8a24e4cef", "sighting--a61cf1f4-ceb1-4fa9-938f-e767bd54026d", "sighting--09e085e5-833c-46b0-8424-7ed060361d43", "sighting--28c919ef-637e-418e-ac01-aa0522e65da4", "sighting--1bd1be5d-1ad7-47ef-8f20-563095112e1f", "sighting--2085aac9-ee4b-42ef-87a3-d6a8b9346d43", "sighting--7515594b-9e46-4af1-8577-216132fb4606", "sighting--268b7b6b-f525-4336-9bc4-ec852684eb4b", "sighting--d73b0442-5ae0-4975-a195-a605eb96875b", "sighting--287d0745-649c-471f-b504-da175e986233", "sighting--08b0123a-02ff-4195-a742-8c19d3f4a553", "sighting--f9a6cb0a-f38f-4937-8fa0-c172c0c49dfa", "sighting--477a77a8-5cf5-4720-a35c-37c99a6184df", "sighting--1aafd784-f148-427b-ab4e-ce8895da0c65", "sighting--7c1cfb26-50e0-4468-976e-c288c40a5745", "sighting--793e83b6-12be-4ddd-b6ca-2ef0065a29e1", "sighting--d46cf699-e91f-4945-a4b9-302ec87849dd", "sighting--8d771a51-9b20-4c07-ba65-7fd7ec36a366", "sighting--1f1f117d-4ef4-4da3-a84d-4d7bc0a46b60", "sighting--f7937103-7d7e-4d95-89bb-e28123ea4b4b", "sighting--c270c1e8-77f0-430b-9957-e649cf6cb702", "sighting--dd4ad8e3-a1cf-43be-885b-04e799b6133f", "sighting--32e36e82-39f5-49cb-b4af-f66be2af4707", "sighting--5f07eccb-6e33-47b7-8bf0-b562c4841768", "sighting--e27f2ee6-6c77-460a-8059-24091fe9751c", "sighting--aff84f60-4e97-4833-a6f0-e47053c353b0", "sighting--ea6ea098-0131-4905-8d22-2f24f6f0e319", "sighting--2cbbc85f-a4e2-4c14-9e18-59608a23d333", "sighting--3bc997e4-8a00-42b2-b5c7-f2b4eeb777b4", "sighting--52564533-c2a9-418b-bdaa-b8f6e6cad483", "sighting--2953d0cd-e1cc-41a3-b610-b5cdbe956196", "sighting--aa5a8ffe-0399-40fe-afc5-bcbfa70e97c2", "sighting--b00174b6-ef83-4281-bf87-b9a92a26f775", "sighting--b0176090-53ee-4957-8fe9-6bc93e9e74e8", "sighting--f913185a-e490-4c7d-87f8-6eb728f8493e", "sighting--2ce0a354-e208-4e1c-9b2d-4d50590a99a4", "sighting--80a02ea9-780d-4af7-b233-0b39997ad502", "sighting--c4ee7def-5798-4403-8818-324b65acfbfc", "sighting--06d526db-ed32-4f75-bfc4-8e84ca06ab2b", "sighting--afc02bc0-1118-4ed2-8c64-0a8e1d4b650a", "sighting--7ef015a1-efd0-4126-9690-71a4b27b378a", "sighting--75851065-49dc-47c2-a788-086777265d47", "sighting--6311be3c-62ba-4618-b7aa-eaeb79272514", "sighting--2b963304-3c9e-4254-be1f-ce742395e030", "sighting--a50d4ffe-25d0-4051-8369-51f6cb4ebf8b", "sighting--cf9f364b-be77-408f-ae70-65b3ce004c54", "sighting--225cbb90-1bf9-4f06-b9a4-6171a9a0762b", "sighting--72b9be95-8c9c-4610-b117-dd5b0f76e408", "sighting--a1f5e562-b828-4dac-a1ab-842ed3dfbfe0", "sighting--7d1e4eea-7505-4038-80da-f3599a260fc1", "sighting--dcaa4ead-fa0c-45ea-adfc-59db742a0467", "sighting--a22c0d34-ba1e-4d1a-97b6-8790e8899f84", "sighting--1245b6fa-1fbb-4f20-a2a8-3456321b43bf", "sighting--af962263-cd92-4ea7-9895-27a9fe7de782", "sighting--7d8758b5-b452-41a4-acf7-488d044687e5", "sighting--a92ffa45-3271-4f5c-ae64-fb63a558ccc6", "sighting--32679df9-479c-41f9-adbe-a6928306f293", "sighting--6dd1a1d1-92a4-48e4-98b1-0fb72e9bacb1", "sighting--971ba32d-58db-4512-8127-32f3ec6af12c", "sighting--88174409-8e0d-44fe-8b05-7094c3074c98", "sighting--a8ba2347-abcb-4441-8d9c-bacdd7f99ff5", "sighting--e4dfa3f7-8195-4e40-99d5-b4da3e162dc6", "sighting--c183a8b1-1513-4a04-9e9b-19a2aad3cbba", "sighting--a5a784e7-c96d-4208-8c70-9d9bd3b4a28a", "sighting--9e487c7b-c46f-49fd-bf4c-83907b479b4a", "sighting--52a22240-e2fe-40a0-8e83-a510e6497a8c", "sighting--1a0fdd82-e088-44fc-b671-4255fa542210", "sighting--0c58ea78-c5d9-43eb-83b8-9840ac6911f0", "sighting--78783520-de15-47f0-9853-4c9a3e89360c", "sighting--c4fbf92e-e698-4fcc-be68-7194bebbf1dd", "sighting--d253f188-6b6a-485f-b761-d5ad65e3573a", "sighting--74cdafec-513c-4451-a398-3b2b614508c0", "sighting--7451b365-e217-4f02-be26-e27941c0684a", "sighting--475cec0f-34bf-43e7-9005-9452cd4a4db4", "sighting--e3d95ee5-b6db-46d2-890b-a84b9c3f1575", "sighting--dafd5dd1-8cc4-47ca-bcd6-0ef618a20957", "sighting--fb02d4d4-eb9d-4d9b-b8dc-30dac5feb613", "sighting--312aa7b4-871c-4c50-87d8-a4fd462ea6cd", "sighting--e44d8718-bf3b-4b35-8b74-4aa7af7c0d67", "sighting--3bc54887-a337-403e-8818-939657d1d4e7", "sighting--db544d96-c522-4072-a06b-5dbc3b868f14", "sighting--96088e3f-8e61-42bc-be14-260eeab9aed1", "sighting--9eb2eaff-3d61-4eea-915c-e0618b9fe357", "sighting--f8fc8558-c02f-491d-8c67-01f5120e173b", "sighting--a7dfa03f-0223-455a-91db-898d6c4b0bd1", "sighting--c416eefa-13a1-4038-ac29-e4e0aa383c4b", "sighting--ab7c8c3c-4f1b-4134-99b1-8542104c24b0", "sighting--a498df30-d0bd-421e-9d6a-bc73a0f434ad", "sighting--df36b86b-4e90-4f30-b550-95f60670fb65", "sighting--d833f58e-bfca-48d0-b008-a1b128d48db6", "sighting--2ed0e411-bb70-46f8-9e01-28d86839cc8b", "sighting--03ffd605-9907-4899-a332-1b0428ee8f18", "sighting--a56de920-edca-4a3c-9856-5b0776f01467", "sighting--695a7eda-b612-4f16-96c5-7a3ae0b6931a", "sighting--aae93bbf-968d-4ca8-adae-f20cfab823e5", "sighting--cc5375e2-660a-4e76-af0f-6f51dd0bf512", "sighting--cd453257-de7d-4582-88b4-1b47410d12e6", "sighting--edb262f2-931d-41dc-82a9-b33071008f80", "sighting--811c2451-5995-4df9-bce4-0ddb7dc91570", "sighting--c4edcfd4-87e6-488c-91cc-54ae2d717af2", "sighting--d195aab1-18a6-4e24-87e6-d83ef59c1970", "sighting--8ebf91a4-2e4b-4925-88db-5a88670815d8", "sighting--d91fda38-2ef6-4c9e-b121-048940083d04", "sighting--5888bcf1-9506-47e8-9d4e-dd56ab9feeca", "sighting--383f5779-64ab-417c-8bf6-4b88ba153e73", "sighting--648a73f3-0ec8-474c-beac-5bf7624e237e", "sighting--dcbbd81b-26cc-4816-8b12-a3621530a7a2", "sighting--cd53c1d9-2a7e-45e2-814b-ada8c02b3428", "sighting--02d0ce5a-3894-4306-8e9e-338e902f679a", "sighting--f9780878-5574-46ea-8855-3c4b0949bb1e", "sighting--aeda08d2-54c4-4bd3-bf1a-76bc111dcc12", "sighting--0d69704f-5da3-4684-ac69-7cd5b0862f0a", "sighting--bd8ef04a-95ec-450b-bbdb-5617f62f1407", "sighting--f832be0f-8e5f-4584-a1eb-5ffc230f6f9c", "sighting--75c08be0-16a0-4f03-942c-290286a5fcdd", "sighting--58844c98-cf2a-4855-a7ed-100fed4dea79", "sighting--6607bf6b-27a1-4e50-b726-7d40d1ba2d6d", "sighting--5bc8c9ca-7b40-46b5-9943-b7396cae7209", "sighting--0a6ab5e5-582c-4bdf-b752-de0182688f13", "sighting--ac33d16f-81ad-4135-919e-6a40e8ae56c7", "sighting--10359b1c-8e0a-4a2e-ac67-d5508ae15265", "sighting--e6c11fe6-1ca8-436a-a794-8e89889426de", "sighting--6b80662c-6732-42b1-bd9d-70fe5c057ab1", "sighting--66f39a3a-8a30-4971-aef3-a2e90cb24bc1", "sighting--12f37be4-ad8a-4400-b938-0b6bdaa5eb8f", "sighting--2ec8f965-7889-4ce7-ae82-89d2dee25c8d", "sighting--c4d8d40f-d149-4305-9eec-47c923c63a4c", "sighting--a242b4e8-4dc9-4402-afbd-10b6abe106b7", "sighting--8b1f0cd6-e72d-4eb9-b387-7de02a4c343c", "sighting--3665c223-2206-4922-96cd-02be12b9f5c5", "sighting--a16fd806-10c8-43f3-bcb0-e475e5ed14dd", "sighting--32ee5638-978d-4819-9d77-ae8ab389c5d4", "sighting--f5f74934-beb8-40d8-8fd6-5d0f130f8a6d", "sighting--708ea933-d936-4f0b-bb3d-e4605a073eb7", "sighting--b477588e-dc59-4bb8-9205-b8711a665355", "sighting--23f95259-2a03-42d9-9194-df9358833b61", "sighting--c2b175b9-a01d-48ff-bd69-2c9b6e119e10", "sighting--ca97da3a-4e16-4e9a-89f1-0b370856a2e4", "sighting--a91ec98a-0c79-40ef-bf39-645f74da94a1", "sighting--3f2ff358-cfd9-4f34-99d6-a98f093c0f5b", "sighting--6a97a45c-59d8-48a7-871a-741cc93c8432", "sighting--b797ead5-05cf-49c8-9221-c2b5cabffc07", "sighting--e8ac4f24-b626-46a6-97d1-2a0c38eef596", "sighting--e2d11401-6596-418e-a8cd-ede5a92d83d4", "sighting--088d33a1-4347-4423-ae3e-cf20520ca016", "sighting--0ac39ef0-4046-4b69-98a1-afe07dcef706", "sighting--b9b395b6-6a9c-4978-ae8f-19f6f093b68b", "sighting--b7a8ee32-08b9-4d8a-a9c1-911c7e84629e", "sighting--7cab2e14-c575-47ba-b2d0-2c4b76d564b3", "sighting--20aa27a6-7f63-4220-9576-90712eb15e7a", "sighting--1f2a5828-c3f4-40e0-ae53-ac4d524add34", "sighting--b241bf0a-b169-4097-bc13-f554c665188c", "sighting--f39fdcfe-4edd-4be5-90e9-6753c2d3aec8", "sighting--5d0b3e9e-8404-4d47-a8a9-d271fc85249f", "sighting--38ee4b73-3c86-4e0d-a8ec-1e6bec97253f", "sighting--05bca5aa-219e-49fe-bd66-40eb4a585721", "sighting--9bb9a8c3-9b59-42f8-871d-bab0eb558617", "sighting--fb49161a-27a8-4b9f-9e11-9854ddab770e", "sighting--b0a716d6-2299-4ce8-a91d-696196cd7c27", "sighting--7fa93e82-ad24-40de-9032-36f97430b910", "sighting--36f58575-cbd5-4bc1-b37f-0f5d0e37250c", "sighting--de6a36d1-cd95-4ae1-b2a8-9a0bb9900794", "sighting--014cce7a-7b33-4c1e-b89d-2d68c73e9017", "sighting--2ab8b1c8-7d88-4263-86f4-f6da9cf1ed62", "sighting--162e7697-a6ef-4748-ae77-70af4e27bd58", "sighting--dd655072-c96e-433c-8369-bad1ab83ee2b", "sighting--f3ad4eca-2af8-42c7-8e3a-afb03f7594ff", "sighting--5f4389ac-177e-4b22-bd39-76e08e82a7a4", "sighting--867632c6-7551-4676-b074-dd63821498a2", "sighting--a186b8a4-8377-4671-8179-53e157aaf90a", "sighting--c582e6b5-07fc-4659-9540-aedefc07bf74", "sighting--5f3e900d-db3a-41e7-beed-6416fd42604c", "sighting--ddc0be82-c265-4870-8886-36e92e1befdc", "sighting--3fff4866-a33c-4c01-b175-bc31d83eec8a", "sighting--997488b2-f315-4fce-bd07-d1564be91fa7", "sighting--8d0270ac-9b36-47c2-8b3a-744956af034a", "sighting--29b81a75-c2b5-4382-bb3c-755f9afd9639", "sighting--c82eeff0-049f-4b21-896b-e35987f00ba1", "sighting--9f79050b-b041-431f-b5ee-2378e1066641", "sighting--6d6d88b0-69de-4aee-b21a-1e1b635479f9", "sighting--fc6d4b18-ace1-4734-859d-6b5d94d8da2c", "sighting--851f2978-610a-416d-9c25-6d75b5df40f3", "sighting--ce4544d2-8e98-4cdd-9bb6-1ef37b322073", "sighting--3329cd86-4c13-4dfc-9b90-cb8601370504", "sighting--54125708-08d5-48c5-9cb8-11a79cd52e92", "sighting--9f70c53e-940b-47c2-94e8-09e4f386de71", "sighting--92403b4b-f2f9-4a20-8735-8e27ebae7ddf", "sighting--60589361-c2fd-4442-a513-8fd3ac0fd01e", "sighting--a52fd6ba-f24a-40de-a5d4-32ca1627e535", "sighting--9fb320cb-1055-459d-83f5-3af02090566b", "sighting--330d81c1-d835-46ae-a406-0199ad77b28e", "sighting--9f326e25-f331-4380-9a47-b58b189ae939", "sighting--e41b602c-eacc-46a6-ba5c-cfe73bed2f9c", "sighting--db5eca7b-85bb-4236-8f55-ba6ca19d2d1c", "sighting--e1b352c3-c552-4006-bd4b-617469e0408b", "sighting--10c3deb0-df03-4ab2-908f-2b8fc34fb57d", "sighting--bd81356c-d22e-4f14-a084-61362f5e870d", "sighting--6fc3b2f8-a013-428a-9ee9-c6e56ec25170", "sighting--0c06ba61-49ae-4b03-a92a-70496f56148c", "sighting--88e574bd-69fd-4486-86ab-375c6380119d", "sighting--bc3a70db-3cf6-42ba-93ec-5514109ef626", "sighting--b32a77e4-ba8e-4544-b4fb-1e7acef13b34", "sighting--00f98dd1-499c-4e8c-8f62-19fe07503ec8", "sighting--f0b25f5e-a2d9-4f70-8122-ddb147dc040f", "sighting--d6394fd1-7df4-4b4f-a667-236c2e8b7d84", "sighting--b4d78413-8ca1-428f-8939-4834bbbd341c", "sighting--3e5649b7-457d-4217-972b-4e243669f695", "sighting--96555e51-1940-48c2-a621-ed00f452da85", "sighting--63d05fa9-f22a-40ed-8ba2-2b1b39933e46", "sighting--0ea0217b-e35c-4f95-a522-bb9d7b42f822", "sighting--61ee789a-7be5-4c85-8036-05c6e4663799", "sighting--ff254591-3a7a-4bdf-a2ee-3145448cc541", "sighting--b044ec73-b6df-404e-bca6-cabf24234738", "sighting--a2c767de-a30c-431f-a33c-6ec0e1c8bfca", "sighting--540e16dd-9195-4fed-8b25-828cc07b9b0e", "sighting--d2689fe2-6a0b-4fb8-b9e2-da35f8513e54", "sighting--d3a98606-22bf-42ca-ac4d-9aafcff65919", "sighting--6e21dcce-ed37-45c0-ae9b-bf1bf677c958", "sighting--9dfd91d4-3fac-461e-b386-c40e1c77b32b", "sighting--941c2dcf-7e64-4c7b-b7ef-503282b3d4a6", "sighting--05ec17d2-fb08-4181-a327-ed49da06dd06", "sighting--0fe76160-d489-478b-a75d-3d360cb8ee28", "sighting--a965ce3b-b8e6-45a2-95ed-5d1e900bcad9", "sighting--2cbec3b5-1e9d-4da5-b1f5-3dc2fe4c78a2", "sighting--ae19908c-2c23-427e-8a82-faebe0285e45", "sighting--d1c10e95-5177-4bda-85f6-fd6e2bcf6619", "sighting--bc4e4dcf-28f7-4b9e-ab7e-36723dd5731f", "sighting--8423db0e-c596-4f7d-b07e-eff05f8eaa9a", "sighting--321c10ec-794f-49fa-be9d-3f2dfedf6f92", "sighting--b3b2065e-b97c-4d89-9492-3ec87ca63e4d", "sighting--37a1e890-8358-467d-ab5c-a91630b91ae0", "sighting--a5cca64c-4acd-44eb-b552-5e0a83326402", "sighting--b64cc8c9-9e7c-4fb3-bf85-5fc96f1dfbdb", "sighting--a8afdd86-78fe-4ad4-874f-0bacb57a1eec", "sighting--0b87ae59-5767-4258-a5ee-4d56f1004eb8", "sighting--d22c9e71-b938-4b14-8911-7b9e718ddedb", "sighting--c91be23e-8a16-4234-9dfa-f1fda3b50dea", "sighting--aad976d1-e2a2-4302-b209-3f1d7130c5fa", "sighting--4c0a9d12-e1db-40a5-ae4b-88b80e4e4253", "sighting--3391c120-d0f1-42f8-a964-4c239d9b5cb0", "sighting--4e2f9a79-a561-4b88-9f2b-6da1d17f25c0", "sighting--4b4eb313-02b4-4325-bd62-8a499335e78f", "sighting--292fe730-84fb-4a50-9190-20bf3449b909", "sighting--52cd5a28-cbcd-4a13-89c6-e88be3615c1d", "sighting--121dcb67-6bfa-4eda-9c76-a9cc1f8c0c90", "sighting--a3d54110-0c60-4a63-a6fb-27634a97c01a", "sighting--5c8b802c-960c-42cb-a95a-aceb474fdeb0", "sighting--d38b9d1a-1f3b-4d14-8657-af535dae5040", "sighting--6ec48bb0-fbaa-4009-9f00-f74b1bc4cc54", "sighting--34d03219-50a4-4af6-92bc-e4ca02f68be0", "sighting--4a0e6855-096f-406c-a2c4-09e647748b82", "sighting--f1a781eb-3059-46af-91cf-411f3752ce3b", "sighting--d2ce645d-4aa2-4e77-9dcb-6ad2f4a30978", "sighting--8d16271e-1799-406b-878b-54518fcec0d9", "sighting--f6d4b406-938a-4416-812b-b783239a3499", "sighting--462d68fe-b5f2-4872-b0c5-715d2a3fbd5d", "sighting--ad027f84-a3e7-406f-ae72-c4684b3eac0a", "sighting--fb60248b-2b35-4146-ac15-bf29e1185d78", "sighting--8e2251f6-8f55-4c61-97b8-f5ee85c390ec", "sighting--80cce5fb-72c5-42a6-a622-d815d6662dc5", "sighting--8332ba3d-9096-46bd-bdba-0154ef4c5c87", "sighting--f2a23227-13c1-47a9-95fb-e409a31072da", "sighting--7c4424c8-d55f-4666-afa8-530061fa949c", "sighting--1cb1693c-e217-48a6-af86-f724a130acf3", "sighting--6804edec-8b29-42b8-9f73-76cc8f0970f9", "sighting--ddb10eee-d458-493c-ab0a-9a742f5751d1", "sighting--63a7f341-ebb2-41c4-86a2-10fb52698384", "sighting--63cfd057-88f0-4f77-b06d-d3a5f5e9e923", "sighting--d9f6a6ca-11d7-4495-bbab-1e41ba4eb509", "sighting--e901e661-99c5-4319-ac2e-b760ac8b2f88", "sighting--1326f7ce-e5f8-4980-8b48-bcfa2eec6afe", "sighting--1b2faeb6-f590-41c5-981a-ff6f7ef41e63", "sighting--17ed91c0-2c7b-4378-9fb6-a31bd9ee3c9a", "sighting--92cb4e8c-471f-4744-963a-fb2c5bb54b2d", "sighting--ae80901b-d2de-4929-b96d-691461df64dc", "sighting--106c3e4e-3d05-40ed-8838-ee7901ad4f5d", "sighting--c8074a23-6e9c-453b-ae15-15491cc56fff", "sighting--d56eae52-a712-4cd7-8269-6b95e53654bc", "sighting--21233add-8128-481b-aa7d-9a3676229db4", "sighting--fe58aa6f-f73e-4819-84d5-96dcf5ca0afd", "sighting--8f09a39e-4929-4e64-ba8a-c04fabdabec2", "sighting--77967050-2886-45af-978d-0f80d9d2d2fb", "sighting--ffe34515-4b7f-4455-916c-e78f7da968ee", "sighting--00c9a0d1-140a-4b4d-a99a-e31338505d65", "sighting--53238201-aaa2-44d3-8bf4-52f564c8fff5", "sighting--9afd948d-02a6-4bb5-b5f2-2f45b500d465", "sighting--a6185291-72c3-40ac-a963-ce640c486f56", "sighting--079b3440-b3e1-48ce-b636-587da38e9d27", "sighting--b9d0afc5-1f72-48ff-8d3c-7aae3a21c2dd", "sighting--049c70c1-6b1f-4506-b128-b1a1ceb5c749", "sighting--335badea-c506-4496-9cb7-a9513b08d107", "sighting--a3add9ca-a953-4893-8adb-05ef2b7656e2", "sighting--94baa32a-709c-48f4-807b-708ed92eebd4", "sighting--fcfdc85f-df5b-4b34-b4bd-599345271a19", "sighting--668e6e4f-bd07-4b44-a8e1-85ba7faed124", "sighting--ee78240d-13c9-49e2-9a9c-2ba77cfe8fad", "sighting--f9649481-282a-49e9-92dd-b8b61fe41171", "sighting--781af97b-28d1-4de9-8a8c-3d8118f067e1", "sighting--4a834fb6-085c-4538-987e-d8e8690d6795", "sighting--73feddc9-208e-4f66-b20c-e543c604c189", "sighting--a345bf2a-ae2e-4308-858c-35f540c0c2e1", "sighting--95780774-88ca-4256-ae3b-8e00717d8675", "sighting--f0314997-32c5-4dd6-9437-ab101752f5de", "sighting--0a1db0c6-8951-4a3d-822e-d4117bc10eff", "sighting--6e10bcfc-8342-4849-a0df-77fc61ff223a", "sighting--ca78e531-3ffb-4b20-a8eb-6139b9de4f94", "sighting--6d338c13-d8e8-4dc4-a434-69965a94ddd5", "sighting--c16b15f9-2dd0-4b6a-81ab-bb75374bd9b9", "sighting--1fccb135-2656-412b-8acb-8f714c7c67b8", "sighting--7c6f30ad-617d-4ad9-810b-6bae1baa70b0", "sighting--c18c795d-a876-48e1-b9e3-cff14d095c6f", "sighting--ef4b1249-00ae-4e84-ade9-ed637df66297", "sighting--9142da87-4c89-465d-a93f-3768dcc5f583", "sighting--ff6b5ef3-671c-46eb-80d0-58e8bbe04b39", "sighting--22471557-6266-45c0-8fcd-1d0b7a2a711b", "sighting--f1850639-2347-43f7-aa5f-b7d0e145f8e5", "sighting--9ec0f42b-f542-4036-b265-a608e76459f1", "sighting--85884f03-d5fd-4412-a5e0-6cdc39390814", "sighting--dfc47082-d98e-4669-8d17-2f06f1c87e0a", "sighting--edec77fc-2c72-4387-8374-534a440e76fc", "sighting--932fd5d8-5460-4258-b059-8a27c175e74a", "sighting--d2b597f1-4920-4f0a-91a0-0dc62b8858b8", "sighting--28aee074-63db-4b90-8366-701904b9a78d", "sighting--51e4547e-f2d1-4bf1-84af-2bb196178d5e", "sighting--d16c3bcd-8991-4337-891f-ca638c014ed9", "sighting--3b1ffe1d-0591-4562-a09f-66cd48645377", "sighting--0cae5514-8d4c-4e4d-b6de-a0b3ef2d321c", "sighting--800dd780-dfeb-4778-84c0-8e667d5fd07c", "sighting--5aebf467-3c99-4839-87d5-df35759e82ac", "sighting--02d52aa2-0473-4344-b9a2-fe3ecb28c0f9", "sighting--0d8b7d89-ae88-473d-8895-d2e739a82f4a", "sighting--b9c5a94d-21d0-40d3-a2e0-db7e5edb6815", "sighting--3f4dab57-d590-446c-a458-76e2ec877a71", "sighting--748954ae-6366-440a-9f21-d847f876f69d", "sighting--d0d4707d-71d7-4b9c-a800-c2f3923d9e7d", "sighting--31690209-3b6a-4378-a696-1dbf159022f7", "sighting--4009c9e7-8592-493b-a5da-29098f224067", "sighting--bce7fae6-8e11-4a21-b6c8-07c34d48f939", "sighting--c5ef998e-3a16-45ce-bb25-1dede200a710", "sighting--5561f575-573d-43cc-8c7c-908b4cfc48e4", "sighting--47f6a8b2-37c4-49a7-a84c-cf53b6beae20", "sighting--94d82ad0-aa16-48a4-bd77-434b67aa711d", "sighting--6b383610-0db3-4112-8ee7-a60dc523c200", "sighting--35c6db92-bd28-4d36-b000-7b8e0c84a603", "sighting--41237cb7-e1f4-4fd4-8f42-b3a8a0e68002", "sighting--605f1d71-68e9-4b29-a64d-db0c385d3620", "sighting--89cf89b6-a647-4298-b394-d1cb69f7bc72", "sighting--33a8cdf2-0f65-4527-9abb-b037b1c6634e", "sighting--0e683f62-33aa-4900-9292-15ce12b7bec5", "sighting--ca9c2961-267f-4d31-a62b-cda997f55d21", "sighting--18fcd4bf-8799-470e-839a-640d3d9ab38c", "sighting--e9c2331c-3367-4efe-b686-5d903256bf2d", "sighting--373b44ed-d4dd-4dbc-a783-fda355cfa671", "sighting--ead806ae-0e22-4f16-ba2a-0a6c0d34bd94", "sighting--bad03e11-a825-43fa-94a8-d911d5194ced", "sighting--af03db5b-e4b9-48b2-a98a-89cd0dc8557a", "sighting--fd9c30b9-74d1-4914-9ffb-9b0d9e4e9d38", "sighting--578ec4ab-3e4a-4aac-9e03-043d106c96a1", "sighting--edde4c43-0ba1-4541-a674-3027ce0b65a0", "sighting--f146749a-bdad-4133-b2e2-9c658753f95c", "sighting--54836533-8faf-4fb5-b662-4ee821189e70", "sighting--7a920080-3915-42c7-8bb8-70a9fd9b9a52", "sighting--9ec42441-d4da-4cf5-b134-f77b53359b5d", "sighting--62e31dfb-f1bb-4b20-82ba-7bfc62b9b0fe", "sighting--73a00d3b-c359-4e7e-8ee4-00b17336d188", "sighting--f5ad7b4e-85dd-4782-9078-945ecce0c45a", "sighting--32e0f31e-e0ff-49a4-97fa-d31d53921270", "sighting--e3f94a3b-f622-47f4-a052-fde953ad1efc", "sighting--7ad2d70a-440f-47c4-9a96-be64e8196cf6", "sighting--7cae1166-a6cd-4a5c-ba5f-90bd07f153f6", "sighting--e29a38e1-a059-45d4-98e0-bfb223ffa3db", "sighting--457648ac-bec1-4f4d-be2d-b5fca72b9cf0", "sighting--e328ad42-6480-4d2e-9578-e79b3589bd74", "sighting--c86aaef4-6100-4f9a-bae2-7f64cc8f4e57", "sighting--08966623-79d4-4b5e-9dd0-5b894cad0379", "sighting--8d6725fc-9736-4a9c-ac82-9f542604fad8", "sighting--df664f2c-73df-4280-95fe-acdeaa939d7a", "sighting--f2a7895c-b9a0-4d10-a888-ff4589a0f01b", "sighting--1a9c0d5d-ac3e-4aac-bd1f-95f0edaf2c01", "sighting--ad5923ca-af7f-44d2-99f7-73751c7563f2", "sighting--6c920bd8-dcb2-47ed-83c2-c33bec549542", "sighting--396eb068-6fba-42bb-bc7c-a5dddfb12072", "sighting--b084edd7-fef3-4410-a85c-ac11ebc02b00", "sighting--c711b5ee-5e0f-4864-89a7-7634c3af8ca7", "sighting--aa467be9-9e82-4ccc-8a14-c96488043391", "sighting--96f1d542-23c9-48f0-8d65-7e09220d6855", "sighting--4f4fa584-6a85-4dd6-8d7c-70e752ca1b3d", "sighting--f726b905-8b1f-4a1b-a84a-aedaddcea9cc", "sighting--4b74e892-240f-462f-b015-4c0cb8eedbae", "sighting--70e8a7a9-f7f9-408c-875e-c1b1c5099453", "sighting--34fc52f5-2fd7-4f78-abe0-15f44d3ad3a1", "sighting--910db324-38b8-4f28-b953-5f0f12843129", "sighting--16a9c84a-9326-483f-b990-fbed0fd8239d", "sighting--14c7db59-04a4-4ce6-836b-b736bba5cd58", "sighting--0e87655e-6714-4185-af12-1609cfa30988", "sighting--c1b4b848-a356-4e84-8e21-672bb0a84545", "sighting--3514a9e4-aa85-4fc4-adf6-5c128b66c2aa", "sighting--8a5851b6-38e6-48ee-9dce-ad88d114ec8e", "sighting--b77bd49c-a65f-49ff-947e-e13438b07938", "sighting--a52eada9-ba43-46c3-9c32-47262d449477", "sighting--b723236f-8a81-4a7c-bba7-d9a5a585305a", "sighting--2f513577-036b-4b8d-b0d0-d70a85dcde37", "sighting--3bbd263e-62f1-4604-a5ab-aabeea45a5f5", "sighting--6020e934-572c-4528-b8eb-b6ef83aea9fb", "sighting--36a20db2-d76c-4400-9fdb-d69aa9a9cb64", "sighting--1643349e-0de3-4aeb-a551-106eb0b401ab", "sighting--846b3427-2590-42b4-b1dd-d689c530a444", "sighting--5b9eeaab-05ef-4934-b326-4f9bd5c60ec5", "sighting--330f3406-f335-4d63-9eda-37d3eb6996e4", "sighting--9cfbbe81-c936-444c-b6ca-4dd5b8b9cacd", "sighting--201051cb-efff-4995-b34f-0ce431a86e7a", "sighting--c4264e47-deaa-4205-863f-f29a1784f35a", "sighting--80ac4350-7859-4801-bed6-fd44c0ac08e1", "sighting--9e884572-0c26-42b0-88d5-628441cb5bcc", "sighting--0385db7b-9da1-4c49-a93a-8c79c31bbeb7", "sighting--deed9f87-c23b-4888-a9f5-5afe5ff2c95e", "sighting--a5bf1c32-292f-4d3e-b098-26768b961ab2", "sighting--33c1ebed-bcb2-4a16-8f1e-f24f612fb0b5", "sighting--6f6cebc5-4ab5-4b73-b976-393beec8816e", "sighting--8d75f601-ea16-4d9d-af8d-6a4cadc27436", "sighting--d3230207-f7ca-44d7-bcec-eeef6d385640", "sighting--17935060-c132-4fc0-a80f-11710126a759", "sighting--65ac2c0a-3c4f-447e-9eef-1a51410054fd", "sighting--f2d863e6-d337-4d22-b15b-f2729de8112c", "sighting--ce167d86-2f1c-4c21-abac-9e2f8a4d0c31", "sighting--0b838e8e-f808-4b46-9473-ad149fa8d744", "sighting--728b92d6-3ae4-4b0d-8b53-581719c8f525", "sighting--409cd334-9800-443c-884b-701a48eeb3c5", "sighting--a998392a-144a-4b82-9ac0-e3d843564414", "sighting--f6e11927-84d8-490f-9765-fdf3189819c7", "sighting--5f953939-2b57-4af8-8cfe-849759db5c1f", "sighting--1b837ea1-0a61-4e19-90ea-1d7cc3cf2ad1", "sighting--9bef0d23-5363-45fa-ba08-8e0f900c8501", "sighting--befc73ee-68e3-4239-ba49-32716c3d7a67", "sighting--a201d606-5bf5-409a-a8d4-b394a4ab6a84", "sighting--72f720a2-532f-4dd1-a25c-ac87b709e906", "sighting--d439f209-b419-4c2b-88a6-63dce6417004", "sighting--3d17e03c-0a1a-471f-b4f4-8ee2c304280c", "sighting--c26b83cb-61e5-497f-bbaa-683d6a66ef42", "sighting--4f891c23-2e5a-4d19-8da0-da5699dd87f8", "sighting--b6eb99ed-2ae2-4790-ae5d-d42e78177ad0", "sighting--26b0e79a-3e2a-4069-a9c7-9365ba6a26ce", "sighting--ab9ff131-d95f-486b-99f2-aff73a13275a", "sighting--853ef293-2008-4a66-bb94-f288744be25e", "sighting--062da2a8-6973-4d83-a206-db12027ac618", "sighting--43ec977d-2c62-452a-8901-35a55a768ca7", "sighting--d051f8ab-15dc-4ba9-b8e8-a35919937cdf", "sighting--edd21ee6-f795-430a-b789-6a50c656d8a4", "sighting--de8fac48-1bab-4ade-a9e7-becc0067a17a", "sighting--fd3f99c4-9354-4b76-a5f3-c795b60fc724", "sighting--6a7c2794-ac2b-4ea8-879f-13aab88bc8fa", "sighting--ea7376e6-ab58-4f83-aff0-04452e0200e8", "sighting--f4dddfe4-fd2d-484f-9dde-64f45a5d5250", "sighting--7910f1f5-0b4d-4126-a2e5-4593653395bd", "sighting--480db404-c0ed-4bb6-975a-8a01d584d106", "sighting--7a79be93-d749-4d65-9fce-5f151f73143e", "sighting--9c3a1e41-5e12-4aed-b508-e574a569ead1", "sighting--68fc062d-1642-4802-8b4c-9732eec682a0", "sighting--e74551b4-9550-424e-be47-0628788747b0", "sighting--885b1202-6255-4965-a753-ee3b06b2afb2", "sighting--1b6e8aa1-3a1c-481a-b6c3-0d6f1bf79140", "sighting--8303253b-4ace-4fd8-9b23-d750b7aa2ecc", "sighting--61949fd0-1fa2-4528-a236-39bc6e7b2e39", "sighting--c0e49923-3f58-4742-815d-b2be2a490016", "sighting--8cddaf86-45df-42f6-8419-05cedf4daaae", "sighting--ff65929d-33bc-4ba1-b4e8-de6322d813f0", "sighting--259942c1-b806-4435-8a97-73ae0022322a", "sighting--b54604be-4838-47f9-8168-8c584e73f06b", "sighting--deabe480-819f-4de5-947d-3830dd14d30a", "sighting--1715d8e8-73ed-449f-bcf9-f57a751e3b86", "sighting--88d6c43e-84c8-420b-992f-241186ec3ee6", "sighting--47209f76-e675-46d6-b7f6-93db531c5eed", "sighting--1bc15d50-5160-412c-9b50-19427b13c668", "sighting--cfa383bc-f0b7-4636-aad8-7a3d7d1e1b88", "sighting--b5c7a67d-67f9-418f-9f9c-8d247a06f68f", "sighting--b2674e83-c686-4f66-910f-cd2b3717ec06", "sighting--3ff8a21b-cae5-4dea-86da-781545768785", "sighting--b7dfeeae-deb0-4f91-ba88-9e65d687a74e", "sighting--5397d9be-8f61-4544-95fb-9b90a2a910f3", "sighting--7436f7d9-398e-4325-a4de-1ecbd186ca9e", "sighting--388e09e7-4ab4-4f06-ba15-b7e51d15e486", "sighting--8559ad3d-60a7-4837-a0d7-8e6cabea20ac", "sighting--08763992-ddb2-4656-8552-163ced5b5274", "sighting--d69e0fce-e2d0-4de2-baf4-18226edf54dc", "sighting--b6bd0dfb-af28-4168-bf46-f9f1e00f68a6", "sighting--809d8b8a-c884-4a13-bad9-ea05989f34a9", "sighting--d0fd8548-3548-4e88-acba-e1e80590919b", "sighting--84a58b50-74d9-4588-8f56-91a827268521", "sighting--4187ae0d-e0c5-4a0c-96d3-bd4f2deb1edf", "sighting--d47c0a40-0cca-4a38-ab93-aca4460b56b1", "sighting--f5650771-198b-473e-9055-1f9da5f4196d", "sighting--32dbc150-e05f-4775-b43f-1e319dfbc62b", "sighting--0a7c81d9-ca12-4df4-95d8-ba2947cd1dd0", "sighting--fc347972-fab7-40b6-a6e9-efa4a9bef8ba", "sighting--efd1f483-5f26-404b-8f36-bbb91d39be84", "sighting--13373e12-0be1-4126-b1e4-da56953dfa65", "sighting--ab0af4cb-9394-4ad0-b223-be6305495969", "sighting--48a7d29a-2c95-4e1a-93b0-5eea38591e3d", "sighting--e82593f1-881e-43a9-9513-56cfe85ec15f", "sighting--fc606da2-4d63-45ce-8a08-b784fc4812b4", "sighting--add5510d-7c6a-4010-9d2c-cadf9f8aa7f0", "sighting--246895c1-1ba0-4b71-9988-d8dc3153ab35", "sighting--5b226116-2067-471d-be89-3ffd3b72ecbc", "sighting--f6a8100b-c1cf-4e90-ac4c-d9b664206eb4", "sighting--7a9a1e6f-eb73-466e-a7f2-7e592178f6e1", "sighting--d49cc743-2d45-401d-8b60-836ab5325459", "sighting--787c347a-88c5-458e-ba98-c75c667c5581", "sighting--beda4b36-4232-4e6f-b464-0e6c259664ba", "sighting--6d41c662-9304-48f8-8822-ccd24984c5d6", "sighting--f342bc8a-beac-429f-a15a-54867056a2f6", "sighting--913fb693-25c0-4a63-8008-dc361c82b19e", "sighting--df4a1de2-58c3-4ed8-83f5-36d4adb412bb", "sighting--118795b2-2551-4dc0-b4fd-35d8c4aab1a9", "sighting--734fb376-b064-49d0-982a-a03687e72c1e", "sighting--a762a0d1-279c-4571-84cb-2257bc610e2d", "sighting--7b2bd433-8f55-49d7-a503-e80c49c4aaf2", "sighting--df511a39-6043-462d-95b0-b2beaaea0da3", "sighting--7598b5eb-7f4f-41d4-9b1e-69a5bc0eda4e", "sighting--6e8a6abf-a23c-406e-a9a5-6f7978b6f5d5", "sighting--d487f2cc-c952-4898-bb8e-56d675b5c39e", "sighting--0caf3828-2aa9-4fce-a357-745c0dfa94f4", "sighting--d9bdf573-2ef8-4363-92cc-c30f2a3e9651", "sighting--2d62d002-51a0-40ca-b08b-780e15acd8a2", "sighting--56fb299a-dfa7-44fc-a2fb-9e05b44109aa", "sighting--b60fdc9c-452a-495c-b092-63555ae195c8", "sighting--cfdcc551-1b71-408c-811d-e6311c783ed9", "sighting--a1a5c987-85ed-40fa-9785-28e6889ae228", "sighting--8dbdf101-cc22-429c-a7b3-cde4c09b75d8", "sighting--073df73e-45eb-454d-87f2-bf6395fa2ffd", "sighting--c4324fca-7feb-43c6-ad5e-846958817625", "sighting--98aa2f6f-d367-4a1c-9698-0199cb73cbf1", "sighting--91ad3c10-3a30-407f-8bdb-70745e3e0b2d", "sighting--f7cabfbc-bfee-4570-b8bb-04759fb9635c", "sighting--126cf6b1-6154-423b-9394-0383e3429ab9", "sighting--ea8d0d62-e314-4ed8-ba41-af5bb1286e4c", "sighting--7ce78050-7bcd-488a-aa4e-6430ecd8a034", "sighting--d7a35735-1fdb-4d8e-966e-31154a2df924", "sighting--879a8609-4a69-452c-b146-2d99dd9f05da", "sighting--de4a7e5c-0a47-4b57-8457-1e60434010af", "sighting--4b1feedd-11a4-4083-bbc9-a0a04bf000c6", "sighting--a34e2447-6371-4adc-ac3c-619b3d2eb292", "sighting--c2d0f5b1-838f-4e98-8cec-566c62ea4ef0", "sighting--992db62d-e163-43cf-831d-83e8a1dd6ddf", "sighting--1d225fcd-7ecc-483b-94c3-a7b6ea02ea49", "sighting--0a101885-4e84-45df-ac3b-abfdeb565c0e", "sighting--834f0588-1174-4764-a102-660ada743e21", "sighting--ceaffe3e-2078-439f-a2c8-1d671f871349", "sighting--1a2e6322-06bc-4103-91e2-d7cd42c63631", "sighting--09ce1de0-93e2-4345-b288-682022318f14", "sighting--cdc6e548-6183-4a98-8fd9-a5ce03b05092", "sighting--3ee55fa2-974d-4521-b0be-9feed5f3a214", "sighting--e1adf1dd-f90d-496c-a737-da3dcfe3558a", "sighting--fccaf5e4-8680-461b-8ae1-55ee272cd5d1", "sighting--19285bd2-d07f-4824-bc09-a3da25b637b4", "sighting--c9daf6ba-a10d-4751-b54c-fc0bed789360", "sighting--27a8f9d4-a637-4692-98d7-7460208e3097", "sighting--f93dce07-27be-41fb-b2dc-489d08f84e70", "sighting--395f250f-c0c6-400c-a2fa-1cb730208682", "sighting--5e2241d2-6c3c-4e83-8376-080c35900d60", "sighting--c7df760b-da39-4acd-8c13-3984612c57b0", "sighting--90d57ed3-b62d-4c08-a318-471bba176c76", "sighting--d889bc3d-4f89-4ec3-9ef8-da7b327a189b", "sighting--7eb3c1b6-1a15-4537-a3dd-b0ab863c52e1", "sighting--2be59195-55f4-4eff-82a9-472a8061132a", "sighting--21810c52-c5dd-4dcf-b5e2-3689f05e42e0", "sighting--f85597f8-5636-4187-a08f-57bd2e691117", "sighting--95045d30-ea2d-4654-b355-ca6d6d67b90f", "sighting--5a19388e-4c89-4ca3-a0b2-9a02d8390e29", "sighting--04a8f544-46ff-4c95-a661-1a78497a9788", "sighting--ce3d3347-63ff-4471-a725-609c1a2fb894", "sighting--2ddc7d84-0de8-4286-a0ca-b1c6c902e5a2", "sighting--4f90e1b2-0e38-49dd-82ce-e9f5fddc99db", "sighting--d5fc637a-bbbc-41b6-9116-15d758fb71ae", "sighting--41b4d295-76f1-41f8-9bef-4e146aec8d26", "sighting--74ac0ad6-fe35-4efc-b3fd-46ddf1d7d423", "sighting--b91fd7c6-f663-4921-bdf3-ed6ac7e69952", "sighting--e1b9d66a-58d7-40fe-b9aa-d582ec09a428", "sighting--272c3734-df79-458c-a30a-08fa54ef22d5", "sighting--86e3b175-19b4-4da2-95e5-49fc1dcd6c99", "sighting--ef143ccb-cd53-44d0-b1fe-c27ed4bd3f45", "sighting--b0a3c66c-d3b5-4bef-9d0c-7b47ab9ffe39", "sighting--697baac9-bc4c-4ad8-b258-6783ed557cf2", "sighting--a2c7a047-1212-484b-a038-7bb53c6e2fac", "sighting--c870301e-2995-446f-8294-9f766497e456", "sighting--9f26d703-903b-44a4-9554-c5e8623ec054", "sighting--6e9b0719-e01e-4740-8ebc-7d556621b6ec", "sighting--ef0f7d60-bbc8-44de-aa00-29f67e003927", "sighting--cc0a1631-f254-49fe-9cdc-24145a2b3435", "sighting--25708bc7-7a50-411e-af1a-a901a368922d", "sighting--666f2d1f-99b0-4005-a413-bcd363cee8b6", "sighting--46aac987-a4c5-4e41-9a3c-6cc2b375b4ae", "sighting--81c446b1-bb24-4d65-92e8-1b498c145945", "sighting--061e87d2-73ff-4d26-b977-a3284a7c0b5d", "sighting--6d714e34-db10-4bb2-b80c-73b5192865a9", "sighting--339d941a-15a2-4152-94d4-5547a0f2f572", "sighting--70eeb05f-06de-41b2-a9ee-71ffcc170e33", "sighting--48948e15-a6d8-4f2d-896a-a70d9ae663d9", "sighting--10e9f0de-aac0-4fef-8859-7feb5e67b392", "sighting--a2486175-d59e-4032-9d5c-aedb2d062704", "sighting--1cfe3345-c1ce-4f6f-ab78-50568619d08d", "sighting--24773e0a-14e5-4e4e-b02c-fdc32b792171", "sighting--c69d2052-e8dd-43fb-b97f-29822cd47c3b", "sighting--cb624082-f34f-4557-839d-9f670b5da6f8", "sighting--313448d0-1066-4d98-8f7c-9540715ce0dc", "sighting--f28243af-3b49-44be-a757-51fac166ad91", "sighting--348e925b-7803-4b15-8357-2cff82984210", "sighting--0a13a17b-0969-4e8b-b9ff-4471814a134e", "sighting--875996f5-7ac1-40b3-abf6-4b523d40b964", "sighting--e2bc5ada-df0a-4338-b0a7-108c4f1da399", "sighting--5039d5e2-f5e7-4b9d-bed7-6b1a2c6ff67e", "sighting--18d8af0f-42ab-4b7b-a76c-70861672153e", "sighting--a3a4a2d3-bc57-48cf-93d3-95e621672751", "sighting--744636ed-480c-4cb3-8e14-763b266ffb6e", "sighting--682f54c2-88f3-4a75-9a1c-8a784e789a93", "sighting--87f2e5e0-24e3-47d1-8fae-012649ea11dc", "sighting--72142d1b-49f1-4cf5-aa90-052556de6a2d", "sighting--0fe09d43-767c-4c5d-ae4c-aaec714c77e2", "sighting--9ddd059b-ad1c-4330-8214-8655dc8e0731", "sighting--55de09af-d5b0-495b-b99e-9fa8bdd1c965", "sighting--7dfa290d-3cf6-47ef-af86-bcaeac85337d", "sighting--0906be06-1e2f-4cb1-ba5f-51480aef5da1", "sighting--c26e947c-86d7-4b92-831e-b284e3a24df6", "sighting--3c2b316d-f9a7-4c22-935d-8b6feacafd4c", "sighting--f5130e6c-cec1-498a-a786-e886f9ff5814", "sighting--fb92398a-80d2-43b1-8413-a48257bca5a5", "sighting--402691c4-213b-4ede-ba9e-a505202acee7", "sighting--84ffc831-5294-4b71-a525-7195ea845a23", "sighting--d2e7580a-4342-4fc6-a1a8-ab893c4695bf", "sighting--3ec6a1f9-fd64-49b0-b216-6e435f844a0d", "sighting--41b41d7d-ad77-47a4-8578-befacb5f500b", "sighting--f5dcf514-6b07-4205-8d57-05c1b957ac81", "sighting--745a8e4b-57df-46a9-a513-99f4410625a6", "sighting--9c8f0819-b430-4665-9aba-e565f5339c09", "sighting--2a1c6ae2-84c5-41df-a33e-ed9a5663ee73", "sighting--24074144-131b-4548-ac32-1a3f0ed2857d", "sighting--e75689af-e9c5-4b22-9cb1-6f4ef9eef461", "sighting--c1c689dc-3892-4052-bcd1-daf21a16f303", "sighting--452d4258-cd08-49c5-acf2-7dd9c02ddac8", "sighting--1bc818d9-eec1-4b7e-9e53-4dd3de8eaf02", "sighting--5e5a6dc3-0b30-4483-a36e-07de53addd1e", "sighting--15aec9a0-1870-4f73-9f00-31a446145aac", "sighting--95b19064-ad1f-42d0-bdd5-8d3c87e21290", "sighting--d01f7c5a-5e5f-4fb5-897a-10ff9846d92b", "sighting--9ffd8146-614d-4770-80f2-fc633462074a", "sighting--5779a121-3153-477d-a0b5-6c8ba05d59ba", "sighting--8c69cc1f-ce07-4d53-a694-c47265ed9a06", "sighting--4b60210a-05d2-4594-8a56-2d6accaddf0f", "sighting--b7c67f52-dd5a-4b5a-bf04-de7a87765012", "sighting--9a7e59e9-ab5a-419a-abc0-6b922592784d", "sighting--a0d3869b-a180-473a-9e68-7ab85881c0f8", "sighting--becc3610-3db6-49d8-979a-cfb4045910b2", "sighting--f14a15e0-56e5-4d79-9ce1-56bba427e211", "sighting--aadfd4ea-4cbc-4987-a4a0-6423eadf18dc", "sighting--daa570f9-fe36-410f-b035-c27d870f0ee5", "sighting--c1800fb7-bcdf-425e-bb82-5da242b2df2a", "sighting--3d8611a7-1a40-4622-98f3-9a9eedb9c912", "sighting--d22b7279-7919-4a84-9b5f-c58e42c0a729", "sighting--6bbd3a54-2081-4b05-a76e-0c18da963622", "sighting--7a4b038e-3961-4a27-8eef-beb6c1683ced", "sighting--7079e44d-641b-49c8-884a-c709eea2f09a", "sighting--6b5a2fbf-8966-4eca-bb47-2b011614ffa0", "sighting--ebb45f01-02bb-4a03-863e-33c41a1601a6", "sighting--254893c7-2b04-41ca-9f07-60380e8399c2", "sighting--1ac6539d-a3a4-4f54-be10-6f0f387824c9", "sighting--fb3794ed-09ff-46b0-a3f5-d91be73a9f01", "sighting--783e1a57-234f-414c-a7dd-34b132c1acc8", "sighting--7f57d5ea-a8a0-42b6-915d-55ea2517a132", "sighting--f1f4c609-1fb4-4566-a3bb-7517c8ab3f0f", "sighting--fe89e96a-8c84-4c1e-b681-6d6da4ac9ebb", "sighting--3269ca38-f5e8-4274-9cac-c02883b29698", "sighting--5bbec063-01cb-4fd0-b3aa-729da2eda1e7", "sighting--d5de9176-60af-4f48-8add-5d7ddb513269", "sighting--1a79e7ca-aa94-497c-8a4e-2b0ea693738e", "sighting--0e36502a-dac6-4549-87ef-a0208aa4fa2e", "sighting--28382be5-4695-4cdb-985c-b6ddbe21a8a5", "sighting--243a3398-fe03-4ee3-b890-e79dd7bca61f", "sighting--c4ae2cdb-5fc2-41e1-b996-425b00b1e9ef", "sighting--989a63e0-e421-43fb-9011-127caf86dd41", "sighting--22497b2e-7f9d-48f6-bb10-94ee43ce95ff", "sighting--eb82dc32-c37a-4057-8442-974a6133f346", "sighting--ca0fc08a-c929-474d-abb6-d9a759f5e99e", "sighting--f8e7ad83-c775-4b76-a4e8-83a55bb36a7a", "sighting--2ff84959-d138-4f64-af06-285891b17919", "sighting--edbcad93-0c77-4ca4-8854-3183580da1ba", "sighting--25d857b3-c59b-42f1-a91f-b4da70b94d93", "sighting--af47f792-7aa9-41ab-80c2-1b5ed13f970c", "sighting--bcd2ed30-1e39-4251-b9fe-8ff7e4b22e7e", "sighting--db1e6227-d6a8-4f58-b856-e4d534bf6ea4", "sighting--4a8cda8f-b539-49c8-a41d-c1a2e94df156", "sighting--5c0d964b-4378-4b4f-98bc-67c4336739d3", "sighting--2f36d299-1803-483b-bfc1-76d513e925e3", "sighting--52c1e072-0376-48d6-89ab-fd8910b9aab6", "sighting--44e45d33-acb7-497c-94e6-24f6aa95c203", "sighting--27c3df3a-eae5-4c05-b88b-2e8b75c543e3", "sighting--13b28849-c9f9-4bf2-a0d9-7ff1c85308c4", "sighting--497874d6-ceee-4e80-a815-927fa911ea7a", "sighting--b328e272-7e90-48fd-954a-2849470fa1be", "sighting--0d0c541b-946d-457e-89d8-9562aca861db", "sighting--f393e6a3-f2f2-476a-8a07-fc466f161675", "sighting--1f5ce614-4089-4525-a8c6-717170c613f2", "sighting--c57eaed2-6db3-4f9f-abec-b60f8aac5f15", "sighting--0467381a-2fcd-4e11-a1bf-6ade13271c6a", "sighting--41efe66c-a8b8-4123-8c7d-dfb9bb20aa5a", "sighting--a51b7e7e-d0bc-44a3-811e-e87266b4c8cd", "sighting--d02a35fd-562c-466b-9b1b-00c77d92a0d8", "sighting--35577c18-3405-41e2-9025-78b294be33af", "sighting--7ab325b3-c3af-48d4-97cb-fd9968f3d3b1", "sighting--d0029827-9f28-4aeb-b2ee-4037eb45206a", "sighting--08e8961d-e106-4394-9cde-b992deedb6e0", "sighting--4a4fdd81-ba43-48f9-b367-991ce2241f2e", "sighting--a5dbd34b-44f7-4932-9245-c2e011287dd4", "sighting--05cb72df-7ef1-4aa9-9be3-ec8bd0843c56", "sighting--10a7e74e-3a36-4592-be29-d7742837ca09", "sighting--62dc068b-6848-45f6-bb09-1b4c20e01afc", "sighting--198fb0f6-18f0-4c10-b05f-772cbbb8fbe9", "sighting--05a13558-a793-446f-8b33-90446ace1fbd", "sighting--a8fc4964-298e-45ae-9691-4d229a5aeeb9", "sighting--799e1ab9-0a7a-44d0-aa78-0ef7fa763bb8", "sighting--1d4b3b4c-5e15-476e-84d6-4b86188806ca", "sighting--42178087-d2ce-42f8-9396-44598c8da582", "sighting--8d66251c-de16-4928-8c4a-b552bade8ff0", "sighting--bfb1de01-233b-40d2-895c-3b08f14ddd73", "sighting--c45a4421-a304-44ac-852c-00772ad93786", "sighting--b48761c6-5a78-4639-aa50-4137f55a3c3b", "sighting--c40c7de4-aa4d-4284-bfcf-83568316f0cb", "sighting--6c996fb3-a90a-4f96-af02-4e72c60b01a1", "sighting--f0c105a3-b0b8-42f6-ba4f-5390abc8cdb0", "sighting--c12500d8-f62d-4420-a8e5-9c21e3799187", "sighting--e5d19472-4454-4fc4-a6e4-05e5ba5643fd", "sighting--42125c7c-1e47-4dcf-bfd8-23430ccb0e02", "sighting--a02fb07f-5b1c-44d0-b925-6ec00d7db349", "sighting--be68d192-b2cd-4859-a1c2-5982b166d998", "sighting--b5974ad6-4d36-4b9e-9628-2d32e41ad21e", "sighting--adf8db21-af71-4e5e-9ef7-6aebae486f1b", "sighting--4369a9df-b838-49dd-81c1-d3c182c9e03a", "sighting--343ef568-43ec-4d32-853c-748246c541f9", "sighting--0436548c-0725-4a70-8daa-32f32e34d473", "sighting--c58eb511-526f-4957-9195-94cad88540ec", "sighting--e76b573b-2e42-4cae-bd93-3ac4d22a01c7", "sighting--32575767-3db7-495a-abad-609d8ce12fe7", "sighting--1543918d-7130-4bd4-a873-4317c1eca5bc", "sighting--9687abe1-5e3b-47c9-bde7-29a9e830ba03", "sighting--535cac5b-a632-4b7e-8bb4-6f71a7efcf2c", "sighting--51c47dc8-7fae-4f07-b580-bd38702baf1d", "sighting--d7ced35f-03c8-4369-ab43-82f617e03ae2", "sighting--3d439703-df0a-4636-bf95-ffb6eaad6be6", "sighting--b1827d67-8d5b-4dba-a174-7777d4047446", "sighting--c83a05c4-cfaf-4532-abf5-adf9b9117453", "sighting--5d0886f1-103f-4bb3-88f1-89f96f9fc4df", "sighting--511314ca-1e9e-4867-a217-ad9bd36af2e9", "sighting--7380ad5f-0a43-4174-a1ed-0132f3820bf3", "sighting--68b2819a-2dc3-4aa2-aaf3-8b54cbba219f", "sighting--250c9dbd-327a-4fdd-b30d-240d3bd33bb1", "sighting--5e967700-a3a8-476b-88c0-8abc80076837", "sighting--b782c473-5ead-4b3c-84b7-84c2066f1f00", "sighting--b3bcc130-88d4-48fd-aaf0-31656d37789f", "sighting--145eab6c-9b19-400a-aefa-2c0a83bfe1c8", "sighting--d97befc8-b25d-45d2-bb1e-7884a3661388", "sighting--947399db-fd37-46e9-9251-b25c537a25ca", "sighting--49c5b491-4540-46fa-8a84-f3286f290648", "sighting--0778fd56-4220-4af6-865e-585c7b2cacdf", "sighting--92b91cfa-b91f-484e-a901-c6ce0f25b6e2", "sighting--e4170099-6e47-4212-8c27-41ef0fa45b6e", "sighting--56175ee4-554d-4807-bc8b-36a4b6f3fa50", "sighting--04654987-72df-403a-ac1a-b7f4c3704ab3", "sighting--429ef23f-8410-4755-a98c-5ae8d888388f", "sighting--0dc77983-1854-40aa-8717-25ebb2299ad5", "sighting--a1b17ecf-ed47-4ee0-b83d-58a9b7b9521c", "sighting--0e62f090-7458-49ec-8fbb-b49089a09404", "sighting--d64c2c5d-fbeb-48a7-a886-baff1177e39a", "sighting--dd85e536-47e0-4b97-80da-2b1dfe60edea", "sighting--123bd3d5-b5bf-4d18-81b7-d1f33ac09b7c", "sighting--ed904e42-43ce-448c-9674-30b733325439", "sighting--f6f0c051-a932-4200-8745-98930b0deb26", "sighting--2efde2c4-3ad5-4915-a217-891f81948596", "sighting--9c772910-e1ce-44da-bf31-bbc1632cb2a6", "sighting--5d40a9dd-bf8b-4448-a7ea-8c2e6e9cc6e5", "sighting--7ffe5a73-219c-4987-a3f3-98c1e17f4dbc", "sighting--785bfba2-c241-411a-bc11-c55fa5ec5179", "sighting--a9d579f7-2fe4-40d8-bb65-cffbf43ee404", "sighting--e413b12f-267a-4973-8c05-daf34953357a", "sighting--e853b985-ac5e-46a1-9552-1e815032666a", "sighting--d511ae84-0cc5-43c1-aa66-03d0e0c1184a", "sighting--882f77c8-9de1-40e4-ad12-36e62a20d5da", "sighting--827858fc-a6c3-4933-ac32-2683e757d6c0", "sighting--b268647e-73a9-4da1-b8e9-9f29c979038d", "sighting--2d5300c3-ff27-4eff-a6ac-e45bb4fe8ade", "sighting--0e0427c7-c94f-424b-ac92-8fab3ff630f0", "sighting--1abe85bf-8fc5-4976-9857-ac93d9c8e961", "sighting--01c432e6-3d46-45ca-986d-6eb9d036b9a3", "sighting--6f0eea8d-5938-4a4a-a2d1-3e3d140b6c9d", "sighting--01e317f5-0e51-43b0-aceb-6204d3b7d442", "sighting--73739126-b4a1-4041-a116-84f5aa43eb1f", "sighting--5bf9d340-f3c6-4ae9-bd0b-4b97225356f4", "sighting--7c61c961-4830-4e67-bf75-16f2113d993e", "sighting--fbe8e8f0-8524-4535-b996-37795da274df", "sighting--26005ae7-0f51-4b99-b223-351d72fd4f13", "sighting--de64ceac-b1e9-4156-a972-24b4a4c2b385", "sighting--54a992ef-960b-49e5-9f6c-b853321ed492", "sighting--f9286d3d-7243-40e9-baa9-74f021897591", "sighting--60be00ad-020d-4eca-bfec-dacedc092873", "sighting--e1832587-4c9e-4eca-a8a1-30a9ef4cec1b", "sighting--79d53fea-57af-46cb-ae01-6a12ca0e8c98", "sighting--02c1fa67-098f-4b1b-9268-136d70d80a49", "sighting--5dc281c1-1177-4b94-9fb3-5c9ca8f51a96", "sighting--24eddca9-feed-451c-b7db-e18922cd75e1", "sighting--0f7da1a7-0787-44b2-b930-74e8707f9dda", "sighting--90d33fbb-e753-4739-8b86-f5409ae2102d", "sighting--cd454261-6906-42ca-9148-17b0b7256d09", "sighting--9eacb216-ce2a-48a7-8ddf-db76703d27fc", "sighting--4fd65828-76d7-47a5-8497-6e002928d994", "sighting--ba1e7cb4-5d50-4548-91af-167db29d33f1", "sighting--8d9b9799-7b1f-4388-8f9b-5616cdaa627b", "sighting--b44845b6-3445-4d5b-855f-82247a64074a", "sighting--bc1e306f-eb9b-4639-b406-e009d87b6ddc", "sighting--e3607575-6ca6-4c02-8e21-9c1de3494b93", "sighting--f65ec3e7-8ab3-496d-9dd8-34b89c861aac", "sighting--8eb0dd48-5147-48dc-9a0e-aedf596856dc", "sighting--e67cf5f8-d044-4f68-9108-59eac7bf81e9", "sighting--4e158d09-33ea-4141-9987-2d4e223d4623", "sighting--bca3714f-85b0-4040-9f1a-b12c6dc51f42", "sighting--3e7cadcb-3fba-4cbe-b41f-8ceb8c8762ef", "sighting--2512293c-7f1a-4bd2-a231-dc823e43fc41", "sighting--19a794cd-5700-4bd6-aedf-525bb365bcf5", "sighting--b97d89b8-2802-47b3-bec1-50b1ca4fd9ac", "sighting--f334bdc9-8ae7-4e30-9852-4fb7b0d1422e", "sighting--8ebde67d-a3da-4f3e-a168-4b9d04289efd", "sighting--a4ea703e-ea97-4235-aa68-34e936b0ac8b", "sighting--c5bb3271-0a2b-4caf-b72e-f236ad56c73b", "sighting--5b906406-cb3c-4bee-b9b7-05545beeb12c", "sighting--28b1f720-b425-4390-b2c0-48b6dcae0632", "sighting--ed06e2d5-9944-43b6-ac6c-5cc77fef0773", "sighting--667d5c1c-4a14-4024-9e38-a34c5efcc912", "sighting--04036169-e24c-4c74-b8ec-c53578675a74", "sighting--cc189bfd-47fb-4f8f-8aaa-ed543183c71e", "sighting--d93d32c9-1af6-4665-aecc-f732aea53546", "sighting--0b2e84e6-ce45-43a4-8ffb-28162b0072c4", "sighting--53bfcc1c-4af1-4df9-9669-d4fc14737929", "sighting--2f5629ad-c09c-484d-95a6-2aa9a7fa0bd6", "sighting--db97ec35-7d32-4e4e-9337-be8445dd2c45", "sighting--0f200682-3731-4f25-8ec4-e76c97b12ef4", "sighting--7e93583f-7312-428a-a702-12dd687ad80e", "sighting--e8e21881-6fa3-46cc-ae76-7549209cc4a1", "sighting--e4595d57-9f20-4fda-b7a8-1f104f034d91", "sighting--4df6faa3-85f7-4bf2-bcb6-27ce2c8ae5da", "sighting--d6058b8c-0eb9-4c26-be4f-e5630c032d1c", "sighting--81d18ffd-68a5-4804-a237-696a0efa0fed", "sighting--b489f81f-214e-46e9-8292-f240f8044aa8", "sighting--eec29ef6-272f-4f07-a7f6-51f7fdd42ee8", "sighting--8d53555a-4242-4b6b-8698-0d5d6df4b123", "sighting--78b93c8d-7f27-4102-91c4-46b0bf4d3add", "sighting--a1ad8b6b-92a9-4584-86e7-6bad5e6c6227", "sighting--d5f46944-ce7f-4bc9-8367-08db8308200a", "sighting--571710a4-39b4-483a-8a42-e39928ef00c3", "sighting--58f822ce-3434-4a6b-82e2-9ede977fc9dd", "sighting--6b13049b-9a3a-4c57-953b-d72693e79782", "sighting--d7bbd92b-f96a-454f-822e-04c1a8a13bb9", "sighting--2aec6fed-842b-49c1-9519-889a102fea22", "sighting--743bed29-b43f-411b-ae44-ce2df5361773", "sighting--05b6b8c4-a67d-4636-8008-1db58d714b9b", "sighting--82493b84-d7d2-49f6-9f78-7da72602b51b", "sighting--db894a10-8cc6-49d2-a49e-3a561a97a9b7", "sighting--23696212-3c48-467b-90df-a6774bd7aa6b", "sighting--80c61e5c-ec3b-4401-bd7d-7fa7d55cb8ea", "sighting--ed12b77c-b169-4d99-979d-73b38cf1631e", "sighting--e751f4f4-2097-418f-b2f7-97fdc8eed3b4", "sighting--1a71f7e3-330d-4cec-8871-4e9be969bb71", "sighting--690d246a-cb36-4088-9449-9d2b719509a3", "sighting--e036a79d-aeda-475f-9d9b-67b6fd6c48d1", "sighting--acfad706-a71e-47cf-997f-a518cb7d0985", "sighting--f73e3cb8-519e-4d79-878e-086b16553a90", "sighting--20f09dc0-efc5-4fdc-b0d6-136671b7354c", "sighting--e4dd15cc-09e7-415c-8be4-4c6f7a613c7c", "sighting--98539662-6e1b-442c-93ee-d112a30986fd", "sighting--c2dabf63-a073-4e0a-aa87-c646d0411d25", "sighting--45482cb7-169b-4c8d-87b3-382d38e09c27", "sighting--7b943b6a-c96b-4b3d-a339-ae7cd796f6e2", "sighting--f894e4ec-c976-4952-bbeb-0b2ffdf90217", "sighting--2f7c262e-f18f-423d-8b20-3f8f1e883db9", "sighting--525e4e44-5ad7-4fae-85cb-42a9b5bfbe3f", "sighting--516d26b9-f3f2-4976-b94b-1e2143a66b4f", "sighting--1c29c98a-a21b-4635-a84a-55ff2a3866d8", "sighting--b58b61f9-2bc0-42ae-8171-aeb24e6ea751", "sighting--836905be-0b7a-4458-b6dc-2560188a74eb", "sighting--2284cce5-1d28-4933-aeb6-446b60ee2e83", "sighting--10cbeeff-8d2e-458b-a2d2-22115221e74c", "sighting--9aab91f3-476c-4fb4-b5a0-e65f2d3b35e7", "sighting--67718e2a-0274-4495-ac33-f116aa473285", "sighting--6d90298e-a606-4f93-90ec-748800362f0d", "sighting--e6f17b1e-7797-4ca9-b2fa-bc52b44a1c03", "sighting--ef42a927-4c32-444d-bfeb-2fe4841bd49c", "sighting--5709478d-4ac0-46cd-bb91-59f23edf6be0", "sighting--4fc356b2-0edd-480f-9748-e12803588eeb", "sighting--53d911d3-98ec-4c3c-9a43-f53d57c159a3", "sighting--69ed8e4e-da73-4825-847f-e9ab81d604c3", "sighting--6db5b024-20b4-4e85-ae16-8ca557f33a20", "sighting--520a146c-a139-4ed3-99ef-3ff1601f9384", "sighting--c84537c3-c2c4-41df-b037-52a191ac74f8", "sighting--0115a5d3-2691-4fa1-b054-96841ea65732", "sighting--57ff8d7d-172e-40ad-b4cb-068ab31b7209", "sighting--6e5c3a16-1c5b-48ee-a68a-2d8eadc46280", "sighting--4153eaf5-b7e5-4680-b002-065cd014172d", "sighting--ddd5a8eb-655d-47ae-900e-461b8d651092", "sighting--61c72d6a-cd78-4ecd-ad07-3ce62a013777", "sighting--32910434-37ab-4313-85af-977857bd5f7a", "sighting--980f0135-3e2c-4869-bcfd-4aeb0ac2aa50", "sighting--43873dae-c2b3-43cf-81e0-d509f7a13890", "sighting--cf6f9525-9494-4993-a34d-cd73c3b771db", "sighting--52f3045f-c3c8-4bba-9c3a-450dc4a0f453", "sighting--0d59713d-0a30-4221-a1a7-bf1f84cc8d40", "sighting--e90ab79f-eaee-4e3c-9f77-4e6c73da797b", "sighting--61b3c3c9-9105-4143-8710-9e400d3ff28f", "sighting--2b1c7fe5-42be-4a1f-a7a8-b346125e1936", "sighting--633fc4a8-42e8-4fe7-9a70-bba94b926205", "sighting--f7898423-4271-427b-b2ab-baad63ef8b2e", "sighting--fbf71bd5-86e7-45d1-bf67-cb6544ef90e9", "sighting--afe2d585-59cb-48a7-870e-dc96c8e9d2fd", "sighting--1cb93ca1-8cbc-4723-b8ff-5514870fc961", "sighting--1470af86-8863-4d80-a0aa-a74ad917528d", "sighting--3312e1fb-fb27-4e41-8c95-e40217b861e8", "sighting--29246448-9efd-4ab7-9aa8-26a56d4c4e64", "sighting--75691b89-9832-4a9a-80ad-07fecfa1073b", "sighting--a4b38c18-0108-4bab-930f-fa577da5f29d", "sighting--824e5e06-01dd-4df4-9d62-45b3f2d98c66", "sighting--612c8bf7-01f1-41f5-b437-eb3e0787d77b", "sighting--a2062201-b4a3-46ea-98ca-8c9be77f76b6", "sighting--086fd32f-f6e2-46b3-b75c-3f40a83dbe9b", "sighting--561db8b6-e0f0-4ae4-a4db-dc88636aad28", "sighting--8aac9e78-f77c-4937-9cbd-2c4b3162e8e4", "sighting--81fb0f6b-acd0-46d7-a8ee-7e0a42ce3dd4", "sighting--02ace950-d867-4e83-aea9-0474d081ffa9", "sighting--8728a0b7-dd86-413a-8072-bf9f6ec6e3d3", "sighting--099d061d-1b88-4576-ad07-58c10326ecbd", "sighting--a6a609fd-fc19-48f2-aed3-1a392988066e", "sighting--4655edbc-4feb-4ecd-be1d-83c5edf987f3", "sighting--9154eb7e-3aa4-4f68-8541-409580d2b05f", "sighting--b1d298ca-6e0d-4d6e-a951-86bc4c183020", "sighting--045e9daa-53f7-48a8-a2dc-c880ed1c53fc", "sighting--2097e42b-dab8-4f2e-97d7-dba194b660a9", "sighting--da4221bb-8965-4f8a-a5c3-3fdb87934825", "sighting--16923020-a06c-4bdd-ad61-5bbee3a0f916", "sighting--1ea12b9e-c44d-449b-9259-68981e479be6", "sighting--042c4934-c477-420d-99de-36a657896af6", "sighting--c1cc8e6f-b094-4abf-81e8-61195e19ee74", "sighting--0a9bd4ed-9eb8-4d50-bbb8-9ee2added8ec", "sighting--50b4d84e-0a95-46aa-b920-095efb790836", "sighting--b5428894-9d78-4e6a-ba0a-b691bb8c099f", "sighting--e56c38b2-0b09-470b-8aad-5e29d2d99cfe", "sighting--79e406da-d419-4a5a-a83e-c303523ba729", "sighting--c0369189-e3dc-4adb-81f7-e723f0c2e6bb", "sighting--4a48f890-78a9-4089-ac6c-9480ca439b41", "sighting--538c74c7-0a84-4242-a8af-206847022ac6", "sighting--7b963bb2-9247-4074-a35f-f892c9afd707", "sighting--3764e29f-2b85-4693-abd4-ff58c2f6d1ef", "sighting--efc87a40-18f1-4cb9-9506-1403dd79dd6b", "sighting--3ca17b15-46a8-44ca-bc9a-75564af25a7a", "sighting--34587370-7d8a-4962-b36f-cbf113c3ff2c", "sighting--d285ac0a-28d9-46a6-b057-9dfe049b70f1", "sighting--5bc293a2-1acf-43ab-ac65-c6b7fd8284e9", "sighting--f8fabd02-58d4-4407-9ed7-d92eb3ccc0e7", "sighting--668b9ea3-f70f-45dc-8d25-bbda90479107", "sighting--58c7d8b7-80f3-48f0-b929-e302f033a47d", "sighting--b314308c-53cf-42d5-80b9-04540ad99ebe", "sighting--daaa0fa5-c5e8-45e1-978e-5122ccb56696", "sighting--453cd2a0-a2f5-439b-b2a1-8e541faa1b4a", "sighting--af9d0545-9883-40be-ba58-d5e6e1c1ecd8", "sighting--539e8ea6-1188-48f7-ac9b-1fe69dda94b6", "sighting--e1b3e26b-f6a4-46fd-9799-7c2970b268f4", "sighting--394a9c70-8618-4ff6-8291-40c98dad8427", "sighting--4bc92d1f-863b-4654-8187-32b63352b010", "sighting--72b02744-d950-4445-a30e-68936d6cc3e6", "sighting--904cf7cd-c3ac-4d15-b0fb-bae3f48f871b", "sighting--02b5860d-c3cf-4b7d-9022-435350f05806", "sighting--34de4895-5a56-4aeb-a83c-d4dd173de630", "sighting--ef0e585b-c360-4ac7-8349-fb254a548747", "sighting--48dd246a-393a-46ac-8ecd-6ad40a0c0105", "sighting--08de0df5-b136-4abb-8f32-97b68ee4b65e", "sighting--5005a595-257d-4f5c-83f4-7d354e2a9131", "sighting--44f73e7c-c63d-46b8-9b2d-dd990889d058", "sighting--ccd99aba-e0e3-46c7-b5d6-110f592f11c8", "sighting--ca515356-68f3-4c4e-aa97-22d728b51fed", "sighting--315a6caa-86d5-4a4b-b5c1-beab4a655b31", "sighting--3e786f04-b43b-44b8-a696-1b4ea8d63488", "sighting--f1482f32-ed78-4ba3-abb1-171cbc3fc5b8", "sighting--438cefa0-d823-4f17-8986-41a493f59d18", "sighting--41ee85e8-7a46-4d60-a017-93a1f766baa3", "sighting--49a2d65f-7169-4db5-9a79-e944389d4f8f", "sighting--a27b99b4-635c-4c77-8fd1-78a6494254b5", "sighting--cb9b7cc2-885c-42dd-b28a-d32b7ec5df1a", "sighting--b837ec94-d959-42a0-b58d-14177552d8bd", "sighting--35d19665-e591-494a-8850-7e377a209761", "sighting--36999a6a-6678-4281-89b0-01299f992638", "sighting--215dc2d4-7fd3-41d8-8529-ffd81d6476dc", "sighting--ba3806ae-0190-45b9-ba89-2d09bc273cd6", "sighting--ccf45f07-6c36-44f8-9e2c-bf0e967f98bf", "sighting--4559dded-a9b3-434c-9c0f-6d1bc6684e36", "sighting--898cbf15-a429-45fb-b2c2-fcc2099100c6", "sighting--02122bdc-4d6d-41d6-9347-9d4b77f94e17", "sighting--642243a1-3ce4-487c-aedc-09c7995cd1d4", "sighting--47ab5fd3-e46d-4452-8db6-598796897d84", "sighting--49768aa1-cb40-468d-b8b1-59e7e202c5ef", "sighting--103937e7-ff08-465c-b1e3-0b3f32a6820f", "sighting--42b2ed46-e027-4828-bf31-a984586d6f94", "sighting--3070d3f1-abf3-4578-8ec5-d5dc11d15d9a", "sighting--200539cc-7931-4f84-9770-be164ddea7b7", "sighting--fa6498db-3447-464b-a0ca-0adddc64641f", "sighting--486aee80-65da-4e01-8114-c9a8ead735d7", "sighting--dfe7d708-ec2a-4925-95f6-f903ee7cd123", "sighting--d996b854-3e79-4a70-a000-05f6e05adb61", "sighting--10309226-8f33-4a46-bf26-ce2529e7b49a", "sighting--866bc729-f3a9-49d5-8726-96a48c14534c", "sighting--18f2cd91-c743-406d-a72e-15f7f4e09082", "sighting--b3b8488c-f41f-41ef-a04c-7fc9142317a7", "sighting--24b91b80-2d11-48ff-aa4f-80c386c926ed", "sighting--c1edcf25-f50b-4392-b0f0-517845c452d3", "sighting--75b4649b-caf7-4dc7-a5c5-ef7ec33297ec", "sighting--1bfbfa34-d934-45f3-b0f3-d13e30405049", "sighting--b2c67018-bd97-4012-a977-e24bcf7eb0b6", "sighting--d5ad16c4-5836-4b69-89aa-99374086c8d9", "sighting--d7c65289-449c-488d-a637-7d876259dca8", "sighting--050bad1d-a162-4f8c-b62e-e4c87fa66719", "sighting--f67b6996-6916-4d21-b66e-f528f8107d5f", "sighting--4b71d964-e8c3-4175-8698-bc7b32d65906", "sighting--538e1e9c-df6f-448f-b8ca-35a968dc4df7", "sighting--11b76880-7750-4c09-9924-fc8e8fc265e1", "sighting--7e14d81b-4bdf-40b5-836e-bd523fb26778", "sighting--5f762468-a19c-4e46-9853-0ed763befc82", "sighting--ede164bb-716d-4a4a-a02d-05d09535b192", "sighting--f399b497-4d04-4ee5-be80-ff94c0a56622", "sighting--43b7b3d5-88b6-4116-830b-48659dc0126a", "sighting--6662e74e-a497-46bd-8d20-045278c9ba82", "sighting--c6d098cd-dc77-4f42-9801-8dcb8acc2cae", "sighting--f5be5a0f-90cc-4c23-9321-95cc68b0dbec", "sighting--db8900f6-f8c5-4105-a0df-ff923e353978", "sighting--62f66457-84ea-45fe-8b00-271fc65f8db4", "sighting--cb38cedd-f111-451a-a2c2-6d3a73bafe9b", "sighting--bd383e94-7666-4df2-a562-0a336bf651f9", "sighting--1e5b6c10-a426-4dc2-bf0e-5a9b6482414e", "sighting--d6ebcc1a-0bcc-41ea-a2b1-9f8665be5b6d", "sighting--586d9740-3049-4e20-af27-94c66c3b6a1f", "sighting--41171f7a-a999-49fb-b013-963193d5baa7", "sighting--36d59b71-f93b-43d1-8215-ff53be6f932a", "sighting--8b3d714b-e579-4486-9fa4-307ab7ef26b7", "sighting--b8ecfa58-cc1a-4b0d-832a-c83827fa20c9", "sighting--59fcb0ae-91f7-4bed-bc52-2efde617e5be", "sighting--e1c469d3-3b68-4fc3-a0e3-b08fb40142f6", "sighting--63e41b20-d2ec-4df8-9978-c5b050c22fb0", "sighting--87c7dcb4-b6f7-4ce8-9815-cab2b5e7ce3a", "sighting--f309f69d-38e9-448f-b4e6-31b899af9a54", "sighting--822b1168-32e5-410e-9b8c-a89ee7d6408c", "sighting--759a504c-c6d3-4ede-90ca-b6cb29db4ac2", "sighting--34310eac-8b96-44e2-b582-5044ecf866a7", "sighting--dafb8d27-1267-46cb-a8cf-f66949fb9855", "sighting--2b048424-144c-4d21-bfd1-ba505e0fb966", "sighting--6fd2f053-205e-41d7-b61d-c60e23e14b58", "sighting--4e3cf762-d694-4636-be20-9778ee70519d", "sighting--f62b85cd-d688-42ea-9265-01a2eebfe3e1", "sighting--1d846040-9008-49dd-a5f9-d49d54343517", "sighting--a082d001-9a2c-4042-b6e5-058af74b933f", "sighting--a35d4b33-c248-48d8-b6f9-6b263e4e8567", "sighting--8ed237e4-228d-4fd1-bafa-9eb9db89aacd", "sighting--a12b620e-e499-4442-a57b-05f52bdae657", "sighting--80f71941-c89c-440f-a5be-3b8e06220f00", "sighting--fa24e61e-9c12-4304-8fa6-2a4da901d466", "sighting--b15cb143-c951-4785-a016-273b73f22b0a", "sighting--558eb1f1-34d0-40ba-9d6a-f48ad661dfe8", "sighting--be57d57a-5e83-45bd-b413-91ac800e1ac9", "sighting--bc9db928-23ba-4a0e-937a-9e160ceced84", "sighting--7e26b365-38af-4dfc-93cf-91031c107d42", "sighting--d805768f-710e-4ddb-b7b3-2d03a9a3de20", "sighting--53978b44-4ade-48ef-830b-3517825f9f86", "sighting--3c54ad5c-2068-4214-a377-dcf534ecb3ba", "sighting--b4bd4525-0eec-4a67-81e8-ff5aa6fab478", "sighting--70bc727f-0073-4a5c-8c8f-2e00ca584363", "sighting--59fcfcd3-7fb4-4310-80ca-71317aac33a9", "sighting--b6600979-3394-4d52-9b85-d7f68612de78", "sighting--1b748216-186b-4fe4-aa8c-c19c17672a0d", "sighting--53548363-664f-46c9-ae2a-44ce6305eb9a", "sighting--1c221202-1848-4456-86b6-754fbd7cae65", "sighting--55aa5890-a775-4bc8-834c-439c7f54fe57", "sighting--4cf01d99-bcb7-4475-b7e0-70bf2981a034", "sighting--846a7a78-dba0-478e-b2bc-1ac56275582b", "sighting--de46fcb4-5ed5-45e2-bde9-ffc1a0381e2b", "sighting--286bbcd8-4311-4879-a1ba-5ccd0a6e647c", "sighting--dd62be9a-c580-4412-9a89-7a9a1455de39", "sighting--fdc56ec4-2bea-49a9-afff-52f75bfc7f5b", "sighting--de97cd3c-0022-49b5-8ea6-a7fd42347932", "sighting--819b07e7-be41-4f2b-b70f-55ab6e9896cd", "sighting--807f21cc-4a08-4971-85a5-0aaa46cdb910", "sighting--90678261-f520-4d5a-bee0-4dcf73e27991", "sighting--e7b4caef-d4d7-406d-a59a-53bf6020be37", "sighting--dc0e3b89-c4eb-4f4b-9453-73285beb608d", "sighting--aa05b61d-9e6f-42a1-85c5-72bf5b78680e", "sighting--b4e788c1-a567-4718-ac33-57e3d451888f", "sighting--0a5192b4-6b02-4a58-8a83-b1f60be841d9", "sighting--f66f3ba8-509f-46a4-a228-404e3dea4762", "sighting--5ac71f4d-96fb-4a04-832a-85cbf1ca57d2", "sighting--7c181b96-15c4-4869-8382-6ded2bfb0357", "sighting--a747a58c-0a70-4e6a-93c1-b2029938f156", "sighting--638f7491-940d-46e1-a0bc-6c038958ee2f", "sighting--ad506999-cf5e-4a4d-bcb6-a20d44994362", "sighting--f4f97116-3812-44a9-a6d2-ddf5cf9625bd", "sighting--c7e6d76d-ba53-4c9a-a6d1-15ff0f64edd6", "sighting--3b617ecc-1e53-4123-854d-9626fe991223", "sighting--a20c5b58-0ace-41ce-9abb-a7736b5ccf20", "sighting--f965279a-f05c-4282-ac7e-8278bb6fe0be", "sighting--4c9e4faf-4978-43bf-a395-4c66853651e2", "sighting--e8c1147d-9df7-4051-9175-4a71680af0f6", "sighting--fccdf1bc-bdc6-47e3-8a01-6234febae6a7", "sighting--259e0bf9-9049-4437-acad-696097e4b8bd", "sighting--dc9280d6-e3d7-450f-af7f-4984f6a6d783", "sighting--bb922177-a1f9-4c94-8578-2d407271b25b", "sighting--23fa3c44-ac00-415f-a1b5-12852aea913c", "sighting--6151afc3-ea37-4de2-aaed-de6ea94e8f31", "sighting--fcf82748-e956-484b-a588-298f2aa68a45", "sighting--96f083f9-17f8-4f62-a915-618a1f523c1d", "sighting--297664d9-d6c1-4bcf-b83b-f7015e154628", "sighting--c7a8dd3d-664e-4c7a-b4b3-70390a53b87f", "sighting--a79e8e5e-c4b1-40f1-909d-71c895ca400d", "sighting--192b460e-99db-44c6-8819-a9d3bf3f9967", "sighting--28398d0d-f3d3-4365-903e-3a2a5dcf2341", "sighting--7ba09505-ef9d-45b5-8368-fb98da531787", "sighting--80472696-472b-4d82-9270-4285f028e2a3", "sighting--0aba3c75-f307-4aaf-9289-014f260f8c5d", "sighting--8186358e-2d2f-4967-9862-5d7f8f25592f", "sighting--dce7c6c1-8f36-4040-8ba4-3cbff0b80490", "sighting--436d161e-668b-428b-b6ee-5836dd9f1911", "sighting--9d4e3192-6f45-4492-98e7-f9e1cdca4371", "sighting--39d436f7-15d7-4769-a9af-c81ec6ca5d94", "sighting--44853316-06b4-4633-a122-b1b5fcff307a", "sighting--93ba8a2b-5a2a-47c0-866a-1f450ccc9525", "sighting--3d6ef0ce-dc8d-4255-8b58-cd8becf0f083", "sighting--63147f2b-112e-4cfd-8ec7-28b3b2781138", "sighting--e32a8cb2-db08-4329-a858-9b8d6ad91864", "sighting--1450ec6d-a67d-49cc-8751-0d187b1f2375", "sighting--51fc7484-96db-4d2f-bf6b-352a5ba3e129", "sighting--dc0f07a9-bd75-4055-ab8c-5f3ff3bf25b8", "sighting--c3ec5fb8-432e-46f7-9ce8-b7bf788fd9c8", "sighting--bd910572-53a8-4dc0-bc23-975399e4dfaf", "sighting--8862cbbe-5a47-498e-aaa3-f50d86dab8fa", "sighting--eb72d5d4-318e-49af-ae35-fbaa48bdb0ca", "sighting--0feac6c1-d743-476b-855d-a39800dc826a", "sighting--b0ce3f52-28d3-4bd6-8d8f-f0921782b6ac", "sighting--5342c4a1-c4af-454a-8d89-e08799f9bba0", "sighting--fac28ef3-e429-45f6-a683-1f6dc385f092", "sighting--ea34067a-731d-442e-98f7-fb38edff36dc", "sighting--0a75d249-b0de-47ea-be7b-d4251c1ff044", "sighting--ff8d0c31-1847-4f2b-8192-43e83edd83a6", "sighting--eb73b2d2-1baf-4428-b17d-c1ab7edc3a99", "sighting--1c9a7f18-e75f-446d-8aa6-70e31eaf88e0", "sighting--67566b37-c8da-4252-8d33-b87e22b6d7b0", "sighting--c909676d-9125-4fa3-aa12-2c64e850028a", "sighting--d3c811d3-7465-4909-b23c-eeffb734738d", "sighting--05a5b897-c698-4cc9-be8a-025a6278312c", "sighting--468e9cd2-e302-45b1-8826-0ec43dbc0151", "sighting--e7401e2e-2106-4ec8-b4ef-fb5bd72431f0", "sighting--4556313c-0d2f-4b51-99c7-a9c15ff4321c", "sighting--981d6da2-8c6b-4224-b778-85faddffaaca", "sighting--2cf813ff-353f-423a-a088-8525dac2c58c", "sighting--344c138a-4192-4f4b-8e30-b09e360aff05", "sighting--1452564c-4eab-4f11-bd75-73d7b3a558ba", "sighting--f52f73af-7b39-4789-b0cc-7549853768fa", "sighting--09402264-bc85-4205-97f1-8390d736756d", "sighting--44b4fe45-fbe5-49cc-8cdb-52a1dbad584d", "sighting--9d8a4fec-c2ed-441c-ad90-91c22e2dec33", "sighting--a200ce65-4eb7-4d76-84ea-91b7f9c8065c", "sighting--3829f390-001f-4cee-b3d1-04b4d9e38d3a", "sighting--b4ff7af1-6cac-480b-97c0-f18c56f88d6e", "sighting--6a2db42f-182f-41a2-90d6-96e184232428", "sighting--122483e8-78d3-4e2f-86b3-a59dc72daaba", "sighting--c6dc45d1-a2c0-4e91-bb03-e548efce8606", "sighting--545e0fe4-e8c4-4e27-b4c6-0b2812191192", "sighting--747ddc08-921e-4656-8d53-8ff6ef0f64f5", "sighting--a1b64e4a-5595-4390-a685-db540b2efb85", "sighting--f8406710-c1e2-4651-8f3e-851f12d3c462", "sighting--60182dd2-8911-4817-a8e3-d70a2910bacb", "sighting--cf83dfb5-52df-41e2-8698-95d5213e4f39", "sighting--38090424-120c-4932-8c09-2cb5f6358797", "sighting--114b3284-d156-4e05-93a8-13eb5b901ff3", "sighting--8f22ce9d-ef82-47d5-82b1-06bc6d973101", "sighting--ea5ab7be-58da-4bad-a94c-db165ceec1c5", "sighting--a4c42b24-343c-4810-a9dd-0e009b633a7a", "sighting--1ad4ca0e-7de9-470e-bfaf-b8999717e865", "sighting--b5a4b546-704b-459b-b763-23d309741898", "sighting--70d3d228-ae59-4c9b-89cc-ea84f6a1e6b8", "sighting--7af4c67e-8616-4136-920a-0e7955a52a1b", "sighting--2e424a10-173f-4f8a-845e-97de8d1e7921", "sighting--8b056471-148e-4635-ae4d-1be223be9b28", "sighting--e494ccab-46b8-413c-84b3-09359f355d91", "sighting--89f0b7b4-fb93-4e83-920d-3ef9d94084b7", "sighting--cd6fca17-51ca-4f82-99ae-23157db49cb3", "sighting--2124ce3b-d937-4a6d-9a46-018c16715511", "sighting--6c2883f9-9629-4069-b881-ff98b9e89b4c", "sighting--67a9928e-a071-4358-850e-438342fb4896", "sighting--fdd73b38-9b43-4020-a7b8-ff3de69964b2", "sighting--693f9a12-a955-40fd-adc1-b591de9c9523", "sighting--eb57e413-f4b9-41bc-8532-07b1b9a8ea1e", "sighting--e97b65a1-2607-4fc2-9418-ab6841634e1c", "sighting--df1db55b-dbda-4275-a734-1efd51142326", "sighting--e6ec14d6-0437-440e-8a7f-411f68d7204f", "sighting--34774184-e8e5-4a9f-9891-1985ffd44767", "sighting--a225c628-ef0d-4675-bb71-41a7d4a87f01", "sighting--5939c520-6d62-49cc-83b7-cc8b9b368555", "sighting--8d4ed86d-4fef-4a9a-976b-74a23bd5d086", "sighting--ebec988e-ab25-466e-9b2a-ed1a270ef53f", "sighting--602c37c5-373a-4295-8493-e4dbc43af195", "sighting--dffe9e96-2dbc-4293-8603-749fe2489982", "sighting--da22174c-cc3b-44c0-abfc-d6ce310fc2c4", "sighting--6dd733ee-77bb-4cec-b91c-6df299176c81", "sighting--27ea7d74-347a-44a8-a039-32c65c62079b", "sighting--d8d66b94-5e1f-4121-a249-77e03ab2efc3", "sighting--684f528a-238c-4359-8bc2-1c0b1b8da90e", "sighting--e65d548d-d6c9-4cb3-b066-6f6b5266fc02", "sighting--430c62e9-a413-4e7d-a969-295bdaa8ec3a", "sighting--1fce5eaf-03d9-49ff-b6f9-b00e0b3d7b70", "sighting--1148415c-4d1e-4276-8479-212a06b02947", "sighting--ab18be00-1db4-47d3-b79e-5e7452ef9787", "sighting--661feb8a-4b69-4ee8-81f2-a0e19c19a5f6", "sighting--a6f0f96c-397b-4581-abd3-5e244a04b9f8", "sighting--1c8048a0-ee59-4165-be59-6b571224e94f", "sighting--f933aa7b-3d1b-4c1e-92d2-652c779cc36e", "sighting--696734f5-be73-4d3b-b9ea-23aa8d8555f2", "sighting--27eb694d-59a1-4de9-bd75-dece39d91f5c", "sighting--90989b5a-85dc-4e55-a541-ba2e51963d9d", "sighting--8f391b4a-b853-4284-8413-ffab09ca06b4", "sighting--ded443e0-a090-4276-b70c-ac40c5574f78", "sighting--fe61d3a2-ff97-4fbd-aff1-8d5a7f35c2c9", "sighting--595d2b7a-11af-4dcd-bf1b-51631d319043", "sighting--4a316810-3b3a-4358-9844-9b649ab6c8e8", "sighting--184d7ce8-995a-4e2a-ab6d-a9429f1dc19d", "sighting--16dbd871-3f92-4c05-aaf5-bcc736d947e4", "sighting--4dc5d030-6881-47ff-9acb-8fb36fb8df9c", "sighting--95cb19ce-7912-4638-88aa-2303928cde34", "sighting--3d960001-fb43-4cda-8017-52ef53add5d2", "sighting--5d6148d2-54e7-4c0f-ba24-cf0bed685321", "sighting--69283c58-d667-423e-a60f-c3182adbcb59", "sighting--8ed425f9-4190-4c25-aeec-051080134fae", "sighting--1ef71edf-9981-4d71-a6f6-eee1b2bc3fac", "sighting--bd02fb1b-0e1d-4add-8c4e-ef74ee0d1117", "sighting--0a8e80fe-140a-4fbe-bc3a-f37b1b0be34c", "sighting--8ed0834e-ebb7-406c-a517-8695628c655a", "sighting--ab04af8e-64fe-489d-8716-f39b0c0944dc", "sighting--30d1b688-acff-42d8-95de-664d86948e4b", "sighting--4d23dcaf-4af2-419f-a167-572b78635ae0", "sighting--8cf68a14-3b59-4a36-a4f4-1e8f0e881c15", "sighting--b04ab32a-4455-4873-be35-177ca5b7037b", "sighting--84b25357-18f2-44f8-9333-8ecb4c508d1b", "sighting--4968b1fc-908c-4d7c-941d-b47a8f845ef2", "sighting--1fd67e23-12d4-4054-91ae-d8dedaec4284", "sighting--f27d8e33-e2cf-4d7d-a767-3bb24b441f3e", "sighting--ef0a1f3f-0660-49f1-8dac-ee6ff9ae84ae", "sighting--c4fb11a1-1a6c-4724-829b-43112540915f", "sighting--c43072d8-4529-4222-a840-f59a7dbb390d", "sighting--a2f9318f-2f2a-4ccf-96bc-b9e884a06281", "sighting--33d45f57-dc42-4749-9ddd-32eb7699aedd", "sighting--c929f5ad-33d0-4fdf-af29-8faec6f9fc5a", "sighting--dfa65697-ce24-4393-8978-55d089daf7b4", "sighting--ef62eadf-443e-406c-9d29-d15b3ab61272", "sighting--fa4f2458-f033-4ec6-84d3-e9838b2ac445", "sighting--1c1437e0-c645-463d-b17f-305f12f4e6bd", "sighting--ed7253d8-ca9f-4114-861b-0f8e18784dbe", "sighting--a5c65c3b-8831-4dc0-b5df-6932ba2c8df2", "sighting--a7358db3-31c1-4cbc-af4e-500cde7173b2", "sighting--a3d7a9d4-ee62-42ec-a256-e3352e9518a2", "sighting--c943a445-0ffa-457c-b692-4619ed04bc7d", "sighting--39f0b328-ee44-4e93-b738-a0eabf181f1b", "sighting--3144c708-9bbc-49b2-b632-733ee7d90f25", "sighting--731f3e44-5951-4bcf-8828-421e755c75f7", "sighting--62b0d121-960f-4408-8dd4-ecd0801afc9f", "sighting--13bc5cfe-fa84-496d-af72-329668be481f", "sighting--3727f67f-aed4-4046-a144-fd7c54525598", "sighting--98e7da83-bd6b-43b5-9889-1c7f02ee5dcd", "sighting--b08b0e6f-c1b0-46b0-bd48-fcf7311c86c8", "sighting--db11bad7-fceb-4cb6-90a6-abbc6d6cbcd8", "sighting--d1ecbcba-8f1b-4522-b259-255eee5c0287", "sighting--5e1800bf-415e-4750-927a-4f5762b9dc8d", "sighting--a47c4f1d-ea37-4934-b1dd-2f16a513da8f", "sighting--f2096c53-bd2f-4899-9690-2fc415666f9a", "sighting--4ef44a9e-9c05-4d17-8903-5c239186dabd", "sighting--7075baae-69ab-4881-973d-72477f561080", "sighting--e96708a4-b849-4cf5-a222-a8b11c48e4d7", "sighting--60163edf-46f8-4bb5-8861-03d4f0b7410b", "sighting--f67edd01-879f-4d20-bcc8-5649d6c69fc5", "sighting--6c28530b-bc3f-424f-91bc-184640385ae2", "sighting--09f83d41-e670-49c1-be0c-7892a5c8b88e", "sighting--165978c5-0231-4fc9-8f83-d39aaf0a4c16", "sighting--7aaa1f98-d43f-47fc-81d4-c4bda31ed91f", "sighting--72d608fa-2eaa-4200-9419-68cb075205a7", "sighting--aa0a2562-d501-4dd6-a11d-2742aaa66e29", "sighting--fe534280-8fd9-4d1f-98d7-24706908db7e", "sighting--9372cabb-7379-44a3-adbf-d99720e81941", "sighting--b7958a6d-ff93-489d-9fcc-52f19ecb875a", "sighting--ad6ba3aa-1511-4492-a7c6-6ccfa0fb7514", "sighting--4dbd0592-018e-49a6-a6a8-82694ea43f9e", "sighting--38a76903-308f-4d59-bbd2-c7cb08bcec55", "sighting--4f3a65d6-7ca9-40f9-b412-6783c657fa1e", "sighting--1475d5df-6010-4986-a7f6-b71763d7b217", "sighting--5bf65424-b4e6-4a32-b6a9-6a72114868fb", "sighting--21f82e36-f6aa-4cdc-bb76-e3e515cd6007", "sighting--1f4ca103-d824-43b4-9592-6055d8b0ad2c", "sighting--253f2bff-ce4f-4c0f-96a0-4767f266107f", "sighting--00b28751-9dd8-406e-9a32-6fc481714134", "sighting--c7f98544-a3b2-426d-908b-68f666f5179d", "sighting--6835a3cd-9f27-4bfe-ac57-e900e7920077", "sighting--2aa945aa-9d57-4771-93b6-30ad5b2fa634", "sighting--55f03ad7-572c-4e39-af73-5b3a1b299cf1", "sighting--e2540395-e507-4c57-8c67-d0f7cf82fda0", "sighting--7d7c1205-db2b-4250-be84-e07c57cbe181", "sighting--422aac61-0412-4a03-9302-7b9d4dd7bcd2", "sighting--94f9ec51-18ed-440f-86b9-300e4dd968cb", "sighting--cbad993d-0c73-4d88-87f2-691904fcb212", "sighting--5abd6b39-c743-4f14-b902-86d1bb31e582", "sighting--5f53e6e8-3fb1-44c1-8c21-35c6d4d72676", "sighting--a9b1911e-baa5-47d3-9ef6-c919e5a39c80", "sighting--b3e3bb66-f353-4cac-9a54-4f0ae26fc32c", "sighting--c8fce8dd-8578-4aaa-bd91-364f10cc4652", "sighting--24e81bc1-b312-429b-8e62-0a2d55ea08b8", "sighting--1c259c95-4c5f-42b4-9024-e520c0884bdf", "sighting--9cf46c19-ad67-45e5-bcef-a9c976ed11a1", "sighting--d81a2dca-719c-4da9-8b9f-a989cf5f956e", "sighting--b5e35735-2a10-44c6-8576-4d6e45d10064", "sighting--06a770fc-f2cc-4b67-b32b-380b7676df7f", "sighting--cb4acd8e-f0fd-43f8-a623-cf37b5025b14", "sighting--37e9ca81-daee-4166-8c58-5a1943c7c67f", "sighting--e2b5bf0b-48e2-4c7f-8e83-fed58c77d248", "sighting--52a9a692-58eb-4678-b8f3-a985fc3fbfdd", "sighting--66cd7688-09ed-4f9f-81ef-a3d18fcf7fce", "sighting--3cb0b9ca-05d7-443e-9452-d2fc74c91bb5", "sighting--ad2a5575-4070-4a03-8fff-bf7ce33822c5", "sighting--5f183574-f1fb-4943-b6be-6ced5d6798f9", "sighting--517c1b32-ca23-4899-ab4d-db3e7df9234a", "sighting--bbda7b84-5b62-4cab-a126-62bfc88c1914", "sighting--2673473e-0fcd-4e00-b088-bdfc6b79e2d0", "sighting--9584f0f7-a372-4a79-ae63-54999e94c3f4", "sighting--f4b59dea-d4bc-4b68-b426-38773d4830ec", "sighting--5f3ac85d-b65f-4259-9be8-09a54419d41b", "sighting--2d2a5656-c0dc-4594-88cb-99fb18fcc33d", "sighting--1e37752d-d6f1-46a2-ac06-9ee1d515e04c", "sighting--241dd7af-e956-4699-b861-648d0d4fedee", "sighting--9308f199-bb1e-4e77-b9df-e8797da9b24a", "sighting--2d0ec1bd-96e4-4b20-9e09-e0025bf5fbd8", "sighting--fbd6112c-97b5-4647-ab56-bca84a209f56", "sighting--684bc805-7e81-4719-8b96-4dcabf796e52", "sighting--1eec6700-5847-45ab-b778-83b8b1ca8d28", "sighting--ff4c9c00-115a-4e70-8020-1b9796d716e8", "sighting--fa87b94d-504a-467c-9407-f92ddbb33055", "sighting--dd6acfe9-57fd-404e-a460-c6057db8155c", "sighting--2d8177dc-ad21-4a53-b238-9b69cdb110aa", "sighting--029c8c99-a287-48fe-b2ea-0216c772ef65", "sighting--8a6b86f7-6a11-4c72-b867-87017adf9f52", "sighting--87269062-c764-4622-9b19-c5ca762d3bc3", "sighting--52acc58c-e1f4-4d34-baae-2ea9581501d6", "sighting--9cdcee84-65b9-4b70-8552-8e923c21be98", "sighting--c3486080-a9b4-498f-a09d-abd3763b2bc6", "sighting--011328ea-0bc1-4d60-90b6-a2aaa4fbfda3", "sighting--99d13c91-758f-46e4-ae28-f27e36f3eeae", "sighting--6895af72-b29a-4539-bf9f-a19d4974edd6", "sighting--257dadc3-1b48-4462-9908-7c1519dc73b8", "sighting--bfb5dfe5-0c8e-440b-ae57-6c596140802c", "sighting--212248ad-f400-44ec-aad5-3f98f787547b", "sighting--5e0fcd41-5dc1-47eb-ae53-c3b22efbb586", "sighting--644f1133-c5f8-4d0c-bdd2-49912e7814c7", "sighting--fa2b95f2-9241-4a4d-a7f2-418a6c52c123", "sighting--21346cba-44b9-4c9f-839c-14ae2b1f263a", "sighting--e5004b8d-1dba-4c5a-8dbb-218b0491904c", "sighting--b22f07fe-6ff2-4e20-92cf-a78a68ce47f8", "sighting--db558e0e-62d5-4491-8356-85372ea4bed1", "sighting--fa1b58b3-8ed8-46f8-b595-245acb9f0606", "sighting--b883c600-3bd2-46e9-bdc9-c9e4e539b3dd", "sighting--d3ff66c8-065d-4d88-89a5-6a02d3103239", "sighting--d6959987-e48b-44ed-84b9-befc5ff026af", "sighting--d15c0f86-ba11-447c-bdcc-d8b3338c68e0", "sighting--54320b80-b751-48ca-98b1-da3fcbc06225", "sighting--f44fdd9e-3a58-4ef4-97bb-1f80f007a490", "sighting--6184666f-8ddd-4335-9bea-b5b14079c126", "sighting--8439f7be-c557-451a-b949-ea2d82063e5c", "sighting--338f5de4-fe8b-40ab-a808-6b9d07164322", "sighting--55e44890-83c9-4438-b572-73108dd3b0bc", "sighting--efbfd646-c500-4584-b0ac-b885dc1e580c", "sighting--d4115bab-79b0-409a-bbe5-b6d76439c2b3", "sighting--b2ee0b16-d5d9-48c4-8f51-e7776b92752a", "sighting--9de3622d-061a-48af-9184-43b8c0241605", "sighting--00953693-9342-439e-951f-a4fb4ab55fab", "sighting--b11295ff-d1d9-48ca-b21a-d2f849f115fc", "sighting--70406c9a-d3c1-4324-aa82-4a7e71e8d91f", "sighting--e3504b96-ebed-4db1-8ac1-316917a0bb56", "sighting--4c5fc6f8-b1d9-4a9b-ad56-c82fecea4a0b", "sighting--1b35e96c-ab4c-4de6-a548-9b9562d9bf2c", "sighting--6862171e-6839-4531-9a33-07a9722811ea", "sighting--0c534dcc-5743-46e9-ba11-937490b87a1e", "sighting--e59f1084-923a-42e1-b6e6-b931bf6d7ab8", "sighting--7d68b716-7355-4cfb-854e-b774e5f6ae17", "sighting--95a8a4d6-0c09-4622-8897-a261df4d547b", "sighting--1020c383-a697-4b47-879f-e09b2774976c", "sighting--1a2c8a03-9ada-46b5-8393-f2a50efdc782", "sighting--8268c94a-6940-4e1e-9766-74778a3a9794", "sighting--7fc6c4e3-ab6e-49d8-beac-12a4f3bf935a", "sighting--7e45bab3-2a6e-438e-8b60-e1c7d18547da", "sighting--c2ee3678-0795-41b0-a2d8-cd7e747eb57a", "sighting--7d9b6355-8c95-4b7b-8bce-5db5405c142b", "sighting--faee0ff0-a819-4d89-bd99-bd15b06527a9", "sighting--afe44d06-907f-4f6b-a428-78d0c98bbafb", "sighting--2bdfc7a8-8588-459f-9956-bfb6ad845b3f", "sighting--5d36e8de-c42b-4160-b3dd-20d9080a7755", "sighting--25e5618e-34ca-4fca-b137-308333ad56f1", "sighting--c14bcd99-5039-462b-8616-7de494a59818", "sighting--69333e6e-4829-4179-8027-aa91ec0fa41e", "sighting--045a88dd-db70-4573-997d-eeeab9b4fd9e", "sighting--c94e8223-3645-4812-a73b-987733659e5f", "sighting--89253b5d-7055-42a8-9f92-76927cb30d33", "sighting--dbcdd70f-9ba3-4d7f-bb3b-b1a2ca4fd254", "sighting--de33d389-5a02-4868-ae5f-dd39e17ed307", "sighting--58dd9b1b-215c-449f-8125-f34127a31902", "sighting--5b0d8430-13c7-4d0d-b200-f0560b623bf4", "sighting--00e433ce-c562-4a4c-809a-7402e9f961bc", "sighting--4855424e-f203-415d-a3a2-4c7b9001a18e", "sighting--a50f87c0-291c-4576-9b07-242ed4b3004a", "sighting--022ea6d5-e2f7-4aab-82b1-0643c9e1ee38", "sighting--09a24c3f-2650-43ad-96c2-229d69ffe40a", "sighting--6a66e604-da38-448b-895e-201a352e5082", "sighting--83e9da5f-0325-4e00-b00c-f8a509c36c5c", "sighting--01a42b6f-6999-4701-9020-89e41ac735a9", "sighting--2121bc33-14a8-42fa-a10f-487b1148b907", "sighting--cacf9452-5e49-49ec-90ec-c43c9deab9c5", "sighting--47de5478-c33d-457c-b20b-b433a4d5821d", "sighting--39f3d49e-5f3f-403f-b413-4581d86cd29a", "sighting--5a5f5db0-26a5-43c9-87ed-622d822ff4ca", "sighting--a265e67f-fb86-4478-83d6-9eda3a72e79b", "sighting--14a41a5e-6247-473e-99b8-21b32454727d", "sighting--299c207c-2a8e-4d9b-944c-e3ed2197c776", "sighting--6fa98ac1-89d9-430d-9a80-310500b3ebd7", "sighting--361be1c2-84c1-4eb5-91e0-1a6c838e5992", "sighting--0c7d2888-c901-434b-97c1-d6aa51965de2", "sighting--0017f7a4-f279-4ade-83c2-31ab3c8ea9b2", "sighting--4ed2946d-d8e1-4332-95f0-8d2a1d92d01c", "sighting--37d43928-3129-49c3-839a-8ddd7b968c80", "sighting--e8570622-45df-48c8-8cb9-2acf6818cbbc", "sighting--35a1b260-66eb-465f-8413-8547ab2b4aaa", "sighting--52989dea-dd3b-4109-be20-79fe89480372", "sighting--b7e441c6-3cde-4040-ac49-7a96f3b3e66d", "sighting--cd025ba8-7381-4a0c-95f1-3e07411a93a1", "sighting--6b57fda1-21a6-48d6-98fe-884a035cf7d5", "sighting--0ad56282-985a-4aca-a4b1-685b0fd41210", "sighting--3d899dbe-483d-419c-ac59-9d2442cc0b9a", "sighting--ce0bd490-8409-44bf-b3b9-df1f09438686", "sighting--ebe0d70d-85b8-449a-b7b9-d4b82a4ad835", "sighting--1e67d453-61fd-4a51-bd00-be1ce911f084", "sighting--b19317bd-fd63-4d25-a284-b96f133f4bc1", "sighting--c0cdef02-b803-408d-9aa5-835a2deaea6f", "sighting--08a6b171-40e1-42b6-9f91-071c6baa1946", "sighting--f0fc2c5a-e760-419b-8dd6-124fa3a55ff6", "sighting--8c52c548-3540-4a7b-905f-54b9f13d8a76", "sighting--48acf028-2c0b-4a49-bc4a-e738186cf547", "sighting--2a9aaff8-c94c-4058-ae51-4a2078fc6802", "sighting--32fee6c4-6079-4af1-8077-a313ef615489", "sighting--c22501b2-33da-4caa-8c77-a2afde8cc94b", "sighting--0302d903-a7c5-467d-9f15-2121ccc97144", "sighting--8ce59528-5041-468f-b492-84a866c22bd7", "sighting--817a6fc2-ba67-4666-b65c-960eba660cba", "sighting--b9d0c636-2909-4775-b9f8-73596924b309", "sighting--15c3285a-11fc-4ab2-893e-077d44406f27", "sighting--a1dc2b29-45dd-4caa-a323-9126d832259e", "sighting--e5f3bc2e-16e6-4507-afb5-767872eb8db8", "sighting--e0d5d939-4a91-45da-9125-e4d26f1e553b", "sighting--1c05bc24-8ad3-4e28-a194-2180d624e65d", "sighting--06082b66-37b9-473f-acb9-86b56adec3cc", "sighting--9b141301-7b63-469e-a621-f662e132af15", "sighting--bc120677-a231-458b-8335-97b2239ec659", "sighting--1db43359-891d-4d8d-8630-c09bf5da12c2", "sighting--28adad9c-58ad-4ae2-9bf3-1ebf9037c41a", "sighting--fd07ed07-bf8c-4d80-8436-28491cab57d3", "sighting--51d57800-1a0f-494d-993e-4c1ff07b2e27", "sighting--71aecf13-3655-4e63-be37-97568ea45f02", "sighting--0308c1c4-5ffa-4e22-beeb-fd1c7c8076a3", "sighting--5fe856e0-5c1d-4a71-bfea-c31a1646ed58", "sighting--b34cc4d8-2e65-4bc5-9652-7f8b5c8fd98a", "sighting--74076d50-ae66-45e4-943e-d43a28d477fc", "sighting--78e0999a-cf74-428d-8904-25f19adf7660", "sighting--42abc175-233d-4c72-906d-2e42d968872e", "sighting--b8228417-230b-45a5-94fd-ceb4079846a8", "sighting--05dfec62-c3f3-4279-8819-1e10b258abe3", "sighting--5b2da771-fe1c-441a-be37-91c368c61ef8", "sighting--14b2e60c-dce1-4f45-ba44-204d26293cc8", "sighting--a92fbd17-beaa-438f-9a6d-60a9e973f3b4", "sighting--8f6fee16-b1fe-4897-9837-af5eeb0cb296", "sighting--d44f1b7a-6187-4c38-b201-f8bfce43de70", "sighting--e8f22159-2111-4513-9df8-a26dca7ce280", "sighting--0f82b082-3eca-4bcf-a75e-e8b4767f6e3e", "sighting--5c5ed0c3-7c3c-4586-a520-0191db64c421", "sighting--e67c4762-d04d-4294-95a8-e78a3aa5b1ee", "sighting--8d84f296-85c7-448c-8b83-4eebe79c5b58", "sighting--ea18c44f-dc0f-4b09-96e6-8444a27ccb55", "sighting--8a8e61dd-34c2-4fd7-bcb3-70fdf5e77838", "sighting--e68058bb-c96a-4005-a7a0-00250df5896d", "sighting--890bdd10-77e6-4381-9cd7-120c8f1e10b8", "sighting--bac8ea2a-ade3-433e-94ee-9f9f3d8f6548", "sighting--8f58067f-a9c4-4463-a648-1b163f0e4a76", "sighting--c9c8d5b4-f56f-4396-aab8-c13360a4477f", "sighting--78b92dff-fee6-44d7-86fb-721d0fc626ab", "sighting--746e17fa-45b2-4783-9068-ad5e869d4ebe", "sighting--29a1b8c0-9b32-4a2f-bea8-0bf33c663e25", "sighting--a8c164d2-6a24-4251-8b9c-0c0b3fe3bb41", "sighting--a4fbd846-f8bf-4ebb-9b3a-cf21eca1f913", "sighting--f662b1c3-140d-4e01-85b2-c50361e083b7", "sighting--3de3f0dd-c815-46c1-ad98-4498db343c1d", "sighting--92972c14-02a2-4624-b02d-efac4a69ed0a", "sighting--a945f383-5e4b-4009-951f-35303d0932f2", "sighting--0ef67945-b625-4e0e-8a9a-97c415312632", "sighting--14aadeac-0894-436f-983a-c1ef4d175e77", "sighting--334784e8-4951-4098-9d75-0554c68a417f", "sighting--a2a71d94-a0d6-4673-85f6-da0dd4bcd7e3", "sighting--472841b6-9031-4dc3-998f-de4fb80b839d", "sighting--b66fd932-8d8a-45af-bcaa-2ad75db679cb", "sighting--6959a31e-7e98-40f2-b541-bf8417f7c9f5", "sighting--46092ff8-5016-4348-8662-6c342c229f65", "sighting--03157eb5-a4ed-4578-a999-7a80ff7f9af2", "sighting--585a431e-5708-472a-a2c2-093de9966552", "sighting--ec60f75e-ec62-484b-b580-d14bb0f35254", "sighting--295edca0-c81c-4528-a938-c1ca36f14103", "sighting--c0a570f7-187d-47ea-8c4c-383c9be4555c", "sighting--fa81c041-1403-4b68-975e-9ef7aa8c3eaf", "sighting--0d014b93-b130-43d9-af69-a1b662b86ac4", "sighting--ba4ed620-f0c5-4bbb-9d08-0edfdf5f5e49", "sighting--88dcfa0b-f40b-48f6-92e2-7bd1e79c4057", "sighting--c2191d18-7087-4c6a-bf9c-66c77b7e9f63", "sighting--c02afc2f-b63a-45aa-854e-48f93feb6246", "sighting--ee2c9fc4-4a39-48b7-99b6-aaa24d64352b", "sighting--428cc8bc-61d4-4ea8-8e9a-8cbb763497c3", "sighting--9a2645be-ece4-4d24-a519-e0cda59f9e8d", "sighting--3aff5438-349d-4920-9790-cd789d94f565", "sighting--4353c4c4-12e4-4a7c-8adc-bb18e73e92a1", "sighting--1c366ca3-fda1-465d-b54b-e7af930d24bd", "sighting--5565063a-7d98-4c8a-bafc-f39549ca53fa", "sighting--bfc67086-d84c-499e-87f9-9eec402c5b91", "sighting--fc9048ab-e605-4d59-ad24-59788b82fbe0", "sighting--6c3e8522-d36b-4276-ba8e-51dae76d0a0e", "sighting--bcd066db-33ba-4e9b-86bb-e5b09e2eec2b", "sighting--9471bec0-d784-4226-bf5d-d26d05a9bd13", "sighting--9157bfd3-36fd-4b91-bdc9-40ac913b229b", "sighting--4716aa18-0097-4982-a24f-493bc3e87225", "sighting--eb311d07-38b9-424e-8dea-8c7cdf6a3283", "sighting--81951960-1ac9-4073-a319-cbc12d607a1e", "sighting--fd2b12c6-2805-4c91-ad02-e7b56dd6b30b", "sighting--27e933b7-89f4-4288-a5a1-f727e2cd2e7d", "sighting--35c5415f-8ee0-47f4-bc51-1e9f335b4057", "sighting--ebb073e3-0d06-49af-8534-6b69fa3331d9", "sighting--40b37a2b-a28e-4d5a-99fb-3354e154d179", "sighting--a3d6d4da-5bdd-42b4-8f4e-ecf1b41fe3f1", "sighting--e5d91053-bd43-46f9-8f07-8725057c4812", "sighting--88a79776-f64e-43c5-a6d8-306aa87542fe", "sighting--034ae550-d637-416e-a51d-0d7dc356dc66", "sighting--80e5ade3-864f-4ce9-8c97-99574c14b921", "sighting--457df114-7771-4dd9-913d-c3df1ee6878c", "sighting--08cf70aa-b19e-4b93-851b-b48200f47d3f", "sighting--9f457f97-7fd6-4378-81e0-db6a3137a5e5", "sighting--a90b4ecc-57e3-4cf6-b9e5-d6b0f2401b31", "sighting--f779bb4d-0e9e-456c-a3c0-52694c171cb6", "sighting--13ad2605-bfd8-419a-bb84-2e6ddac926f4", "sighting--ac8df27d-75ef-4962-8356-0f39018db5cf", "sighting--eade8ecd-d412-4872-a880-0b420899efa5", "sighting--ff247e4a-502f-4049-a477-7768ae5410d6", "sighting--f2697818-9add-4b9a-8eb0-b69c46a5f240", "sighting--d46c435f-ae5e-4502-b295-0e4c28144575", "sighting--30bc2a82-eb76-4793-a4dd-bf79c9f7771e", "sighting--da5d375b-3bac-4804-bf8b-0b5cc1dff6ee", "sighting--a94d479e-a75e-48e9-8040-34df683f37cc", "sighting--86e78d2a-be9a-45e9-a71a-4ac384c1be62", "sighting--3f38d4ec-0a28-40e2-83dc-c787d0eb52cf", "sighting--4b159c67-d564-443e-8b95-78591040f1a1", "sighting--d78adf97-1672-4a28-bc1c-4fcf8ca31e4f", "sighting--e6ef8476-32c3-4337-985d-5bd6f5b3f6aa", "sighting--a5dc0cb4-1a5f-4ccc-8fc7-9094739b84e7", "sighting--cb2b4719-b01c-466a-9541-fa22a2ceb189", "sighting--9a3b1bf5-2ef6-485b-8eac-2577f5aac255", "sighting--2238e3cd-e2b2-47af-ad5f-c3e4d53fc3e4", "sighting--f876f19e-4c59-46c9-a9cc-b7eb24d5c609", "sighting--20928bab-b0da-4b8e-a57a-2025ea183ea6", "sighting--d20a4526-feb9-4598-89ad-5848a1dae935", "sighting--a4041d0e-dba0-445d-817c-0cf292a5e2b8", "sighting--c66f8c53-ae12-47cd-9785-a661a072d2c4", "sighting--6643e86f-ff8c-4bf9-a0a3-059ca3b4d071", "sighting--8cfaf8ba-6b3f-47ad-b853-6bca199f9d56", "sighting--ff56d786-392a-4a2c-9e18-7c69999dc574", "sighting--a218223c-4dc6-459f-bfa3-58e021951baa", "sighting--9c11e03a-fabb-4991-ba23-6492bec075da", "sighting--708ceff5-d340-4f64-b959-3184ba17edd4", "sighting--f01d8ea9-8922-4ec3-bfa5-bd521864c251", "sighting--1372aa3f-2582-410c-aa34-d0c960576606", "sighting--ff544d22-50c7-48e6-b264-9c97fff6b5f5", "sighting--b33ca616-0f88-4f82-8de4-34ccb0965aa6", "sighting--76bed1db-c718-44ee-a911-6a6b2e1e5021", "sighting--e877ffba-4f31-4f6c-85ac-f0ba50236676", "sighting--b12b4cc3-7caf-4b5b-b66d-6997b3f866b7", "sighting--5308c427-c692-451b-9c4f-cf84dab730c3", "sighting--3d612305-67f1-4e8e-8663-fbf4e04c4f7e", "sighting--8d1ac3db-c811-4416-b789-5eb70e58f01f", "sighting--b75b4fc8-9abc-4e41-8b37-5435c0cb2e6b", "sighting--fe7fa447-81d7-4e1f-a0aa-08ee2b45ba90", "sighting--ee3a5cfe-c4a5-4317-8028-091c09e70bd1", "sighting--9c32ddaa-7feb-429f-8375-be683e8e9552", "sighting--e9739763-8737-4827-8d0b-86ae3e2432ae", "sighting--981a23d9-ebd8-4507-86d2-556810765663", "sighting--fd7b0ee6-889e-4a2e-944a-2e9f3e8f9632", "sighting--801b85f5-d484-4177-8d2c-7aff1078d3c4", "sighting--5db990dc-a357-4e3d-b3c5-4f1fe33e251e", "sighting--e78e736a-2cba-46f0-bf7e-f02da20299dc", "sighting--8736bb30-4d64-42c0-a0ae-3797d3f6aac8", "sighting--a3b214d8-7400-4a5b-b588-0b071cb31e89", "sighting--df0f851e-8539-4668-9fc6-01c1ac168d59", "sighting--64878441-a264-4a67-9d0b-ad23ae7dd999", "sighting--6179409e-4f8b-4973-8db8-ef522856f706", "sighting--8e9cc04c-9c24-4380-9e75-3a0a2d11168e", "sighting--d9a619b2-8325-4fe6-8efa-d146b13786c9", "sighting--562dc75c-b885-421d-ad76-5c279b6af717", "sighting--2d84dc51-a2f9-46e5-a49c-347d019fe6e1", "sighting--e9cdfa1f-2925-4c81-afdc-579f7b538a43", "sighting--bdee6e03-5c32-4a57-bc8a-c3a122dbc471", "sighting--a0d62518-d799-4bf3-89ae-50f1a5010911", "sighting--c085b350-c168-4c79-b112-57b8f8afea30", "sighting--6cfba5df-3eee-4fb8-9f75-dc6bb55aa95c", "sighting--9210179a-f0b9-4d26-b1ce-2aa92cba9458", "sighting--87059496-ab17-40d8-96eb-e9d2746a313a", "sighting--ca4f2a50-d6c6-4737-ac50-b273377e0516", "sighting--bdf1dddb-c5ce-4d12-b8c9-87ebdbbaf1a3", "sighting--c72fd2c0-e41f-4818-8bd9-b2a97c98925d", "sighting--1532619c-ac48-4db3-bbeb-7b2369c5c71c", "sighting--86605f35-21ad-4a5e-aecd-0ef6a276d149", "sighting--60ca11c4-88ff-40f5-9181-d2d18e232c0b", "sighting--c427fb47-0c5d-4461-88b8-1ac930b5e5cc", "sighting--7b0d0530-1320-4f68-abe7-afe37d20733c", "sighting--87767861-7cbb-4d81-b8cf-6d25dd0cc289", "sighting--3c56c482-175f-41a9-abc4-6258656dcd21", "sighting--42de6270-cda7-4ad6-9b45-d14f2c91ac9b", "sighting--d1be55c5-7b3e-475a-a3bc-68e845f9997c", "sighting--0eb8896d-26f8-483a-ae61-c36e62053197", "sighting--edb39807-5c18-4a89-82a3-58cdac670a9c", "sighting--cec2c5ce-269e-41dd-bb28-205ed0bc4d07", "sighting--a2ccb028-2a38-4ab3-a12f-7c8a71f8ecbf", "sighting--acec3697-7bfe-4ad0-a14c-b4755bad728d", "sighting--1ca5bb64-6daf-429d-b57f-11d5ac98d676", "sighting--14a6ffaa-0413-4587-9113-0788fa510282", "sighting--92891693-93e8-4ae9-8cb7-6e7249c6e812", "sighting--30d0a75b-60ba-497f-9c6b-ba9306597b40", "sighting--05b333f9-6d08-4330-abf3-29ec2ae17c34", "sighting--4c61ff8a-3894-4c12-96c1-cfdf8c7add9d", "sighting--05d4937a-b28a-4b08-850e-e86321a42cd8", "sighting--854b4f89-6a74-4d41-b9a0-aeeea27b5767", "sighting--8661c0b9-169e-462d-8be5-21e5a2f0b24f", "sighting--bd17e1a7-0f51-4b2b-99c5-a0e99eec30c3", "sighting--0e446df6-db75-49db-ae13-d1822ac106f7", "sighting--494915f6-95e8-4fc8-851b-b6556d5dd2f7", "sighting--e4377631-27fa-4de1-9791-7b72e217238a", "sighting--83983c5f-63ad-4c9a-b71e-072a29e93c1d", "sighting--45cd5c5b-9e37-46de-9a20-07047d459ba2", "sighting--9e001d9f-9c05-4b3c-9988-b483daebcca8", "sighting--3575d70b-dd5c-45b2-94ae-d39ec11dbd6d", "sighting--34b1dde4-c220-433b-aee8-0d4ea595c83b", "sighting--1e451f7b-d6d8-4bb4-8edd-bc4c95360f0f", "sighting--6e77b81f-3dc8-437e-b65c-6092618da049", "sighting--4aeee2b5-6aaa-4e07-bb42-69fa9c005de1", "sighting--76f141be-9604-4600-bbfc-9c3e5679b12a", "sighting--4cec7a1f-61c8-4e8e-ac2c-9d0c7d2e693a", "sighting--bc6eb98a-f557-449c-9bce-f2d6801e69a2", "sighting--3792f454-1dd7-4613-809f-bbffa7cb9f46", "sighting--574c8fa1-43f9-4fa5-8919-20f69b4d17b1", "sighting--6616a8d6-39e0-4e8c-a19d-ac2cf48c355e", "sighting--cbcfad23-b9fb-4a53-95b1-e2c6e5f8c623", "sighting--fbfbc298-097f-49c9-a2f9-79f301dff511", "sighting--dbb1348d-4967-4b05-a46a-e20ec90f3702", "sighting--4ab8821e-bfc0-4afd-98f5-6ff0dc5a9d9c", "sighting--76af6d31-70f9-4000-8d06-2b71a9600a4d", "sighting--29910313-4341-43ea-8023-15063f8d2d52", "sighting--ff9701bf-6f02-4995-8194-96f29006b315", "sighting--992d8f86-68ae-429e-aeab-fdfc39239246", "sighting--7e4b98bb-515b-42cd-b9ab-476b2da7ba51", "sighting--7cec69f8-5fbd-40f2-aeef-e1476f3aab4d", "sighting--19200433-392a-4882-9d50-77756ccd4812", "sighting--451a606d-07ee-4cc7-863e-b5f1d768025d", "sighting--9a2e6bbe-c7c2-492f-8e30-522862543e85", "sighting--a7f6d189-6d69-4510-8cfa-178041644db8", "sighting--ca76b0cc-090d-4b6f-ae86-bb3c0b6892bd", "sighting--f381f1f0-700b-469b-ad2d-8be305def48c", "sighting--03ea381f-ffd8-4462-a061-ed2b09893126", "sighting--5c798c81-a7b4-4f6f-b41e-863973f297de", "sighting--90168637-acfe-42ce-b9d4-94db0d219e0a", "sighting--965796af-585e-4656-b327-2f3c4b80bdf2", "sighting--7c6edc69-3c72-4ba7-a285-90d58b67743c", "sighting--3fc9f22b-8613-4913-a8f3-2a2a6ecab396", "sighting--dc12e039-6d77-4110-ab39-e1125c2dc65b", "sighting--c65cfa1c-e0dd-4d5e-817e-afb10c2cd2ba", "sighting--da0dff4c-7e79-44aa-9ced-2f4b16e4a624", "sighting--4d3a90a5-f6c2-4e87-acb6-c6caaedb7143", "sighting--8764b726-efa1-4f8f-b69e-94add0416b77", "sighting--d356cbde-5fdd-4504-9380-028cc4d48def", "sighting--7065fd78-edfc-4b68-a99e-76f3b07f38cc", "sighting--738c050c-a972-4a22-bcb1-4053b68fe05f", "sighting--6dcd5f7e-abfe-43a1-8e68-7fdb087b9a7e", "sighting--5dacf10b-4f99-4664-8d71-9550ab608515", "sighting--7164bbcb-085a-4100-88db-8d1bf58510c7", "sighting--8ea12f25-3dea-4492-990d-ed9cb2b29bf4", "sighting--592f16c6-0280-43e0-a042-9b6c9f7527bf", "sighting--fffbafef-2224-42dd-a33b-fa316266f2e9", "sighting--b68ac41e-fd1b-4170-8eab-cf2871a7483e", "sighting--8319c853-e622-4576-a26f-e44af3d0f6fe", "sighting--030a7e20-c0a8-4d56-9163-8fdc53795b2b", "sighting--a2f4206f-0f23-43d5-8f37-5a41e9af9470", "sighting--8707e804-96b4-4b4d-9cc1-7235fedcace7", "sighting--e674cf56-7c5a-49f5-aef7-578e723ac9fc", "sighting--bbdb599a-754a-41d7-b194-1e51f6e613ee", "sighting--eca019df-f655-4f78-8d1c-4348c09c1074", "sighting--e03b4405-2e88-424b-a15b-00f649942d67", "sighting--06a1fe50-9f18-4fe4-ab4c-e20038ff6378", "sighting--f5d448f9-3279-4121-8ab8-48261b222f66", "sighting--03876dc0-e3a4-4440-ba77-e7c5318ba240", "sighting--05c4d8d8-89ff-4a4c-9dba-472874e91c95", "sighting--e8722bd5-d87e-4aca-a938-358ead80aef2", "sighting--6455da70-2dc0-40bb-b2b0-a02e5ddc8225", "sighting--04220644-d125-4a12-998f-3a13cb17b4a3", "sighting--a649c20e-732d-4bb0-8e31-cce74ca1f63d", "sighting--788de3b1-a209-45a6-b7d8-3aa5c1dca7e8", "sighting--db2ae12c-b255-4f14-bf0c-efaf1471ff8a", "sighting--81183f3c-899a-445a-a269-c5b924cecdf7", "sighting--c480a899-dccb-4863-95ec-517a282592ab", "sighting--a52878e7-cc7b-42b9-986a-ffd6296bd02b", "sighting--e5d84d1e-781c-4486-81ae-ad344d1a0b31", "sighting--02ae1d54-930f-4e74-aa1f-9875bb33c060", "sighting--e20d5ffc-8e94-44b8-b721-d4f40e2dda1b", "sighting--b0b7609c-5a43-4d74-a6eb-25b3613e75ad", "sighting--e7383ed1-6d13-4b94-9b68-3b7772940e87", "sighting--657e6092-dd09-4633-b6f5-3840771d5953", "sighting--c5c44b81-d21a-4124-a48f-458ddfce1b73", "sighting--1efbf0b1-0a58-429d-a99b-2ed25c395e85", "sighting--0f4e5348-6293-4f84-b0e8-533b3a041087", "sighting--48cb6ba2-e907-441d-8b18-0f1220fa47e3", "sighting--8e8a594f-c703-43f4-8c8c-407478e8e949", "sighting--3c66e2e0-1e59-4092-8535-2f86afb86f4b", "sighting--bfb3ea63-0365-4ece-a694-ba9598ed87a6", "sighting--1cdec8ad-3812-4a64-9dff-dbe6af30374a", "sighting--33687661-b6a2-44ed-a151-0ed85ab22d48", "sighting--b4508f62-c098-49b8-9e20-94b427a2b7a3", "sighting--5c8dcb00-f216-4a64-9c91-42db4d2fb894", "sighting--f2b61e25-3635-4c10-8fa1-60085dda3a5d", "sighting--a2506ec7-a34e-45b8-b61d-41a8859d3437", "sighting--f7834bb6-174c-4caa-b4df-eac4a291f30b", "sighting--07b3b639-30a2-46c1-94a1-f12f8e96cdf9", "sighting--abbe66a5-df1a-45a2-96e9-a52d83f39918", "sighting--fd2b0656-2e97-4616-8b74-9ee5e6f8ea93", "sighting--27d5a70d-2406-41e0-ab75-4bfaf471180f", "sighting--b445a89a-d813-459f-9109-276e367a9edc", "sighting--d2057d82-0c5d-4780-825a-e6908b6f51f9", "sighting--528e1f23-6189-4793-8e7f-8394bdc8bf6d", "sighting--0ed75caa-d12e-402f-8133-2456203ff85b", "sighting--8ec6016a-ac12-49d7-9aaf-1274d6c7bc01", "sighting--582730f2-f789-42a0-b2a9-c0e00229af28", "sighting--d5642794-bb88-44aa-9f29-2960c5e16269", "sighting--1d30b8dc-71f4-4d04-bd23-8fe3b38f3705", "sighting--ad3fa177-0fae-4d2a-9c13-fed4137d626d", "sighting--be772da1-9998-4374-8de3-ac10d0082924", "sighting--8a75e924-7355-41d0-8e81-f0ad77908de2", "sighting--b6e5b3bd-c32f-4918-9cbc-5971bb11392c", "sighting--657bbe5e-252e-46d3-8308-a6b1fb5d9be2", "sighting--479321ca-471c-40ab-8239-03ef4cb4fb1d", "sighting--97493b53-3b32-43e0-b243-0e205bda79e9", "sighting--1de679fc-13cc-4b33-b6a9-0bff8c8047f9", "sighting--47901dc4-6e5c-4bdd-8aaf-29f95ab380ea", "sighting--d4b821f9-2f19-41cd-98e1-4bb45446b00b", "sighting--09c6574f-5736-4800-8dfc-1f99fcc823ba", "sighting--e4f19fdd-4c8c-4491-8b2d-16ec244e4c63", "sighting--c0f69ba8-2336-4fb1-ac86-5a0d37fa4dc9", "sighting--67242575-2e79-4bac-bab0-b1d4e9c17e39", "sighting--bea459e2-baa1-460f-9ddb-b303999e0a82", "sighting--5644ec62-8691-42db-9780-9f9e6f0d68ff", "sighting--ff5cd2de-bf84-4222-b9c1-a811737b7829", "sighting--642148bf-cec4-4413-8a61-168b3dba44f7", "sighting--c0de287b-92b8-48b6-9ff5-b67fdfb84d93", "sighting--6cf38b16-e1ad-4191-b68a-3d0743f6b241", "sighting--b1fa42d2-40c7-4341-abc5-3084717f0757", "sighting--99815331-c6b1-40be-a24c-e275fff45abc", "sighting--ff7576d7-fe95-4bf8-8a7b-ccd4a90387b4", "sighting--fed9aaa0-7e28-4d29-b334-06b1a38b1627", "sighting--860fd45a-4236-4d29-8e02-f77c817a34c6", "sighting--dd1f2561-b66a-41f1-b395-fcf8ad9c93a6", "sighting--3c5ece18-bc5e-4192-b596-70a3a16c836b", "sighting--e61d0159-c373-4355-afc0-0cc9e5e3f200", "sighting--96f4ffd0-51b0-40f7-9f4c-b15b55f35fc6", "sighting--985e79fe-da04-4a4d-8361-344c6fb7432a", "sighting--71a31911-bf10-45d5-98c5-a7ce11be9822", "sighting--a5c9974c-58c2-40cd-8891-9a099269b83e", "sighting--bd0f2a68-221a-4371-826a-bce89686cbdc", "sighting--94e295ff-09c9-49b2-aa4e-da0c79499a5f", "sighting--3b6e2d4d-5835-4294-928d-aa4b4a2c01ad", "sighting--b1ea5b56-f26d-433e-8e5a-d51febffee20", "sighting--2018373e-7171-435d-a7eb-214bfa105d2e", "sighting--fc415489-40f9-4f5c-8453-08f93ff4c2a7", "sighting--add958b1-c0ac-4c03-bf04-9af1cab6eb50", "sighting--6089dea5-fa68-4a6e-8191-92838b22538b", "sighting--45cdadf9-62e1-494e-afc4-614ab109ce28", "sighting--8a0c662f-94b7-4dff-9d36-c3c01a1dd9df", "sighting--6520538e-009d-47a0-83b6-9ad19d7511e8", "sighting--3ee89919-469b-4d0e-ac93-a8463a935bce", "sighting--1a5b7b69-b1c0-48cb-97c7-f3e0726cc6b0", "sighting--3e70b1dd-fac6-4adb-b9cd-d447eb3f9145", "sighting--e3f17d3e-4aad-4480-af62-cd048b89478a", "sighting--36a8473a-2e6a-45df-8b88-02fea880f506", "sighting--77dd6e58-13b3-4143-adcb-8a266d78151c", "sighting--f3416547-7708-457a-98dd-0a3b6e6c3da3", "sighting--e47ca46a-2bef-4a8d-94b8-706726ca613d", "sighting--21dc0541-a12a-4c03-a981-ee0b84a98d98", "sighting--dc161cc4-f8b7-45ca-82d6-47fd52ee6f00", "sighting--69611a07-b091-4dd2-9a78-d61587ac9442", "sighting--4e06d37e-1b5c-4fae-ab1f-995f969d07e0", "sighting--ebc42ae6-d1ac-4615-88d0-e0cb531e4ede", "sighting--c6c5862e-b98f-4a8b-98d9-97700571326e", "sighting--c66322a3-f064-4860-99b5-ed649674770a", "sighting--0383de80-ee57-4442-a098-16a81acddf52", "sighting--4a020f43-b576-4a9d-8f4c-3c97a7130c38", "sighting--7ff3a551-ad86-43af-aada-915e5c0edded", "sighting--455104ec-6379-46c0-a1f6-3528468773cc", "sighting--a767a1a8-e63c-448b-8b2c-145128e8bbb2", "sighting--aca594f3-d040-4dcd-83a3-7bd4a179c667", "sighting--c451628a-0243-42cf-92eb-5809be8ee97c", "sighting--544f8304-3469-4546-831d-e3a6ea234c67", "sighting--8127e63d-37e0-4476-b394-95a53064e172", "sighting--12911bdb-7f2f-4bd7-94b3-d13e01475585", "sighting--3c80a751-002a-406b-8286-34ff391f61cb", "sighting--3d56167e-a758-498e-91c7-6872a483a203", "sighting--c6c69c6b-506c-4782-84d8-0e71c60d6239", "sighting--c6a7ddfa-06a9-44e4-94f6-0d2b7144652b", "sighting--7dfe5a46-2e07-40e6-abb0-8d94eae92684", "sighting--6ec239e2-8e0b-4242-871d-e431d6e201d1", "sighting--81ee20b2-e80d-46c0-82fa-4093f8fd2927", "sighting--f4217cec-a88b-4d95-a8a8-3556d4180432", "sighting--4340e8dc-34f1-4045-b338-45c3456ebbe6", "sighting--f6849572-f10d-49a6-a516-d0a2fec635e4", "sighting--167ef911-cc00-44d9-9183-59cac2a3c5af", "sighting--47ef5533-2452-4f38-aeb4-4e306576454d", "sighting--72a68e02-8ff7-4873-b4d1-0d5b92ad24aa", "sighting--ce8bcf9d-f136-424c-bb42-00f885262a13", "sighting--3bb3fc76-74d8-4241-82c2-ed475e896f15", "sighting--d6f6f0df-709b-4a5e-b906-59a333c25b96", "sighting--056929fb-1648-4601-a69b-3bbb92b1e7a6", "sighting--5774a4ee-9b60-486c-b4ec-f0b711e985ec", "sighting--12ca411e-abad-4fb4-abe8-2ee72dbf61f4", "sighting--2999c9ca-7ed9-4b4f-bfef-5a772ebb040d", "sighting--64d431cb-fdea-4183-a28b-4ccd6a0b9239", "sighting--5de6a22c-19a1-4951-8b4d-af5649239a8f", "sighting--9ca1c1b3-351c-4dc7-9d5e-5e851b45c3e5", "sighting--6c950375-c98a-4043-99e2-5441bf9eeff3", "sighting--407f4a1f-3f67-4fb5-947d-a52978296f1e", "sighting--a9e0672a-cdbf-439f-a00d-7987598d4f38", "sighting--2a882dc9-bc52-40f3-b256-cf5c1dce885a", "sighting--701ce4a9-25f6-4c98-821c-e30f0a345749", "sighting--c8ebc156-e23b-47e7-9ff7-d12b2cd50956", "sighting--460dd4b6-55b9-4f08-8c3b-6d0a23a921d2", "sighting--6c8d0410-a801-430f-a294-db637ac093b7", "sighting--0af419fc-ac96-450e-8914-c44500f5496f", "sighting--12c22b3b-4adb-4f7f-ab1c-d9d99d309bf6", "sighting--20ef05f2-d0c8-412b-a398-5d54b85a7d6b", "sighting--ea76ddd8-cc1c-47e6-8e43-6adf847c226f", "sighting--ae3a637c-5353-48cf-84af-db1aa07d29dc", "sighting--645257e6-5906-40c5-9ca3-b3b872ff09f2", "sighting--93fa8de2-1ea8-4913-b67d-2d8147d1b40e", "sighting--d2814746-fd40-4ccc-9636-362d9915a726", "sighting--37e2e14a-7529-4a56-b30a-63e83787b1cf", "sighting--5492fda9-5dbb-45fc-9aba-f47396ec5855", "sighting--3929a06f-81af-48d9-8ea6-a53f29bea99e", "sighting--e080d140-88f2-431c-8a26-4bc7f1516232", "sighting--28591566-8f5b-4fa0-862e-b7a94e2d6a69", "sighting--86c34ab7-4fc3-4c32-9f4f-c40e0881e4d4", "sighting--5a3c91a6-d225-4c9a-9173-1588c1d2c9a3", "sighting--67332028-6e66-48d4-8bd7-15e18b883c66", "sighting--d3e49f07-941e-469d-a169-adee0f1f75b0", "sighting--b5d5464b-4e6f-4dae-bbd2-499a62160585", "sighting--a4fdf866-25b6-49ae-bfcb-3633cda0086d", "sighting--97f8a2b6-3305-4acd-a959-ac811465aae5", "sighting--cfcb0f5d-3640-41e8-b73e-26dc73d3d388", "sighting--33b5b11d-c950-40d9-a9ad-d982a8f658e2", "sighting--b099dea4-1b59-4c82-8aa3-8de73cf80a71", "sighting--05e96f78-3bd1-4c52-a9b2-130e5727390d", "sighting--9e028275-95c8-4a8c-81cc-f524f788184d", "sighting--9c796ed8-c0be-4513-b252-34461d0d17c0", "sighting--d1a1149b-f5f4-44ae-adc4-b984022dd9ce", "sighting--9bf121bd-a238-4720-b266-dae4e60da9ea", "sighting--b909ec1b-8e9e-4eb1-8f95-51c9c2420f66", "sighting--fa083df5-3823-4a5a-9344-8288a832f0b2", "sighting--5eef65af-ef6f-4876-8a88-2a84a6781c22", "sighting--405b6050-3805-435d-bdf9-e783802a0c16", "sighting--b2ed14d7-df1c-4353-8397-7961e13dcd09", "sighting--28853bd9-db69-41e4-8c1b-7f4c9c3215fb", "sighting--4cf554f4-2351-4d03-bff7-501518a29950", "sighting--3252cb5f-c72d-4c8a-9e14-a9f42a42f95b", "sighting--411d7a14-e663-4927-b3d7-b46be7948c07", "sighting--7b974842-cd46-4648-8719-8604b7a9a465", "sighting--46ec33f9-c89e-42d3-b22f-e361f92c1fba", "sighting--d74f7929-99c8-49e6-8ec0-47b34fb819f9", "sighting--067b617f-57d4-4965-a430-24e3b4cd7aec", "sighting--3c085995-7751-409f-85bf-9fbb69abe98e", "sighting--06a26fb8-98bd-479f-985e-1e0f0ad44608", "sighting--0496c178-a6ea-435b-85e7-edeb84584ef8", "sighting--ddb3c8cf-5d2f-4286-887b-70066f61df8c", "sighting--f894e011-be6c-46fc-a342-360aa0dc6dc7", "sighting--83adac75-7f33-40b6-a174-bdcd2de768ba", "sighting--1ad29e41-665b-4e48-a116-c3274c47f596", "sighting--417d074d-3ed4-466c-9289-b42768265ceb", "sighting--9870265d-7d0b-4b9a-b70e-8f583bb43280", "sighting--b71beb50-ee2e-49d8-82db-07b8b11dd747", "sighting--e54a3020-bcc1-42c2-971d-bf97ecd25a34", "sighting--34b5f8d8-ff73-4e3d-8983-dbbb6a07e690", "sighting--a0c33e67-d773-4289-b481-903b8c24d829", "sighting--01219138-e4b7-4ddc-ac6e-e37f5c0221c5", "sighting--cb969064-f6fb-4860-8298-9cabc9b6c4c6", "sighting--c433c460-9bd3-424e-b167-b953c21b8209", "sighting--4920357a-678e-408d-8d5e-e3f57af2fcf7", "sighting--95324bf0-fa76-45e4-9aa5-a192d98a7f02", "sighting--11367e5a-645b-4235-8f77-949d18a7eac5", "sighting--3be8b9d5-5346-4aa0-bdcb-4fe7878c700f", "sighting--343e090f-51ec-4e27-9e63-bf5c51b7ea8f", "sighting--c8cff59e-7791-4313-b138-c78ce41aa402", "sighting--1ec96fa7-93b3-4cd4-9832-7f7a833c866d", "sighting--1a811df6-a59e-47d7-8d06-f4cb73ea3048", "sighting--80b50597-823c-4fba-bb3d-b8e5f9117892", "sighting--a5fd96ea-ff55-4838-910f-211687ec2c10", "sighting--10c53906-3c4d-4525-abc2-2169588654d8", "sighting--712ed939-fc85-40ad-971e-f860e7f12cc8", "sighting--57b04d67-c29f-4eaf-8cef-2859f1f0e6a1", "sighting--366546c5-96cf-47e7-9eb2-a9a0ecb76401", "sighting--3736823a-ffd1-424a-a620-77a8c94ebbc8", "sighting--568c6bb2-8016-48c0-aeac-512c53580dee", "sighting--6361a6a4-c420-4b3a-aa87-59d55aa91ac5", "sighting--a3175988-c28d-481a-9735-1b285449bb57", "sighting--fbbbe15f-e26a-45df-be9e-7913125bf090", "sighting--81f27261-b1eb-46e0-9cb6-e3e9899566ab", "sighting--183ca026-4fea-4a83-a4f3-52822b55b4d6", "sighting--b22c60c1-df11-47d3-8d11-8db1698354e3", "sighting--ba930ed3-04c5-460e-8c51-97d381c40d8e", "sighting--4989042b-4538-4660-b12a-e76d9894f59c", "sighting--991e1da9-8192-4caa-b1e1-b90c08b82290", "sighting--cccecfe7-f5bf-4c28-86c4-9b107fc9952a", "sighting--182a92d6-ab17-4220-8164-6946331cb940", "sighting--ff1a8867-ad11-43ef-b4bd-f1f3e352abb2", "sighting--22b3d0ea-48e0-47eb-8f5b-3fe022bd4128", "sighting--a0a0f7b4-55be-4caa-a40a-a03a64a6fa60", "sighting--16392ddf-c75f-4cd8-9729-664e62544973", "sighting--9cdffa89-aac0-44a6-b886-6ef07a0ceee9", "sighting--1b5c7831-af41-4228-8e9a-cbfeadecd8b9", "sighting--09796b01-a638-4c4b-9f80-3494555db1e7", "sighting--2b40d819-773b-4195-b146-c997b275aeb6", "sighting--a9ee1906-3fcd-4f4c-871e-a319b7966da8", "sighting--dcb8e04a-2d46-4425-a1b8-3d64a25ee0fd", "sighting--93072375-4d95-48da-b578-0e983eac061f", "sighting--40bc84de-9768-47fa-9974-a17acf57451d", "sighting--460f76f0-29ff-4c07-8bbf-71ceb2d1703b", "sighting--a1fb16e0-0b20-4ebc-bcc1-9db28f686f5b", "sighting--94ed27d0-4c25-4a94-9cf5-10f1fd7ca3b4", "sighting--26e98793-a9c2-4c5f-ae23-ac51bb713b3a", "sighting--058002b2-fcd2-4403-bf71-4505eec5b6e2", "sighting--2eebfdf2-1bae-422f-b26a-9832f008344b", "sighting--24f1f5a3-3448-49d5-b8c9-15a6febfb97d", "sighting--88dbb4fc-a5d3-4065-a2fc-5b1ee7c94006", "sighting--ec946f69-9c40-44cf-84bc-ddb1d0c8c97d", "sighting--d775167b-1779-4a4d-9fbb-ae5e20158cfa", "sighting--548df24c-9328-4a88-bb54-9b051fee340c", "sighting--b6f421f5-83d9-4a6c-84a9-2a929064f14c", "sighting--17552960-6450-43c3-a80b-970dfa6beaaf", "sighting--87b4be6f-c100-45ac-9a5e-3643c9b76d13", "sighting--b28cafb8-a78e-4338-93a3-46b438d45a05", "sighting--2197693b-0656-41c1-9494-7066b33ee57c", "sighting--34d3d848-1b75-4977-9312-4a91bb1e5dc8", "sighting--5aa08a54-8789-4b03-9081-de56d2f6aae5", "sighting--6446964f-ba9a-4598-bb72-b67698acf700", "sighting--975791cc-d7db-43ac-8823-2f40cfd686ad", "sighting--11ad8514-af52-4eb8-84a0-0bfe643527b0", "sighting--d5ce5e73-8f70-4447-b1e0-b3c4e0a0f6dd", "sighting--1a0de617-20a8-475f-889b-ba806f56776a", "sighting--1b487e39-47e8-4d5c-a3a3-93d26be235cc", "sighting--b6952ce9-6e80-46b7-8e02-65dc6b91c907", "sighting--f67a37cf-effc-4de8-95da-af39a9ebd374", "sighting--7a01eaa9-31ba-448a-af8b-8f0f9b257986", "sighting--c00805e9-5ffc-484e-a24b-8cda2b3264c0", "sighting--ba6f280f-f598-4c1a-aa77-e21de05d309a", "sighting--e2cba03c-d990-421b-a953-aa029b1db485", "sighting--63de8a91-e5a1-475e-814b-7b9a00cf751f", "sighting--fdfa3e0b-22f2-4b0a-ab68-2a96d70632a9", "sighting--0acc346a-26ee-4d30-9378-499a9198cf37", "sighting--99f4f781-6de6-4822-9571-edd67752847a", "sighting--d2e9db7b-8532-4518-bb7d-cb2ded4d6f3f", "sighting--b032ebb2-6ce4-48d9-92fe-3313dd4517f1", "sighting--66512294-1f53-497f-9bab-84be05b3e9f1", "sighting--a3556f22-3864-426a-a159-f6001e4c269d", "sighting--de938d2a-1642-44ab-92be-6d92f2c8dd8b", "sighting--f18ef17e-49d4-4bad-b992-31dc5d5cf83b", "sighting--264fadb7-0fc2-424b-96f4-5a12d4d9ee52", "sighting--157d2c60-8132-4d38-abc3-8f102f105005", "sighting--a9280e04-5e96-45b5-b61f-a812de25c6bb", "sighting--49afcf7e-c781-4942-8db6-2b0badc76fc4", "sighting--f85c910a-1dae-4254-84d1-415196ffa344", "sighting--35b54dc7-0ef1-4fa3-b0a0-ab5af7f3e3c4", "sighting--cc182933-2bef-4ee2-8747-e692c63b7e5b", "sighting--1f007c8b-250e-4bed-bb68-3f3063b3c322", "sighting--b7816473-2a4f-4b96-9860-262550e558de", "sighting--679f3c4b-597d-4acd-8d82-5d1c9d8c85e1", "sighting--05200690-a97c-40e9-847c-e07988548af1", "sighting--1a1ff12f-eaf4-4eab-98fb-72b7f450d8dd", "sighting--ae8c8ea2-19d3-450e-8cb7-fda406941ea5", "sighting--978e4279-13ff-4d2f-b683-b27dabe7ec93", "sighting--7ff52609-e6ed-4fd7-b3f0-e28f0e6c2e21", "sighting--3cbe48d8-5997-4124-9d59-e9b53cbd8f57", "sighting--529e54fa-bd30-4355-a5b7-31c17e076af3", "sighting--fca7c0d0-dca7-4d48-a1a8-3b38d52df14b", "sighting--db2212a5-b5ee-44f0-8778-5008008aa8af", "sighting--19886df7-aa72-4674-8624-a10c3e679d5a", "sighting--2082ea79-1948-4cd3-9457-e1193071f51d", "sighting--77ca3ce0-6816-426d-a58f-5c6ec608523f", "sighting--0011cd34-06ea-4e0c-aaa3-aac556add1c5", "sighting--700a5137-d2dd-40ec-95fe-845db88a99fd", "sighting--a0a8a46e-b743-4e62-9d55-378bb2fca8c0", "sighting--539075d9-e0ea-4cb2-ac56-adb534d48fc1", "sighting--e977ebc7-4ed5-457b-9b6e-c517d2efb07f", "sighting--fe4622a8-abe0-4c71-aba6-fae87964764e", "sighting--0e82c9db-c48e-4472-9c99-93a3a35c13d7", "sighting--0c508ddd-b72f-4fbb-a946-dbbc289940ec", "sighting--655b1833-f6b9-4d3d-b7ae-4479dc7d64bd", "sighting--911679e3-7766-4f68-8cec-e3fe9d95ef3c", "sighting--00662e03-df6d-4144-89b2-b611c7d1177e", "sighting--7b259b03-b191-4507-8f71-2b05dfb6fe3c", "sighting--c5e03f0e-1aa3-40af-9cce-44b59820cce2", "sighting--230fdaa4-ad25-4974-ae87-eae5ef2fb4f1", "sighting--faa9a01c-0ff8-4ef0-afa4-48fc48bcb2e4", "sighting--39e27fbb-884d-4ee2-bef0-280f2524165b", "sighting--728577cd-68dc-47a4-92ba-4e8865e0ece2", "sighting--c8c589f5-9789-4af8-9d95-2b621ca04b6f", "sighting--1d704d9f-2e01-4ec7-9398-66075c002d98", "sighting--a6087fed-64b6-4ea9-9e33-ee9337011772", "sighting--1d17ba9f-74dc-4756-9f79-a7af858c9fec", "sighting--89bc9195-302c-44dc-bc7d-4a4da523e435", "sighting--11441104-6afc-4ba4-be4a-9383f4868024", "sighting--593a101e-644f-4880-afaf-96b169908deb", "sighting--726b4a59-90cb-4cef-aa6a-c5b60187ac12", "sighting--72fb67d2-6e84-4992-8d1b-4593e3cbbf6b", "sighting--e1fe62e5-7321-46a7-9eb5-b826f5048962", "sighting--acc86c72-86a0-40c0-8805-9f968444d70e", "sighting--2e06f1c4-a4c0-44f0-9372-5a814771951b", "sighting--cb897a9c-238d-4063-b3aa-075a5bc4c182", "sighting--95294d94-f203-4209-bd9b-5a5bf22c7d1f", "sighting--94e66835-44e2-4791-809c-898bc3a1f73e", "sighting--5d5a75ff-4670-43dd-9c2d-6866615db800", "sighting--4c3d58b3-7c4f-4255-8c78-47fd43407af8", "sighting--a56d1ba6-fd1f-4940-92e9-2ffeda050f33", "sighting--758d0110-d94d-4545-a679-82c5225fdc3c", "sighting--e9219f4b-d085-454c-856b-940bdc449272", "sighting--21e1dc0a-cd45-4d2b-92da-21304745371b", "sighting--8fa47df6-2815-49e4-aacc-377db1275d6f", "sighting--f4a8a4b2-1253-4092-8c64-ffd22379c357", "sighting--4e44d3c4-76df-4ca6-a69f-0ea6de7db23d", "sighting--2f40157d-e8af-43da-8a78-fa7cb492ba20", "sighting--bdb061ed-c618-49e7-bcb5-b330bc18f8bc", "sighting--43a9fc84-da10-4ac7-80d1-4216c972127c", "sighting--189dd891-a9bc-4491-9bb9-18a3182c4ce3", "sighting--9d52c4d5-3a4f-4a85-ba05-4d3db68b4817", "sighting--a80b3b69-1092-4ca8-9a67-8c0cce1faee7", "sighting--9d7fbdf7-646a-4645-8fbe-f905538e0bdf", "sighting--83668079-a2a9-47bc-9277-bab3a41d936f", "sighting--ee9ae59a-9216-4d21-9d61-4b604d3b6990", "sighting--9ba7a0d0-24a9-4cc9-86d0-4f4221d77833", "sighting--ea80d2b3-120d-4a41-ac7d-55f248fd73e8", "sighting--f07a8ab3-709a-43c5-a7a3-45f549b348c9", "sighting--141500f8-2686-4a1d-a62a-b334886ec4d9", "sighting--7374713e-2ecf-44fa-bc4c-cce273e528af", "sighting--9669a8e9-2835-483f-932c-57afbaa5a502", "sighting--f8cf77ef-0223-4d2b-8868-a64da372b5e5", "sighting--b98ff8be-3882-414c-8dbe-6f8523985225", "sighting--15c2de27-babb-4f24-bf91-74cb7d48f96a", "sighting--26573cbf-e788-4a2d-9e99-97e31a87c422", "sighting--a5013f70-93d3-445a-aeae-49ee3657f083", "sighting--71de260c-15de-41de-8b04-2bb6a60ec0fa", "sighting--6cc37e70-7a8d-42f4-b5aa-75e6a012996f", "sighting--76fba6ff-e791-4435-90ba-bd32931d3053", "sighting--f1f08d28-a9bc-4995-bac1-a08d9681ef5e", "sighting--1c2f6eaa-2292-422e-a1ca-0c66b1aeeef1", "sighting--60668291-30ce-470c-906a-1125a35d2971", "sighting--01b61377-b251-4a31-95de-16f152cec6e4", "sighting--21cc6d2b-7a8f-483d-a748-bb482f16a356", "sighting--7a88fe26-4416-4a76-828a-ad00299cef4d", "sighting--b0eee62c-8a4e-4c03-8a64-0d122c52a5be", "sighting--904332ee-5f17-4aa3-94be-b08b0a31d790", "sighting--2e1ad308-ebe6-4584-89c9-ea9f71e24c3a", "sighting--d02dacb0-818d-41e4-a6b8-e18a6a26fabf", "sighting--d8e679bf-0886-4bfb-8417-98fb1541b5e3", "sighting--40bfeb1f-359c-4b65-92c5-b62e7ba8c76b", "sighting--2fd1e02f-b8e1-4e9b-bae3-1f2067ad086c", "sighting--169248db-098a-4fbc-8db7-133852bbccce", "sighting--1cb193b7-81c2-49f0-97f5-cef0899672d4", "sighting--afd7b568-c490-45b8-9f65-f359a34b962d", "sighting--e347d9a8-cd14-40ca-a6ff-871205fdcdab", "sighting--032d5e67-8bb2-4853-bbe6-719daf3284e1", "sighting--e61fa999-374e-4708-acba-62b70a1037cd", "sighting--42ce651b-b185-472f-a1cb-ae811addf3cb", "sighting--7ce06b59-03d6-418c-bfd8-67b36254e58f", "sighting--ac24d9ac-e632-487e-b70f-b96fd1b6a7c9", "sighting--092e6b10-9532-4974-a4c5-e363cd4f5dde", "sighting--0e44179f-b246-4fbf-9be4-566429308ecd", "sighting--b08f665a-eb25-4c25-9d4e-f190727e920d", "sighting--80b52a1e-8b5b-4b28-bbd2-5dd3925f073d", "sighting--4fbcc577-be28-4dad-82bc-83fe8b749d73", "sighting--b4a78380-658e-45c6-aa19-4a0f2bb21f68", "sighting--075b94b7-c835-467c-b035-d138c0cd80d9", "sighting--bc072516-174d-430e-b039-dea3f581db2f", "sighting--46cf7a01-8fba-410b-ac65-79c87d4df1fb", "sighting--1cc37d7c-e690-415d-8463-33adeae4ceb1", "sighting--26e0b79d-0010-48f2-b8e4-a274b2ceacc2", "sighting--292890fa-4bf0-4a13-b6f4-c3de194e5205", "sighting--f3408a2d-594f-429e-9cf5-a4a3a09fc86b", "sighting--f39d3294-1ffb-45a3-89cd-2268044e0b61", "sighting--9d972fe4-cfe1-4ceb-935c-101d55129eb0", "sighting--28ee51aa-5a50-483c-b358-bde0321d6451", "sighting--2ddd015d-4354-4799-8808-437d30d5fcf4", "sighting--afa8a76a-592d-449f-9035-41c54b5ab730", "sighting--bb53f1a8-7979-4ad4-8910-21ec864bd1e9", "sighting--22dac117-0267-45a9-98ed-ba05bcb6ae54", "sighting--69803504-e213-4ae9-b220-dc6eaf6dc7a3", "sighting--9f63c4b8-c83e-47e9-85e2-d6dd47423239", "sighting--40d549dd-6117-409b-bb68-5b2436c224ba", "sighting--3b05f7b5-a8db-4a90-a943-8c51840c6a9a", "sighting--076b1f7d-3702-416e-b756-f6275b9efcc7", "sighting--d9bbf7f0-86fc-455d-a613-6b237dcd29db", "sighting--ddeeba27-9eae-4e8f-9c94-7f20bf269050", "sighting--4b1fa400-0078-447b-9e3a-8f4e0356fe45", "sighting--48a5f744-3a50-48aa-9883-1ab32cc55b90", "sighting--1aaae6cb-31ed-40a8-a1f4-6c4d49de1f28", "sighting--542ed6e5-b0ae-4b81-abb2-534924ab03cd", "sighting--cb64bbce-34cf-4920-8506-1787161e8ed9", "sighting--6013d5e0-f1e7-446c-b6a9-5dd4c4979992", "sighting--1543337e-8afc-49b2-9ade-b6e1cb77198d", "sighting--8d15f9e3-9226-4b00-a0b7-d9dbcbb57489", "sighting--acbc2e3f-7fba-4de1-bf48-7bf86218239b", "sighting--0b403870-769a-44a2-91a3-50a88cd13bb3", "sighting--1f52545f-bcda-4b8e-aba1-dc36cc9e919b", "sighting--e421af56-6bbe-4341-a67d-f732a875471d", "sighting--c6c02f68-854a-4887-8ed5-36240221d514", "sighting--cda68939-2d3e-48bd-b3ec-76ecf3344f2e", "sighting--5fd0544d-5383-473f-9cee-05304c7a2b62", "sighting--07bccb14-298b-4817-9d0b-eec338b41b0c", "sighting--ee364fe1-63ef-4956-9f75-3150a791d637", "sighting--ea3ca187-310a-4445-9bb6-2d9fb70ef9b1", "sighting--fae0e59a-7d6b-4bf4-90e5-7a31cc6b76c1", "sighting--c4a41ee1-2120-41e1-8814-4c2a340dd54f", "sighting--9434246b-7ada-4662-a1c5-5cdd0b93be17", "sighting--a2d67f4a-b8ff-4e33-b178-0079ccb60815", "sighting--f35205e7-67a4-45de-a04c-2060b4c90daf", "sighting--40404d83-28ad-4a9f-b77a-8530f83f51aa", "sighting--4b069c1c-39a6-45ea-a599-afa8f911b32f", "sighting--0dd5388f-6804-4020-aa86-79642c406607", "sighting--0164300a-50f4-430c-b2c8-37dd954dbcc1", "sighting--af3ed253-67f7-4569-b4ff-db4fb03195ea", "sighting--803d2b66-91c8-41b9-b9da-b7dac43b1de0", "sighting--a1f6ddea-efed-4f5b-af73-7b0f86b9199f", "sighting--1aede51e-68c2-48c4-ba70-3c1cc5daa01e", "sighting--13cdbddc-dc5d-4a45-9b6d-05cff0fab7a5", "sighting--9a306c02-4160-4d32-97ce-aadb88bd5aca", "sighting--24ecd019-a3b4-4200-a930-f4c74e42d2ca", "sighting--e85512fd-f2cc-4eff-8927-ff004db04166", "sighting--93841e83-8366-465a-8d46-8067693811d7", "sighting--a9a83339-268f-4a8f-8533-273881f4e2a1", "sighting--f1334ae9-3ade-4d18-be8a-88bb7cae29b5", "sighting--f4093f06-948b-498c-8509-1b2b534a337b", "sighting--b984acec-e66d-4668-a6f9-37bc4c3896e3", "sighting--d80f1a6e-e898-4fd7-8322-9a4eb3e0f616", "sighting--9383874b-7ff7-4570-a8d5-bdb40a36ddb4", "sighting--d07e0510-79fb-40cf-a5e3-43a4939d51b0", "sighting--0dea957c-d11e-4517-8860-508d8306bf98", "sighting--7872ff36-bcbc-4c56-8fa9-2cbb2ab06b60", "sighting--10656091-d8bd-442e-a779-1a6b2c79d01e", "sighting--025ca9c9-0b85-492b-8b45-52f8048222e0", "sighting--983e3b7d-505b-4bfd-b06a-b4794f549574", "sighting--d738c25e-86c3-4dc7-bce2-cf3a269acbc6", "sighting--dd529e9a-9b44-4b30-93ee-3ea51e60e7cc", "sighting--20ed2709-d948-4289-b97e-529a89623786", "sighting--9e835be6-bcda-44b7-8ef7-93ff2c85e881", "sighting--1668c154-48df-43a6-afc4-de213ab7b6b5", "sighting--c66fc5db-fd56-4457-b37e-f36c98d9d9de", "sighting--42ef0380-8768-4d41-aaec-d241880e8772", "sighting--97fe26f7-d14b-49dd-b3a8-bafe3ddf70cd", "sighting--48832049-98b4-4781-bb1e-aca733a46bfc", "sighting--237dfe1f-e4ae-4f17-b93f-b299340455ed", "sighting--2d0d2dab-af04-4e2d-8aef-4eb8a960384a", "sighting--5934c111-5a6d-4b46-9205-50f5029e78ee", "sighting--a886dff0-baaf-4135-9601-121a5cfb9053", "sighting--82bde848-2eb3-41b2-a773-43e021f5649f", "sighting--c057796c-fb5c-44ab-bbe1-803c96fe84f7", "sighting--f049fce0-842a-471c-abc1-f58077706c63", "sighting--d742df80-a6fb-4e71-8ebd-ef952c049fa9", "sighting--efc81575-1f84-467b-b8d7-ddbf9b191a54", "sighting--34f6e270-fbc0-4997-9a2b-cfd1f02278f5", "sighting--df66700c-ff16-4994-897c-fe615ab364cf", "sighting--59066236-7b11-46e5-af9c-b677d224fe1d", "sighting--0f3eaa72-b6bf-4568-b359-4c658b414a99", "sighting--b6208258-6574-4e25-88bd-650f9fa07f41", "sighting--054129f8-0a20-48d9-956f-1711ae64490d", "sighting--005be07f-5280-48e5-b49f-56d407e2cb2a", "sighting--c789ea84-585c-49f5-b4c6-fbc34cba08f5", "sighting--a81bcf29-decd-4ce3-b8a0-a2d7485f2c32", "sighting--10ce6ea4-9249-4acb-bc19-5afae812126e", "sighting--7d4619f5-d0ad-42bc-9b7a-00402b1f479a", "sighting--91580d92-61e0-4271-934d-ff2903a590f7", "sighting--c57eaf1a-636d-4130-8b0e-9a4f56171a06", "sighting--2331b951-911b-45bd-bfaa-b89a4daeae8d", "sighting--43de8471-bf11-4b09-93ab-7eb4c3698a95", "sighting--f6ac5bd6-6ef5-463f-b0a1-25fb2233350f", "sighting--08fda28e-2bbd-4b56-99ae-b9f399020d02", "sighting--10ebdd11-343a-4174-9077-9655438a9259", "sighting--591ffb4b-af3f-47ca-a107-954356b40d8f", "sighting--21633532-9948-4fc4-a6bb-3c6429a855db", "sighting--75057708-0918-4ac4-8b35-0f1162767b9c", "sighting--13753817-23eb-436c-8782-d3c229f71c9c", "sighting--613ed817-60ca-44b9-80e8-3c3c2e00b322", "sighting--f88d9462-34b6-4be7-a787-bf58a7b09845", "sighting--031c3150-8891-4ef2-9c1a-55432f3cc5aa", "sighting--1085d78f-0563-4e81-ad31-fbd9cad5bd36", "sighting--f2c76c2f-0553-4ec4-a697-5d7055616751", "sighting--50b471b3-2263-4bad-8528-1270340271f2", "sighting--f6824d55-6ada-454c-aa33-6b4ccd5162b3", "sighting--d597dc0e-ef2e-4eb4-9e57-2663abdc4e0b", "sighting--c5cfa775-d94f-462d-8dbc-873b28f9b3ac", "sighting--f88d5c50-0303-44c3-80d2-839a1a6214a4", "sighting--b3016f87-69d5-44a5-bdd9-d9eb59f7d70d", "sighting--b886eb64-cd1e-46a9-a85a-8881b71efcdf", "sighting--cf408f6d-a529-4af3-b75f-78510e4b3a1c", "sighting--3480eba4-526d-4d35-84a8-dcf972ce75b7", "sighting--21b609d9-49ae-4f7e-a780-b6be8ed22400", "sighting--700d317a-376f-4b57-8b69-0fd309a78ddf", "sighting--8c3e72c7-2fbd-48dc-ae2d-ce52f7808226", "sighting--7f4ce07b-fb49-45e3-b59d-0c61db71e1e9", "sighting--4a6e8245-b181-4c21-8176-36e3c2caefef", "sighting--1acc9c2b-55de-498e-90b1-952723b6be97", "sighting--aaae56fd-f6fb-4c7a-aa0f-d113fa3e6b5e", "sighting--60939402-6e12-42ff-b971-49baf2ab6e40", "sighting--a6a3a51c-f13b-44e9-a1b1-9de18af4b9a6", "sighting--67b5591f-fb8b-4110-810b-8cb6f770274b", "sighting--d9cc342b-b100-44c7-b558-c220455596ac", "sighting--4c5b7ea5-677b-4081-9dd4-4b855f93548b", "sighting--6f2107bf-4314-416f-a96c-029647cf2567", "sighting--b899108d-cc32-4852-8caa-ebff10bc5f5a", "sighting--861f5dc9-5083-4a6c-9102-63d3b4dabfc1", "sighting--3313d17e-b90b-49f3-a0d9-339b0d5ae68f", "sighting--00a36608-4860-49a7-9f92-7454b310d92a", "sighting--17f652c0-b7e3-4bb2-a909-8f603a6e62d4", "sighting--347d2429-1571-4886-abd2-ffe131988199", "sighting--022e660b-8879-4bd5-a52f-a35ef635dfcd", "sighting--d7b68506-a9fe-4263-a43f-4bde8f190a8c", "sighting--b5d423db-b817-47bd-892b-dc76b795c051", "sighting--c78d3488-f1ae-473d-8732-5dd35abdb0b5", "sighting--d43c173d-a7d9-4fb4-a7cc-0e8d0f8259b0", "sighting--55c76433-7a98-4fb3-b9b4-c225aa48c25d", "sighting--218a8438-7267-4946-9e84-f7d887032a2a", "sighting--e535e381-4364-414c-ab69-bb00b96ec3d0", "sighting--e18de8ab-cc74-4748-bc91-b08eca4ce827", "sighting--9033f664-579c-43d9-81c5-187ec775d3b1", "sighting--c54b5d3a-ef44-4d4d-a009-d4b4dc2fabc8", "sighting--d55864e6-f427-4896-ba66-12f399c99d2d", "sighting--87f1956a-8338-4e27-99e9-22041470aa62", "sighting--9847a7e5-13b4-4d20-8e85-7ac67ef3fa4c", "sighting--f60e415a-3a87-45af-a0f2-b580c391f6a4", "sighting--1c11ab9f-3027-4fce-bfc9-6857422707f1", "sighting--44307ea5-6eae-4190-a783-22322f5b3d1d", "sighting--24ef1974-cff0-4ba5-815a-a024e27dc781", "sighting--85fb9207-f040-4109-a80b-5dfb2a862f04", "sighting--c42b7f34-ded7-4c3c-8760-43a2adea00c7", "sighting--462e8fac-59b0-4f7e-bdd8-4401b74815cb", "sighting--48f445d8-70e7-4f71-9d93-57eab78557cf", "sighting--69a3cf05-c4ad-47d3-8686-1b47b2f7d760", "sighting--59328ab4-36ae-4d6f-8c3c-395bc086fdb0", "sighting--9d6663d0-3892-480b-842d-981b63ae5463", "sighting--25f73507-fa4e-434c-9c43-d91aae8c21d3", "sighting--a084ef65-c221-4c1d-b02e-8a14af2ebfec", "sighting--af58dfa1-45ff-469c-9054-69c6bc3238b3", "sighting--edb5e007-3986-4b0b-ab91-7706254af4d2", "sighting--aba56bb4-ffeb-4e90-8e7d-c7fef85a9903", "sighting--98a1abd9-9597-477f-bcb9-53ccea0aff71", "sighting--e5afe7b7-fc08-443d-84ab-75e9961dfa98", "sighting--4cf1d5a7-3666-4419-a4cf-10cfd7bf829d", "sighting--64e2c919-979b-4e2e-a512-f16f6924fc6a", "sighting--9e4689e3-480a-43fc-9b2f-624651cb834a", "sighting--c0f6c17e-1750-4575-9837-ff4b512f9db1", "sighting--93cdaf40-c9c1-4f8d-8be1-bfcf19680c62", "sighting--ac090e44-1e16-494a-9b48-9af3423b2d19", "sighting--30a8d22b-9f0c-4c44-a00c-d04e39c79403", "sighting--d307923c-d6b1-4ccd-8761-4d7d068db9ce", "sighting--b2608a36-74c7-4413-a240-7d83800cdaad", "sighting--d835e402-205f-472a-b448-361f251d075e", "sighting--9f2a97ad-ef4a-484b-899f-30720c36596c", "sighting--27ec689d-8fe3-404c-ac75-6541a46a339d", "sighting--81ec5b5a-594c-4726-9166-e2f98fd0cc2a", "sighting--3a8f958a-7d2c-40fd-8e2a-6fe317d49bd3", "sighting--282c0e53-dee1-4a0e-94c3-c7a9f6e67fb8", "sighting--190dfe2c-b57c-4222-87a1-7eb56219adb0", "sighting--34b2994c-723a-4fd5-bac1-6a2198dd1402", "sighting--c5b9fda1-8dc4-4a68-b9eb-0fb8a5c9d243", "sighting--73cfb855-a59a-46df-97dc-2e4711b9413b", "sighting--86b071c0-7471-49fe-826a-e49b01ac8529", "sighting--10b03079-bbef-44a6-9525-7e2f5668d85e", "sighting--eaf25da3-1bb4-47c5-acaf-67c76b5ad27a", "sighting--62002876-ebcf-4bed-8cab-6bcce65de7ed", "sighting--ca3bb404-6aa3-454c-97e6-79f104e170ce", "sighting--78d397f6-f16f-4d41-b6c5-b2b669169da6", "sighting--4697c87c-2b9d-4449-8f1d-1124ef00c91b", "sighting--4d4d27e2-882f-4b89-8a5d-7a668dc5799e", "sighting--f9ca4454-0dfa-4ea4-b713-04de76a95746", "sighting--555d46b5-3625-4eb9-bac7-04b23d6571d9", "sighting--ab6cc8df-1385-41d6-b7d1-4ce538eeb42f", "sighting--40074192-39f4-41b9-a9bd-b230823cea30", "sighting--9cbe7f55-9abc-4bed-8c5b-92113f478aff", "sighting--e86c2095-2859-4548-a109-254dec03f9b7", "sighting--e772d93b-44da-41c9-900d-967b343e24d3", "sighting--36297711-ac3f-438e-99a4-4319b2fa3f28", "sighting--f1ee9bb8-82cb-44b9-9844-2ab6d1a03305", "sighting--286fc099-f0bd-4de9-8732-67cc98c55db5", "sighting--02b1508b-651d-42bf-aa15-b8512c059d67", "sighting--7b61a798-3998-4e6d-8abc-7500e8973ed1", "sighting--66b7a041-85b9-4d33-ae97-8d794bc2cc4c", "sighting--56d45802-bd17-4ef6-94bf-0dc176f37f87", "sighting--0f63aeb5-9722-4a9d-8f43-92abec84dfd7", "sighting--f4c14d64-3778-4a20-bf31-9b34f0e7f0a0", "sighting--d1ff620d-0c77-42bf-8fae-105f8c0f7858", "sighting--15fc1c64-00f6-4e05-8a22-166e927340cc", "sighting--6a1d256d-aa8f-415f-a3e3-6cdc6402c7cc", "sighting--532c4ec9-db85-4eb7-b35f-21e76b477cec", "sighting--f8e2d6bf-d5e2-4c24-9ebd-c73ca0f3f1f9", "sighting--395b6582-3a03-4d72-bf92-9d2a19f5229c", "sighting--e2656df8-67a1-46e6-9a5d-1f32ae55e974", "sighting--484b00a3-b1dd-47bb-8ea1-910b23ced477", "sighting--fb6da4dc-7b6b-4343-bd6e-6f7972c7278b", "sighting--0205c22b-ee59-47c8-b8bf-49db5d334974", "sighting--d2579148-89be-4fdc-8b67-0b32a1232c23", "sighting--f206a488-8e01-465b-8613-7919c5005f28", "sighting--d2e0211b-d9e8-4391-a06a-783466570e67", "sighting--29fd0c72-3bd6-4c7d-82d1-2d4923c9dca4", "sighting--3c6237a5-7322-4fcd-8f5d-d9a8751cce0e", "sighting--3fba8c3c-f0cc-4f36-9588-f07c3a6c4a3b", "sighting--3fbebc6b-8236-4231-9fe5-7413f7bdc58f", "sighting--ff2da577-10c0-4719-b74c-851d37755cbc", "sighting--09f678f7-1b96-4fb8-adcd-2ee4f4dd3a25", "sighting--4fc3f55e-51e6-4424-af8e-39de5cc87486", "sighting--2cbe3dd5-ee96-46f3-bdfe-73f37b49f057", "sighting--6ad17c92-9b6f-42fa-b420-7ab408a51322", "sighting--51373df7-eb1f-439f-8fa9-c07bed6f0e27", "sighting--f65dd4a0-250b-491b-bd03-c6ecf258bfe5", "sighting--ff68be92-3ff2-487f-8892-495a49dfd171", "sighting--99d531ac-41ca-4023-b1a3-28f30f6a1b47", "sighting--a181a824-bbdc-4d53-8961-d0ba6744a0e3", "sighting--0619c317-60cb-4c65-a221-a4eee965dd09", "sighting--c9c08155-9113-47e0-a046-6a62a2e61fb5", "sighting--98d3f7ef-9b90-4483-8c7e-d271cfcc84a1", "sighting--13132135-8b2b-460a-b9e4-445132c66f5c", "sighting--334be486-3cd5-4110-b047-7e5d8932de1a", "sighting--a5d914a9-1986-4884-9ff4-a911ba105230", "sighting--ab0da7eb-f7a2-469b-8dd4-6a34e7fb6c5c", "sighting--3b7bd914-062d-41e3-9dcf-ffb634ebbd03", "sighting--c23a8cd8-d0dd-41c4-97c4-d4880e040934", "sighting--4c829ac5-58d7-46af-8451-87a6a8d60059", "sighting--c5b375f5-73d4-46a1-bce1-123a02fdd4dd", "sighting--1af046de-dce9-4918-b3bc-6a8756901132", "sighting--c5ac6b8f-050f-46a2-be6c-8224e285a8c6", "sighting--7eb5dd69-12f2-4445-bdd9-d3166183033f", "sighting--67a2827d-976f-4909-bca4-448ae0494672", "sighting--8e1e74c4-2c46-430c-b13e-4e7b0c1440ef", "sighting--d50ff549-7e14-4138-bb14-306cfb5deb20", "sighting--aa27b091-0758-44e4-8f19-cb3912ee7659", "sighting--83ce7769-2756-4e91-af08-56dccdba3293", "sighting--6a7d26f8-3382-46d6-8cd1-9e7ee2b0ed5c", "sighting--628df037-52f1-464c-acaf-2e05791d425b", "sighting--8a093c0d-ac8a-4693-8868-bd34a94e1957", "sighting--9cbf7059-cbbb-428c-a5d3-2c7a1c47f814", "sighting--bb2bd953-523d-4f1d-8fb3-59247cd38b35", "sighting--7509af0b-abfe-4e98-910a-faeac6fb7489", "sighting--a8362c58-d09f-48a3-8cfd-33a1c338f8a9", "sighting--aec17cd9-8260-4f65-830e-59d44b2494ab", "sighting--c428b030-4027-498a-8c3f-0cc773ba3f37", "sighting--2d0cf1cb-b37c-45bc-bcce-e2379140f383", "sighting--566c58b5-06ae-4a3c-910e-a7d72daa928d", "sighting--77a28f73-41ce-43b3-8f57-d87bfdd4eb81", "sighting--a2cfd445-4bc3-4a85-96a0-b5a24b1b5737", "sighting--a340b095-50ef-47de-82ef-8b025f07a849", "sighting--9c4b2362-7a25-4c64-98c0-53fefa80c4ad", "sighting--625d0e61-cdf0-4fad-b702-aac92a580879", "sighting--de575f5a-3adf-419f-b850-82db1802ec3d", "sighting--ad16b8ea-7352-47fd-9f91-1505568475ba", "sighting--217416c0-06ef-4af5-b415-7e564ca9d67a", "sighting--fec3a095-ef2d-40a0-abc4-118d65124641", "sighting--0fe3b69b-0bf7-4cee-bdce-4615eacc772f", "sighting--086f0a17-3111-4b75-9332-1adbde11ab4c", "sighting--f9a5bb13-9ca9-401a-b722-52e243b7e063", "sighting--33001aa9-ce9f-4657-b6d4-c7e46c76cacb", "sighting--148d24ae-d10c-4a88-9a7a-6ade48d4d286", "sighting--d7527798-3f65-4f4e-8b1a-b65173de9116", "sighting--25288a16-b60e-44e6-b2ab-a529c9e73e75", "sighting--2d7e7631-0eef-40de-8cd4-a2c850218e7d", "sighting--b3bab1e3-7f7a-46bf-b668-91c4679e7593", "sighting--8efa8c75-fcc6-44a3-a2a4-35bfdabe1984", "sighting--98a5056b-fb5c-44e4-9e48-3824f6616532", "sighting--1e1fae75-f7d2-4c33-8170-0a8c441ef843", "sighting--afc137a9-21af-4d85-ae1a-d7edeebfc328", "sighting--e2a101fe-2674-4bc7-a82b-7d0d40a40ab3", "sighting--4461922c-193a-43a1-a4f2-e50f2932868e", "sighting--e671322d-3bdc-4651-90e7-78ec0b4516d5", "sighting--5c7ce91c-8ae1-4985-8f66-b52f1c23e699", "sighting--c3ebd502-7909-48c2-a6f8-5c8084e788d7", "sighting--ea63da11-3698-41ec-8bb0-a62f61cf985f", "sighting--4fcf5fef-ac2c-44e1-94e5-559aad13b7af", "sighting--991eb47f-b4e0-4770-8e5a-e2b80ef239c0", "sighting--89c4e741-3322-4def-98c5-b79f19a37271", "sighting--b461e7b2-41b7-41b4-a224-e129184c5f5a", "sighting--72681bdd-0313-4f61-89e7-7494f9bd8039", "sighting--60af88c7-d0f3-45ab-8b24-b3ff3950c2de", "sighting--3d1a58de-09f8-47f5-94c1-5b7e57918bd5", "sighting--89a9ed94-b53c-4836-8e71-de0d10e856b6", "sighting--9bd56af7-e466-4aef-8ae9-d0183da704b5", "sighting--18ae7d8e-d6b2-4554-bbfe-113c23b44c26", "sighting--a981517d-209a-4829-a41f-2d46eff9dc65", "sighting--d7073f6a-04b0-4462-99b7-54aae9ffe9df", "sighting--c3557bbb-745d-4586-8586-4d89d8a701c3", "sighting--8e060867-3fd3-4991-af26-045d57e65b2a", "sighting--d5854075-5e86-4435-93f1-25a086290c79", "sighting--9f0bad1f-4ceb-4d25-ac84-2f1892dfbce4", "sighting--36820443-084e-4141-9ab2-ced28a9a3c75", "sighting--5fabbf62-1ff0-4e76-9ac9-773ebd5d2d43", "sighting--5ede7431-da75-4d5c-ac58-c8f32bfc73f5", "sighting--826c8b3a-5bf5-4dac-992e-d98ca15a3dc7", "sighting--0ced67f7-1b03-44a2-a5bf-688abcb5754d", "sighting--ea14455c-0097-43bd-abcd-23d546b4f15c", "sighting--f8ae0484-aae9-4e95-b77f-855c0bfcc2c6", "sighting--3993954b-8043-4abf-bef0-d28265ce5f58", "sighting--c05cc018-1f5d-4dc7-a91a-243a589322ec", "sighting--e9bf65b1-54f6-43c8-82fa-aaf0e8794bce", "sighting--07be0045-6d79-4077-8cf0-6974137f8b96", "sighting--ada16d77-f126-454a-8ba1-aa66559e2c94", "sighting--69600a49-250f-4827-969d-6765bc54549a", "sighting--d23f0128-9ef2-4fc0-9f3a-5360f0437c5e", "sighting--b197ecf6-d2dd-42f4-a2d4-b3d403455d85", "sighting--fdea0764-ce1d-4b8e-945e-ba993e765bfe", "sighting--ca41735c-3f74-4f94-b691-9d5998c9a8dc", "sighting--fc6cd52a-f6f8-40fb-bc9f-f98c73cea98c", "sighting--4bee3b2d-a817-46eb-9489-bf31fcb884ef", "sighting--83d8940c-318a-4b25-b948-bd02047e7708", "sighting--fb589b2a-b778-4a48-9d53-8c59b5f40923", "sighting--0364f19c-91b1-49eb-8e96-bc8fd0c69f00", "sighting--44e78a01-8f98-4079-a43a-c84aff6d141e", "sighting--53104053-7502-4f2c-ace1-be545f3dfe8e", "sighting--1a025cb6-086e-4896-bbcb-4df278540caf", "sighting--169795cd-f8bc-4a4b-a550-0e11c850d0f6", "sighting--e56338dc-ad86-46ee-9174-bed34bd3db5c", "sighting--7d0ff3d9-ed4e-4516-8602-edb7298f5a7f", "sighting--df763373-e885-4756-a01d-89e38afac9fb", "sighting--b5159c87-8d6c-4413-a228-91bacbec04ef", "sighting--72a4b3e9-0f0d-4d60-b302-d8583e13f7db", "sighting--a31ee64d-ef6e-4704-935a-35e602d732d3", "sighting--e962125f-8e1d-4e1d-ad6a-f0cafadb52a3", "sighting--a63b70f4-9208-4791-a14e-c2f1e5d5ff9e", "sighting--87993c6e-4627-498a-b4d6-2980b6850260", "sighting--aece4173-d95e-4198-8480-bfcb2724b10d", "sighting--72f45b0d-9466-401e-a700-eac0ca505fb0", "sighting--3e006845-bbab-4620-be51-4df3d4083987", "sighting--047fef79-c234-43af-97c9-80800b179842", "sighting--d31791a4-6983-492b-9b83-5fe80153b45a", "sighting--abf1ea71-b0cf-4d5e-8a4d-57b636866153", "sighting--60bd5734-88ec-45a9-9c64-1f63112a51a8", "sighting--e15e404c-732e-4afb-b065-9fc03353bda8", "sighting--fbe2b228-bd8a-4020-a0c0-1137b0aa18ea", "sighting--f83d1704-b79c-4e75-903a-9d362e918006", "sighting--3b4276f1-a1c0-4ba5-b19f-db0b65659943", "sighting--6fbea4b7-5586-4c03-aba0-1a6ce3ccd4ec", "sighting--ab4bc317-f5bf-4712-942f-572b394ab54c", "sighting--a213c85c-f047-4a02-b6ee-c8b6b3ea15a8", "sighting--c4d0125c-e43c-4931-8719-fa99dd50b7e4", "sighting--1956320d-6912-4460-b5e1-217777a35a7b", "sighting--7f658ad5-a63b-496b-a0f6-52555bb274d4", "sighting--7cdb8bd2-953e-43fa-bab6-9a953838aa50", "sighting--28c34c4b-ba0d-46d2-9da7-b7497a328def", "sighting--83c87687-c6c7-40b0-b5d0-706c74145485", "sighting--2392fbea-7f86-4053-9af1-663bed31164a", "sighting--7d9c0aea-0c31-4541-bb67-4cedd9c2a374", "sighting--3acc0c1b-5a86-42aa-97a2-23b7ee55ee19", "sighting--f2b6227e-25d4-494c-83b3-08c7e840e694", "sighting--23e5d8cd-0e96-451f-a34b-92fc52e7d01b", "sighting--c72668ea-5bcb-4415-9cb5-7960c6b321dd", "sighting--795ee12a-a728-4d26-88e9-aa25ab02aa03", "sighting--e56226b8-d937-426f-a82e-fd4b227e63ad", "sighting--150e7669-9e18-4b2a-80ad-2808a0dfc40c", "sighting--1b7c91c8-2dee-463a-b60a-8a611dcaa516", "sighting--cb97e89a-547e-4c40-83a0-8911d8983c7f", "sighting--32a899c6-035f-44c3-9492-42661f0638d1", "sighting--ae2c9d17-7fc4-4b6c-8dee-9754081ab8d6", "sighting--80a96316-5008-498e-ab3d-d35b10001313", "sighting--4d79fe22-c3f8-48a1-8418-4d2c4c793354", "sighting--b2d1142f-5817-44e0-920a-7ca4e47945c9", "sighting--96c61ffe-dd33-4c82-bc79-65919928aa77", "sighting--2aa64945-c3ad-4cf5-b1bd-89d4c2bc62a0", "sighting--91277aa8-af5d-45bb-ae61-dadd9242ef22", "sighting--c55b1e6d-46f8-47cd-91b0-67ee965494dd", "sighting--50de8b54-883b-4584-94ba-1b66ebf963a0", "sighting--2961f7d8-d8d0-4adb-8362-c0b54c1c1895", "sighting--7320dc7b-94e9-4bee-853b-cedc0573a8f1", "sighting--7919b18d-2df6-4ff7-a044-b8563cbe73eb", "sighting--eac9386d-b151-450b-a721-98113dd169e6", "sighting--e693b0d7-9221-4a5d-8088-e9fa6cb83842", "sighting--4a01174d-4431-4e07-b846-4caad8b836fb", "sighting--79ee2447-3048-4a05-8e2b-27322fc32960", "sighting--c955b94b-c920-4c34-a44a-73c281e2e53f", "sighting--dc448e7c-2759-4ff0-8752-fc4a2c4a489f", "sighting--3c7ea7e6-7acb-456f-9539-4c5bd5b44a7a", "sighting--272b4102-bd35-4d7d-9559-efc90685aa0a", "sighting--5507dc55-33f9-4f8f-bd22-fe3e272bb422", "sighting--0c9ac7ff-ae7f-4b3c-9d87-2c1d0fb25c4b", "sighting--57aa903d-8684-4160-ba76-d408d6e247c2", "sighting--701efe97-4919-47ae-a188-7b243c7f253f", "sighting--2d05e097-fb41-4107-b4a6-78662fc0a9ea", "sighting--5f9a585a-fb36-44b7-abee-05e46a85efc7", "sighting--910b7847-c726-4aa7-b904-34dfb3ecb00c", "sighting--6abdaac8-ecba-4c72-bba8-9014621217c8", "sighting--0fe03fbb-9d6e-4473-9cfa-989df7806239", "sighting--3deee054-27f5-471e-b785-7b7850dde3d8", "sighting--6a065629-c234-4011-8bce-91aa6c0caa75", "sighting--78fc4085-7478-4636-9c84-6b7e6b8e7ae5", "sighting--a990fb39-eeb7-4292-951b-c51255509615", "sighting--8330ac0c-ca0e-4edf-9a39-8850e8597d2e", "sighting--6ce20990-9938-4b77-a642-699f4c337c7a", "sighting--8eb63ebd-2582-4479-9344-d027d1183ac8", "sighting--4c0d976f-669e-4bda-ba8b-072570cda785", "sighting--f8e35db3-56c9-4098-9ec7-237203de1e5a", "sighting--751dedab-2424-48d3-bd5e-ab2ee8fcadbf", "sighting--811cbd1c-d004-45c9-8048-debf713d2c7c", "sighting--e23f39f6-85f3-4115-8a47-dc1cf4505f9f", "sighting--6de4cc8e-843d-4e62-8c48-617d5865aaaa", "sighting--5fcfd7ea-6021-4ddd-9976-b03c0c9a35cc", "sighting--9e0efe17-7d9b-4c55-9879-a698cd8131c3", "sighting--3af41f3e-6757-47c1-8d8f-2c7d688a23ff", "sighting--c6f91dbd-fbc6-4c46-8924-c80649b93236", "sighting--c74e2806-5592-4c0e-9863-ac6c299d062b", "sighting--a6a92bfe-1e6c-4330-bbe6-e8cf89973ba5", "sighting--095ea51b-19a0-4253-9f5e-33cf680fc697", "sighting--15c5f247-4a69-4f8e-bd61-dba482c7ec8a", "sighting--98ff089b-2095-4475-ab92-85207ed45437", "sighting--a6b9534b-46f7-4bf1-afec-2c1b3cb8edcd", "sighting--6b59b765-aab3-43bd-893e-fa1138d033d8", "sighting--316f6caf-df5d-4029-b674-fbc4a2332fc2", "sighting--bd9b2a94-32b7-4212-8e6f-ff62e2c86fb0", "sighting--ba9b3dea-554f-439a-9271-a45887394525", "sighting--7190d8a9-fb8f-485e-a59d-edd2f0a4f4c4", "sighting--aa4da99a-b74a-414d-8667-97af1cc5f0a8", "sighting--5e944a07-b6f2-4bc7-998e-cabe458cbf88", "sighting--75b4f248-e260-4b51-82bd-67d46e4a20ff", "sighting--40702865-c170-4dd0-94f1-c563bf3d4635", "sighting--1dceb418-ff8d-4b94-82a6-3c8c8132478d", "sighting--60eb8e77-37c1-42da-93ec-e5e7e839fb3a", "sighting--9d0f2f25-8831-4edb-8735-37715815eb2c", "sighting--569dd71d-9d61-4fda-bf8e-7ad1aff625a6", "sighting--93cac700-b294-4056-834d-28afecde649d", "sighting--41e179d7-413c-4158-960c-a89d4a0c86dc", "sighting--a1eacbdf-0ec4-480d-8641-16ab82693335", "sighting--987331c6-77ab-4cb7-b522-e994e7d78f65", "sighting--680f39e3-018c-48d2-95c0-99ff9908f623", "sighting--69f7e2b3-dc23-42a2-bbc9-d3a9634c2a3a", "sighting--dc9d83af-3a8f-4253-870e-4119fa169f30", "sighting--8261ca4f-dca5-4615-a4a4-e5bfb3069d50", "sighting--17ed6966-9548-482f-9a1a-88016ca7e722", "sighting--f9964541-1b72-4575-91f0-08b7988216ab", "sighting--2eb8a9cc-96c0-4ccc-bd06-fb8ed9d3ae4c", "sighting--0c721f0b-5ebd-43ff-b2c0-df355be4bc5e", "sighting--7df12e67-41f6-4b75-be90-4ea4e13cefc0", "sighting--9fcfd9c7-2073-453c-bb37-940176a27db6", "sighting--34eca604-c526-4677-8aee-2cb483e571c6", "sighting--c68245e2-5d74-4fe3-8582-2d75c7d011c1", "sighting--f8638f31-8f85-4e42-8804-0c6ef2c30d10", "sighting--812864ad-2fa5-4d1a-a3f8-c2f7099c323b", "sighting--eac62e1d-8218-44b2-b3e6-b905ff5bde73", "sighting--44dbb043-9b8a-4e0c-b9cd-c4ef542f3af4", "sighting--a667271f-bc94-49f3-abde-0869c218a2ac", "sighting--72b9807d-38d2-4f4b-a0ab-ab2d441ae2ab", "sighting--35557c70-4d87-4eeb-b5f1-f8757b8cb1f5", "sighting--2d7bbef5-988e-4609-bea5-37356a67aa61", "sighting--8360bbc4-e0a2-4580-a4d9-46ed06ddc945", "sighting--1723fd52-eca1-4bad-8e90-063da5eb569b", "sighting--492e790a-018c-432a-b55b-1389deb694ef", "sighting--1f28340b-609e-47e0-8abc-cf032f48cd47", "sighting--b8f5d6ad-0a83-4b63-a9ff-5313be9c33c1", "sighting--bd90d520-0fac-4b11-b6c9-97d0a19e5aff", "sighting--f90ae27b-ec47-4239-8d64-d2ef05761b63", "sighting--7e814265-61a3-46a6-95be-3a82bed7293c", "sighting--094bd62d-583c-4815-b134-1d9c64e37f12", "sighting--80d1c086-5ac8-49cb-97b6-53cb231b1e8b", "sighting--2f4d6adb-8ed0-4d26-99aa-f4f46b0820f2", "sighting--994ef608-37bf-4d7e-a907-97074f9d9efc", "sighting--91535682-bdf3-47b0-90b6-c59c6bca6089", "sighting--70e123e1-aa5d-49f0-8428-8449e2fc55a0", "sighting--e4041c6b-4353-466a-ba5f-9c3ff7675b94", "sighting--9dcd0ddf-87b1-4a85-9203-48691aaa267a", "sighting--ac09927b-b133-4ce9-a78a-f8daf526a3dd", "sighting--0997cd4e-c1f6-425f-9e4b-a7a39b550c84", "sighting--1fbdf3f0-9cc1-4b15-8d51-d9dae9b49c14", "sighting--84dba381-5662-41cb-8f0f-85668e6cc183", "sighting--76f29f62-f36b-4e89-b7eb-283c7c092f1f", "sighting--32bd1784-086c-471c-9155-cd4fe8b4bea4", "sighting--83e3ca21-a26b-4841-aa20-e998c51b034b", "sighting--3b160b67-1540-4689-b65f-f02dd33fbfe9", "sighting--26961d56-73c7-4dbe-b0f1-38a6c01f6d48", "sighting--34bfb67a-a009-4cf4-a181-19f36ec75dc3", "sighting--f4021320-16a9-4f36-ae1d-9975943b4db0", "sighting--32a2ab5b-3744-4e5b-a2ce-5f406deae44e", "sighting--76669f6a-5876-42d1-b916-91ee95f6297e", "sighting--06b303b7-c895-4cb4-95b4-e5c3a37a1aad", "sighting--33774f2b-bb10-431d-9626-3ea4f6ad7936", "sighting--053e7721-a1f7-4b6e-b404-55c8c7fa5991", "sighting--56d66ac4-ceb7-44ad-a0ff-ce48dd536339", "sighting--fb1f72ca-295f-4695-98d9-ae66df66a779", "sighting--0f74a7c0-0f0c-49ca-bb34-b2f1254e7df4", "sighting--06ebcdc9-cc8d-4541-a2a1-f4c24b4d0a95", "sighting--8cfa11b3-5e95-47df-b490-048291fea5a5", "sighting--d6bd95aa-f6d6-4ee6-9525-8f07c08d06ca", "sighting--7fc8c0dd-f76f-4e60-b2db-c652f0ce2b1a", "sighting--81183058-4452-4b66-94cf-2bdc935ff497", "sighting--045f2194-f16c-4a94-85f0-b40d56bae6bf", "sighting--e36db0f4-357e-4ffe-addd-3b06646ce3e1", "sighting--0a59e3b1-20e0-4b78-8472-0c397c905245", "sighting--e03a3f53-d404-4126-a44d-977341a1297b", "sighting--aca2c431-383a-4bd8-a0e5-5fe490f275d4", "sighting--700bc35c-bca8-4f0f-a73d-4f08230023b9", "sighting--e9d52f61-9eb6-47d4-af17-683ad5b44c9a", "sighting--7e6b689e-7b66-4c2e-8325-0e468b0d600e", "sighting--06b46d65-c9e6-42b4-8223-05567ad9e69e", "sighting--58a0ffac-b71d-47b0-958c-76adaea90959", "sighting--5e1b585c-e7d7-411c-b93e-3dca58c9f9eb", "sighting--3f2828a4-baa1-464c-82a2-740efe968afc", "sighting--f1bcbb30-d2dc-4377-98d2-49136360e401", "sighting--ecc7a52d-a6ca-4a54-8008-4b82487cdaeb", "sighting--f67c9bbc-583c-4ce8-9a79-a67f386e8cb2", "sighting--e66e9602-2625-4aa7-b792-99d074a85bd3", "sighting--46b1ecb0-3ef5-440f-a4f8-3ad44c6f0225", "sighting--9d19b2a0-4693-49b9-9619-0315e0db4b23", "sighting--36f2afc9-2472-432c-8b4f-1b87945762f4", "sighting--ef526d51-feb8-48c2-b7d8-648b1e64dfed", "sighting--b67fee83-ca60-4870-bac2-d5ebc4bc3652", "sighting--51d57d30-fb31-459b-979c-57747bd6698f", "sighting--7c66495e-6826-478e-b211-0a3db44325cd", "sighting--f408a30f-992d-404a-8ff9-a0d779378ff2", "sighting--645fb831-59da-4fea-9300-b051000c079d", "sighting--9d6d227a-6543-41a3-afb4-8835c533a842", "sighting--ce5b5222-f819-4b44-a6ae-9ba94367c4b3", "sighting--de83f7da-70fe-462e-89c9-cb6de35e5214", "sighting--6da246fe-0afb-434b-8317-611d2737a71b", "sighting--b9455801-a6c9-4279-979e-1bbc71393ab1", "sighting--9aac195d-ba7e-44b2-98a0-c76891786400", "sighting--beb21edc-ff46-4beb-a846-eec2607e2781", "sighting--d5486511-3778-49b3-abd1-83889d2ad771", "sighting--2c4043f2-86ba-4103-bfb2-2d04ed2ab700", "sighting--df028cbb-2b84-4d26-8008-18eb26586d2e", "sighting--0c86308b-a523-4f2b-9bb2-80308fa80684", "sighting--16e66676-7ad4-44c8-81d8-5f88fae270de", "sighting--a9bf825c-0b58-4102-b57f-4330a51eaa22", "sighting--41e304c8-e1d2-4efe-a1a5-6a4298bc9a1d", "sighting--2fef3e45-0a9b-4b20-ab69-5ece2614c9b9", "sighting--8f4c3077-f07e-4fa4-83e9-a3ea01fd4f4a", "sighting--c4710cb1-3c5a-4aae-8c5a-2a5b0dbc3b0c", "sighting--0cd520af-9190-488d-a0df-d64f7b4d7b78", "sighting--9f343ae9-2768-4456-8ab2-d1fa4a2f3344", "sighting--fdacea96-4455-4c16-96f3-6794f8371cc3", "sighting--9e5811c1-a4d3-4c5a-a004-97978b0f7fd4", "sighting--4c1450c9-8c8b-4d56-b0a9-1e69850f5ef5", "sighting--e9d2a470-185e-4c3e-8f1a-0707d74b6461", "sighting--b88a7f4f-df10-4d95-806a-989f7788b19b", "sighting--d12ff81d-8d86-46b0-9c46-d18b76566bd0", "sighting--3f0c68f0-db3d-46d8-9642-132395c7a6c0", "sighting--571ce107-ea22-4b06-8172-f5e8c0e29d00", "sighting--3a10cb1e-fadc-4d3b-af83-d86b21d4c469", "sighting--dfcb0369-811a-486a-8caf-d4b340d1588d", "sighting--da7695a5-94b8-43a2-80fa-2b9c25e2cc4e", "sighting--fc29e222-31c3-4fd6-8877-c43a2a67d403", "sighting--53f3068f-77e5-4232-bab4-7b4a5c2b9ac3", "sighting--6b9bc485-5757-4d34-8359-46036aac0b61", "sighting--96b7262f-9c6f-45b7-896a-3cad62452e5b", "sighting--2877240d-9b8f-43c5-9edc-37a282530883", "sighting--aada2797-7b09-46ba-ba58-839849633835", "sighting--1ad94a5d-60b1-49b8-af99-240b8c07f3fc", "sighting--e70d9d16-995e-4695-bd82-8e6d7b4a7c7c", "sighting--6d01ce1e-00fb-469d-aeb0-6d8fa411ce63", "sighting--8bdeb461-a8bc-4842-9302-b10a9da94994", "sighting--3d037550-1d5d-491c-902b-1e6eed45494b", "sighting--903a8207-f39f-4754-b962-5ffceec65ce3", "sighting--3a6219a7-b0a8-44a7-b4d1-48015e4e07d7", "sighting--4c4bd68b-f186-47ad-a78a-69d16271505e", "sighting--22f79bf5-38f6-449b-8f70-4e3fea50ffa9", "sighting--2f815a78-4f35-4bda-8328-c02297bc94a4", "sighting--67428b20-d32c-4c9d-a91f-3826ad83919e", "sighting--5c2723d2-2385-4f34-94f5-0918a86b83a2", "sighting--9e9a50a1-73ad-440d-91c5-6f406f7911dc", "sighting--99596793-71a2-4fbe-948b-b7a1cc64e47d", "sighting--0ceea588-4518-4b53-af59-21bb2804bade", "sighting--39a50b53-57be-449a-871d-258eef3a0338", "sighting--d4f0bc9d-2b2c-4d26-80de-407a85ed9700", "sighting--51f0421a-acf4-4ee3-9055-ca11fc86b086", "sighting--6e5c9c05-7e92-49b0-8652-6e06852669dd", "sighting--857eb209-d5db-401a-a574-3c9ab171dcc8", "sighting--16c93408-bca6-4722-acaf-229883ee91bb", "sighting--8c825930-e320-440d-aab8-b6e03d45da7b", "sighting--1a3ab2e7-6334-48fb-b2da-7e386842b4e9", "sighting--c425744e-a63e-4285-aa0a-fa354731a9ab", "sighting--c80a34af-1692-46e3-ac5d-0edfefa7249b", "sighting--4e3dd69b-63a8-4ab6-875c-13378b84cc9c", "sighting--7441bdd6-c763-4818-99dc-4a3aad3fee0c", "sighting--00977010-002a-4b20-86c7-73cc4aaee66c", "sighting--500e3bd4-2b30-46f2-a1ad-32ce19931335", "sighting--2c0c48fe-5b6e-4530-8804-c7d67e3e8832", "sighting--7bf8df00-2efd-4860-a1f8-11072133ab23", "sighting--18197f10-109f-4d6a-8999-fc5d904d00eb", "sighting--3f9a456c-99b2-49e2-b6f0-1609e4d85f25", "sighting--44e67e64-6f2d-4e91-932d-4614f241ab27", "sighting--838926ca-fcbb-4158-b356-60e3cea0cc5b", "sighting--ced618f7-a22a-403d-9792-52f0d200d63f", "sighting--de17c0a0-4f5c-43c9-8e7b-b45253bdef1a", "sighting--dab5c8f2-6c2e-4abe-8f2b-fe60f58354f9", "sighting--b9790ef9-c2c8-441e-ab59-02fffd7cae7e", "sighting--a7302e92-df96-442e-a0f8-497d007a8fc2", "sighting--477af0bd-74f1-4c66-98f8-16f46b5a63e6", "sighting--5ef0fa5c-bebe-4935-aa1e-6437865d8c24", "sighting--0b074221-20e8-4b76-84a6-301aecccc50a", "sighting--30f6cfe6-2ae0-4e02-b549-ae6b4d6ffddb", "sighting--b3dc713a-463d-489f-8990-0aa01e6a86b8", "sighting--e9202f7e-8402-463e-b5e4-7306a5d1ef9c", "sighting--bdb61170-eb0e-4e8d-8475-e5c929de0ea3", "sighting--e3aa541a-5740-499f-8fbd-bbce22775285", "sighting--b2ac3867-58de-4e1f-a4aa-ecafacb2dad1", "sighting--ef237258-c725-4477-8c83-02cb5a4aebd6", "sighting--c33c54a2-cb54-46ec-b188-da5e38658ff5", "sighting--c80320c9-5032-47ac-9eec-8ced1fc9b18f", "sighting--b3b20cf6-0246-40f8-ba96-861133f502f9", "sighting--863a19fd-db90-4e58-842f-d5d54da152c4", "sighting--af527b5e-075c-49df-b866-5fba9c88a732", "sighting--9e023cb9-3209-447a-bb87-85e884fd6a97", "sighting--2994e646-9ceb-4bdd-9795-c1aa48c8e838", "sighting--b85a4f19-7b08-46d4-adf0-3c7fa42a1c47", "sighting--de48d91f-42d6-4464-a899-230f19719820", "sighting--7d8fe65d-e526-4d16-a796-07ef2d18774c", "sighting--dc642eab-9425-4a99-8a8a-4492664c11f8", "sighting--0e28f72b-e036-431b-9018-e4e8c20167d0", "sighting--6fa2b3c9-fbd7-4d8d-b271-59b488bcf680", "sighting--9eba2f11-64c3-43a0-a5fb-3ecf7e7e0d11", "sighting--e7c0f0a2-384f-43ff-b578-1027362eb964", "sighting--5fe13bd0-46ba-4ed0-ba45-79e82b10a103", "sighting--89bad109-80a6-4035-b3af-15e132cafdca", "sighting--afea54c3-a3f3-4734-b7af-9f6b5dd1a970", "sighting--34091099-0f86-4f07-8e6a-b2f3cd778f3a", "sighting--f041244e-4714-4283-8c68-fede08888403", "sighting--f32e371e-b76c-463b-8943-7b0768a63d14", "sighting--214a6548-bfe7-4181-bb7f-75b5c4ddc9cb", "sighting--c552c47c-a395-4ef5-bdd8-c366184edbcd", "sighting--6786eb1d-4b35-4348-9bd6-049016075def", "sighting--d0ffab76-3134-4b7d-8808-1e4083c1fded", "sighting--f138b7f4-d8d8-43e8-9c24-d8855a919748", "sighting--9c99c1ac-c4a9-4552-b91d-f3ea67bcf3c7", "sighting--b95228dc-58a5-4a20-ad16-7c3edd4edabe", "sighting--8a720bc0-2381-4894-9807-77ab55c2513f", "sighting--e33d8aad-e53e-46f4-ad24-254971e43c52", "sighting--7155c388-39ce-4bb9-9649-cc1288af0c93", "sighting--bb73c727-5a62-4332-9f34-f195302abe5e", "sighting--61b5c03a-9f11-4558-b25d-71c1b68ea5cd", "sighting--893ab32e-1ca3-4d11-90f6-366e8e9eeabe", "sighting--4f8d2d69-a131-49a8-85a7-e3a09c337e1d", "sighting--f35a1f59-32a9-41c2-95ff-ff6f8e0b24c8", "sighting--a4204776-7f8f-4dc8-8e65-2dd8974a3227", "sighting--6e351280-23aa-4c24-9b66-953eae5cb22a", "sighting--2837e512-b5fb-4583-a3ec-cce31285ae1d", "sighting--e1bf1884-d521-4aed-ac6b-297cb0e0f61a", "sighting--77f5a9e6-9fd1-461b-98bd-23aa22998686", "sighting--819d7007-3620-4fb2-80b4-ea9d125c0eaf", "sighting--8b37a1dd-141b-4f10-8918-dce4f316224a", "sighting--0c0c17ae-ddaf-4388-bba8-8717444a0419", "sighting--977c4ebd-1d1e-4af5-b3c5-29b513781842", "sighting--dcf9ce72-4526-419c-9605-1ef9d2353633", "sighting--3c53fb13-9cc9-411f-aae0-a3f8ede3b740", "sighting--e5c9a9f4-53b6-4148-bdee-303b1e4f1aec", "sighting--ff8788be-3614-478c-9bd7-b67dac7d9343", "sighting--57f6392a-e7c8-47e6-8c85-ffdecad58c34", "sighting--e9e0730c-d379-4771-8c35-86b1a91c29dd", "sighting--b0416d04-c5fb-416b-b21a-a79027982aa6", "sighting--e46927f0-6e3b-4fa7-85f9-c8e2ec680465", "sighting--6b6f24ce-72cf-4bb5-ab8a-1d9df36c5162", "sighting--f1c37705-01b7-4b63-ab97-10f6f5229f2d", "sighting--a3a1dc66-d01d-4598-9dd3-69d6f19b5604", "sighting--e0d860ec-bd8e-400e-ac73-dcbbf10b8db5", "sighting--f68cb390-fbfc-4f31-9e0c-053dac5c7c89", "sighting--e21d0a63-9dee-4a45-8f72-0d2717dd0a94", "sighting--47aee909-fe3c-4801-a28e-018d398c8342", "sighting--be7dea6b-a42f-4878-a396-3230810fe6cb", "sighting--d7c7e90d-39e3-4341-9a26-dc6ea9ce5229", "sighting--5349f190-d486-46fb-8575-59a674c2743f", "sighting--360c8e01-5e53-4c51-adaa-20f5ad1f1cd2", "sighting--8ae84b91-5f81-4003-9640-4312cb969895", "sighting--92b41005-2528-4b8e-9a5f-066475cb5951", "sighting--592d9d44-4050-4ebd-8888-f15f5a6f314d", "sighting--2f90d9b6-3f24-4d98-8c2e-d3e737350fdd", "sighting--2ede2b4c-635b-4450-b4e2-c523e373d946", "sighting--ab66cb6e-0eb6-468a-b448-f05a3c4a034a", "sighting--c5a21ff7-34ac-41ba-8846-571be3d0995b", "sighting--fcf873c4-64c4-4b2a-bc43-6de9d6dfae99", "sighting--affe0bd3-6997-4c93-87c7-2b8153ea292a", "sighting--28e2de14-5a6a-4206-8472-560a2514cfa0", "sighting--0320469c-c0f8-4f50-9e48-c7e1e02409ea", "sighting--bb3038d0-a9d7-4646-be2d-03d284092fc5", "sighting--af63f3c4-78ae-458e-af88-5520b2f1f158", "sighting--bb17c3d0-26ed-4a8a-b22d-7298651f50f4", "sighting--2665a607-0e0f-4645-a690-e24fbf9c981a", "sighting--fb857bba-0896-4dc1-8070-f6288e633f2b", "sighting--fe39e8ea-a05f-4ae4-ae99-620d3cd40f3a", "sighting--9e321e02-6c2e-45e3-bd03-e1c9e20535ba", "sighting--85dd14ad-5acb-476f-9462-afb407ee0e35", "sighting--921e75d5-841d-4743-b7db-ac99105a7f82", "sighting--93707098-221c-4ffb-bc96-7b5810e5e958", "sighting--20069db3-6dd9-4e05-9540-2f7c8cb0a1dc", "sighting--bb979868-c9c5-440e-96cf-9bbe414d1828", "sighting--77e1e272-d004-42ec-bf45-19bad49d3a83", "sighting--5d8e295b-1b3d-4ebb-9432-b3ae4e30bda6", "sighting--d169cc44-a44d-49bb-89f6-8169500ca8f5", "sighting--1edd01e8-0863-43f1-b700-b7bdf02e14c7", "sighting--8bc2d567-cfad-4ae8-bc2e-b8be65d2eec7", "sighting--96d2d27d-84cf-42a9-87cc-0e13b66373d9", "sighting--2a46f2fe-9bee-4aa3-a605-b1e4551e730a", "sighting--514738f8-e82a-4ca2-8e37-a8bcdbcc60b4", "sighting--046ab4f4-ede4-4f36-95b2-368fe44501fb", "sighting--f8e57405-1bd4-4398-acbd-98bcfd708ec0", "sighting--f543cbed-8a43-4d36-88bd-8f27f96dccd5", "sighting--eacb6622-bd8b-4396-a980-6096a7d3aedc", "sighting--48b807a8-defb-43ed-81ca-9ee9ea5fd297", "sighting--38a7d587-707a-42e4-a6e7-836cbad843dc", "sighting--4b3a4304-d8c1-4421-8483-c84d026cfca9", "sighting--fada95a7-3c9f-4635-94b3-5a833a6d1cf0", "sighting--1e38d5e3-2c03-42b6-bf3c-d00c309e0bef", "sighting--e9449ba1-0e29-4273-9e1c-60747d376709", "sighting--10c20e2a-2aa8-44fa-b1f5-eedb86abed27", "sighting--ce665935-be35-4c1c-aa37-825db4e7ed7f", "sighting--801122d9-c448-465a-bb16-8858656376d6", "sighting--70ac1495-9356-4a63-87f5-6575d7fdf954", "sighting--0e09aab0-a788-4817-954b-498923578ea3", "sighting--72330cf8-eec0-4431-bd3d-dbe5d002f053", "sighting--996e9663-c044-4652-bf49-b92e45069692", "sighting--7146687b-d1dd-47d1-94b7-5004870667fa", "sighting--ff484c98-f7e8-4d6f-b783-a370924bb9cc", "sighting--d43c420f-8534-469d-bbec-7c28255d6e6f", "sighting--4dbf8f44-2cc4-4d4c-b490-dab2b7783dc7", "sighting--8de3fd55-7629-4615-8afe-d56dbf2c7bee", "sighting--445ddff7-cebe-4663-8616-6415325e9cdf", "sighting--97ff8e0c-fed8-440e-b4d0-fdd9a6bda887", "sighting--8ae7d1a1-3a41-42ca-9eb1-605827ee8c21", "sighting--689bb66c-bce6-4311-afdf-fccd84e1507d", "sighting--de38c333-0615-4833-b2a4-2702b469342c", "sighting--a7704478-5c32-45a2-9141-5572f053f251", "sighting--7c4b3f2e-99e8-467e-bda4-3b7bebe21354", "sighting--5adf459f-362d-4f97-a4a1-65090faddda2", "sighting--ddc51306-1e93-42cc-a0d5-d428689c0771", "sighting--9d5ee734-f211-4fff-8bda-0e6399da5dbf", "sighting--7155bb59-fd65-4a47-b1fc-5715412e5e64", "sighting--865055ec-102a-436d-9be8-426857a18e99", "sighting--60163848-c966-4004-82aa-81d3eea80d3c", "sighting--cffde0c1-cbd0-4c39-aa5b-b6bf630cbd43", "sighting--e851ef9d-f069-4d8d-b18a-1df66ca81519", "sighting--743ff05f-bd69-4ea2-a5c5-65accb932502", "sighting--79723950-6563-450a-a04d-0078f61dc617", "sighting--b4585142-20e2-48b6-beaf-ec6c02f19d0f", "sighting--1733df94-a236-4d49-aaa7-b4966ed96699", "sighting--5d33a32a-dabb-4cca-a076-775509fabe9c", "sighting--f90360ac-1f67-40d9-927c-aa409098b898", "sighting--f2ac048f-0c49-40cd-8bcb-0146331a96bc", "sighting--9c3faab5-64f0-4db9-a93b-312b382d74eb", "sighting--2e6b47ee-d537-46ef-a2cc-c6a9d4d6ed1b", "sighting--1e38aaa5-5485-454c-bb5a-f769f55f4afc", "sighting--ee47e478-b770-423f-8fcc-dbef68731a1e", "sighting--7ad7a9ab-2356-454e-9b60-3de7bb33be80", "sighting--4222dc36-2e57-4a5f-9582-440497be5a46", "sighting--52b15cc6-fd3d-4e8e-bfc6-94d99a829dcf", "sighting--64bef259-d1b6-4cf1-85d2-80775d0fca7a", "sighting--4ff4533d-281d-48f6-8638-25e401da9db5", "sighting--644ba6f0-4fe0-49e1-bb80-be4331bbcf93", "sighting--b5d7f6bd-4349-4d35-84fa-603e0cb90b0b", "sighting--0612a79b-a276-4438-8fd0-0b16635d3a83", "sighting--8dbac683-81d7-4d39-aef4-cd43441b9c4b", "sighting--edcaeb75-c167-4f94-8bff-52ac76efb6dd", "sighting--aae6ba2e-c2eb-4018-88f8-7dd2fcd05d9f", "sighting--0f950913-7694-4991-8afd-31eb657f93e5", "sighting--d506208a-5154-4486-a3ee-49bf839162c7", "sighting--bc6cd63e-1282-4bea-8e0b-200d71473446", "sighting--d3aaa0a9-d003-4af8-830e-e81d0ae83d5d", "sighting--0ac427a7-a0ac-4296-bcc4-f71e4f208170", "sighting--8f01a2a6-cfca-462c-be69-92fa66b07bcb", "sighting--03cd9852-ce3d-4d45-89a7-3b23b93cb1cd", "sighting--9fe4fc1e-a668-49cb-b721-0ac0320a8c83", "sighting--a98614ae-fd55-411b-9d79-3489f714df41", "sighting--7d4e63e6-bab7-46de-b3ec-e5ad62b0b54c", "sighting--bd69411f-ee99-4995-965e-9e31d89d9fd7", "sighting--8deef07a-9595-4798-9fff-ee1b0473b68d", "sighting--d9d41bac-b5fd-4a2f-b29b-340c2afa2b26", "sighting--b0489d47-9992-48c8-98e9-05efc0f511c6", "sighting--4cff12f4-8fb0-416b-991d-005817c7e1cc", "sighting--0db491d0-2086-44a4-973f-8f675d6c2574", "sighting--8cede1ec-78c7-468c-8265-f28451adb84d", "sighting--f96fcb5e-5bfe-421d-81f7-7ef25ef9dc44", "sighting--f109ab25-e706-4bfe-ae4a-43d317e9720e", "sighting--aad06a2b-0ce7-4ada-8013-c3af79ad8f87", "sighting--468263cb-29c8-4dfd-90cc-52824d11f5b0", "sighting--c814b180-88a9-49c5-a49d-d0e7754b6a19", "sighting--ccf7b246-f5a3-4496-9bc4-063d215049a6", "sighting--fcc52c23-de5e-4823-aa7f-c29f7583b705", "sighting--c93f283c-cfec-41be-8d00-54d91de51986", "sighting--b060b2bb-5155-4e59-b277-7d1e7c46cd3c", "sighting--d1a9dfcc-64ea-47a1-8f0b-1059798235ea", "sighting--de1515be-1dab-4dcb-a8e8-fbbc459fdf97", "sighting--0393522f-9ce2-452d-a9fd-7526b25d09fe", "sighting--e200b7cd-3e11-4ce8-9cb0-352d16665dbc", "sighting--1e1c836d-1695-49f9-8ead-3136329494a7", "sighting--64c27345-fa73-4dbc-93ca-6ce689c55eaa", "sighting--cc1c100e-2bb5-4050-a037-db92af366ad3", "sighting--ac617155-b6c7-4bb6-b180-a3fcc3b15168", "sighting--ec6e461e-6a4c-4ceb-b121-1b9352b2c816", "sighting--25cf1bd6-f336-4150-84e0-99dd45c7df3b", "sighting--817e983c-5b27-470e-9097-d036875845ae", "sighting--3c037c9c-044c-48ef-b386-4f24134951e3", "sighting--4406fb56-925d-4d08-a9f0-8d45847e6864", "sighting--44f56408-4800-40d3-9f46-026f9617e399", "sighting--2d53f429-d72a-4601-a3fd-5084dbff08e2", "sighting--2dee82a0-0afe-4299-a89e-a1abf24391e0", "sighting--ac10d165-5666-4b5f-afa2-a054945b4ebc", "sighting--34e76be3-10e4-43b5-a0d3-79cf1e8cceda", "sighting--d4b1789a-fd71-4ebb-bc77-b832604db541", "sighting--c0cd9c01-9064-40b9-bb18-6401fe15b609", "sighting--c0225444-03fb-46ce-90b0-5086590a005e", "sighting--095e0ec3-a86b-4c8f-ab2b-9c472a3968a9", "sighting--5e1166c9-9b7d-4992-858e-909979127b9d", "sighting--367c3f77-e992-4766-98a9-071178943146", "sighting--68dd52e4-04cb-4203-9d78-fdb594aadd5f", "sighting--0a60c5d1-2bd0-4bb9-ba8e-2f3ab89bfebf", "sighting--00bc17ff-369a-42c4-b682-54f69c0a4b52", "sighting--b3a74ce7-4bbc-4f66-9c9c-840c46c7795e", "sighting--201f6761-f871-4435-85b2-9c05fd01cd80", "sighting--fc78ba4a-9985-4b84-beec-0601cdcff0d6", "sighting--eb597ce8-f15c-4b23-9386-2bcfc0e9cfb0", "sighting--de1746c4-5456-4483-a93f-095542d36fa7", "sighting--d5a0d357-6596-444f-ac44-c1c66f4f9a79", "sighting--6494aefd-8161-415d-9ee0-dd0c66d6d4cd", "sighting--580e9610-8dd7-4137-9583-afc1b45171cf", "sighting--c235e101-408c-4e73-9bb1-db1239d81df8", "sighting--32008197-15a4-4677-b953-5e7dec19ec1a", "sighting--eb956382-3582-4a9c-a9a5-d73f4670fa0f", "sighting--7873a22f-dd07-496c-8a52-3a6ced98d07f", "sighting--d13defbb-655a-4e56-b12d-5827cad77ece", "sighting--8196341f-b309-4bfc-8348-d179c5a8ce92", "sighting--f38c3b18-8014-4682-9554-3acf65ef1fb0", "sighting--6e141226-840b-407d-8c30-0eb32ccefd8a", "sighting--994d654f-027e-4ce8-b483-0c9d5369af22", "sighting--b8ccd4d9-26d6-4493-9ce2-80557ea5ab6f", "sighting--be2d2852-5b90-40b3-bcf5-3572d96ea5af", "sighting--9af54f6f-c386-4058-98c9-ed9ed36c21ac", "sighting--020ecd44-2fd4-40d8-9d65-803e862a2d97", "sighting--1e0f1188-5e86-461b-b492-5ff8d4feb745", "sighting--8e27af17-75dc-4b58-981c-c16019c8bb3b", "sighting--8d3c35aa-0bdc-4896-a801-0f6cad3b3770", "sighting--718c96ee-048b-48be-a90e-c9ce4e31fbd9", "sighting--08162b87-98e4-407c-acb3-9237f000371b", "sighting--9077a935-c4c4-4d69-b1aa-dbaf9513ce92", "sighting--7168a39a-ff89-44a6-b182-b6c65e6530ba", "sighting--ef87217e-1372-4381-9955-f2788b1f012c", "sighting--72f5e03a-080b-42fb-ac19-e04bfbce87de", "sighting--b51d81b3-4d10-49f1-8470-e6b46ef48e7c", "sighting--96826c64-a978-4822-b2b8-236f9cf1474d", "sighting--b364f5f1-05ee-4a5d-a391-59cc1d86f451", "sighting--85f5ef4b-5764-42f9-b3d3-ea1990e159f6", "sighting--3d19c1c3-f0fd-40e2-ac69-d35e1a8dc37f", "sighting--a261f35a-a83b-418c-857e-02f9808f10c6", "sighting--cdd171a2-5da7-4961-bddc-a0f8a5e0e419", "sighting--9d66765d-08fb-4903-801b-dac7cf499b36", "sighting--992c33b6-b414-4293-bd2d-18fd4328756c", "sighting--9963bc68-860d-4458-a979-60047653cf4d", "sighting--ab5b0352-8158-400c-bc3c-9e8bac0ee7f5", "sighting--edea1abc-420a-41bf-8885-4f75ebe4b1a0", "sighting--4f6781d4-77e8-436e-b4ab-6d5c97e888ce", "sighting--d9d8312c-06ff-4681-8093-d4f91f272423", "sighting--e4c6f858-f13b-441d-ae79-afac75697dff", "sighting--eefca877-0728-4270-b577-7eca8224db48", "sighting--743d8a3f-fc0d-478a-97bd-d35fcd7371ec", "sighting--d5657b35-e187-4038-b24d-7e0750e27e20", "sighting--cf93f520-6b68-46b4-b4cb-d06952d448bc", "sighting--d007c871-f257-4d61-8d1f-66ef919c836a", "sighting--e283298c-0a4b-474c-98af-8c8bf22e8b35", "sighting--f2b0dfb9-257e-4ed8-ba83-f0d0a366a1c7", "sighting--4102399b-5737-4b0c-975a-eacc812fc7de", "sighting--40463fa1-267b-41f2-8c9e-36b619f0b3b8", "sighting--4907e44b-0f49-4671-b681-62a5f654043b", "sighting--125b76e3-f177-46af-84f8-f4ac1e738464", "sighting--e6966085-e65f-4e6d-a433-3769beae0fd6", "sighting--a33698fa-be62-42c4-b493-7b3d1ffa9b3f", "sighting--0cc6eafb-4e12-4786-a4e6-e02bb1553712", "sighting--df064e0c-636f-461e-9751-fbe06a76a207", "sighting--39ac2a4d-d9fc-42ed-baee-8b03ed995fe7", "sighting--a07a0304-e34d-46de-96e5-987f1722cc45", "sighting--67b17986-909d-4f98-bc4b-05305ff7ccd1", "sighting--7b9ddd61-5ff0-43ce-acfd-9314eda8fbaa", "sighting--de1a7c5e-8794-446a-bec9-8a73b72fb125", "sighting--4449f6b5-b5b9-4f60-b20e-09a3b7325a10", "sighting--e4a3ef5b-74ab-4ea5-b6d0-d60b1474fdd2", "sighting--2f89a6c6-57f8-461d-85f5-bd21683a3702", "sighting--88e85cb1-df35-4a78-a3cf-d4fa75223e07", "sighting--a4bfee34-dd20-4ef6-b450-f94fd688d0dc", "sighting--d6083477-19af-46a2-b5ec-1a4e2140034d", "sighting--df8b9a52-be43-44af-938e-3f0f86166f1b", "sighting--e404267b-eb01-4900-9d36-014e0cc1d180", "sighting--ce08dbf6-13fe-4acc-bf75-6ff44e2d7829", "sighting--9662b53b-fc7c-427a-ac12-ca7d0705dc2a", "sighting--b284aa46-0245-49a0-8653-d85e7a781927", "sighting--c1ff0488-d86d-4170-8b92-0d01f273f9bd", "sighting--fbd534d6-558e-49d3-890e-4787bb21e76a", "sighting--89d7fe8b-77b2-4c55-80d1-18c31b051d65", "sighting--fc311211-a687-46e2-b858-28b0b37a23dd", "sighting--b7c68f3d-c685-4a0a-958c-51fd496c0509", "sighting--b044967a-18da-42b7-b9a9-2a29dde4255a", "sighting--0c9cbcad-71fb-4898-a6f4-e4a2de315542", "sighting--943a3105-0515-4988-8671-17cc20408f93", "sighting--46bd8c2f-ca9f-40ae-a769-2eeaff0330e0", "sighting--aee83c08-f38f-414d-9e03-fc397bb51498", "sighting--a0f93314-1279-4fc6-8054-0af1c4c61cf8", "sighting--41c482a3-7110-47d9-899f-af73d07bbc9d", "sighting--069d827c-4a1f-43d8-ab8d-c8da67ce3acb", "sighting--4c662ccb-cfa7-453b-9bd8-0f172889fc02", "sighting--93ce89d6-fa01-4543-9eb0-7281b7fa8832", "sighting--5bc2a898-0329-420b-99d5-e76e3f02b307", "sighting--ad0ea037-e6dd-4e30-b602-99ba4a7eccde", "sighting--b775fe24-f8a6-453e-a71b-ea01be25846f", "sighting--9857642a-52ec-45dd-9607-e053aa7eba1f", "sighting--a0891a25-defa-49c5-9bb3-795fa3d37b6f", "sighting--5ade1f91-f691-42eb-a92c-5d19f3ed6627", "sighting--14db70cf-be27-46d9-91a7-6f76d6c73709", "sighting--06593194-c2ad-4141-84ca-382dae50e2d3", "sighting--c826d254-d9c8-4c57-9dcb-b0363ab16e60", "sighting--f6b1e22e-79d2-42e8-a28a-3dcc025a5d51", "sighting--cdd6b875-5092-4d86-a52d-9f0055e138b8", "sighting--f8ce9b7f-b90a-4172-a014-6e2f05dfba43", "sighting--7b5286c1-f431-4cd1-b722-934244888435", "sighting--bf9fab6c-4b18-4dd4-afcb-c165c502b672", "sighting--c6475cb2-b758-4ffa-897c-3181cd505749", "sighting--700e79b9-c0ef-4c26-8248-9bcca4c9d38d", "sighting--32c031e6-41f1-49bf-b578-4b9e3399b1cc", "sighting--35afe410-8c5a-4330-a046-a1ef9cece5bf", "sighting--c6ec9e86-3a42-4ad4-9a08-c999de17b274", "sighting--3ee507ee-0cfb-40f8-a728-bae78ef9709f", "sighting--4f55a55d-cd8f-4c27-9ae7-2fc552629460", "sighting--a7a631c4-b22f-478f-a334-a6ae978bb00b", "sighting--ab544e74-2a5a-4c33-bb6c-dbae176e3dc3", "sighting--78af64c9-f7b4-4bb2-9837-64bc8c21a5d3", "sighting--2ba18bad-a7c0-4c22-ac0b-75008be28162", "sighting--0e86099a-aab3-48f2-bc2c-54a0aecd97f5", "sighting--28929442-e5c7-4d8e-80df-bfd6a12eff9f", "sighting--093d6b37-162f-4561-9c0c-cd5945db512a", "sighting--49fb4747-1042-4a08-882f-c4bc4d9a1315", "sighting--a3c72de4-e7f4-4fd9-9003-f565839cabe4", "sighting--cca679d0-8ea8-4783-8488-42039baf4186", "sighting--7e509d1a-2605-4f57-bc0b-024d4b83db8f", "sighting--eadd16a8-c90e-41ff-81f9-df18fa01cb3c", "sighting--675e613a-07be-4afb-a672-b1c602c371fb", "sighting--15992ca0-e57a-4180-b236-b4576722a456", "sighting--b953f32a-2ba6-4cd4-8b8e-c7c6660899d4", "sighting--53c3d527-a0d6-4247-a8ff-f515eb1ba6a1", "sighting--a985b417-ce33-46ed-8a97-6a841ebb3f72", "sighting--4ceb9604-4caf-45b0-aac5-6d15eb598ec6", "sighting--049b6930-e701-46c8-8970-993dd9ccf666", "sighting--64e5f0a9-8160-48df-9692-95a5c38f6129", "sighting--d3568f5d-aff1-42bd-8641-5fa7ca633370", "sighting--9b54319e-de7c-4d9b-9bc4-459435f2cee0", "sighting--5c8edf56-2f44-4c84-aa03-14fae29d9f9c", "sighting--318fba8d-2b37-4960-8493-91006ce64197", "sighting--443d2570-a40a-4300-a766-3fdaf45b6f86", "sighting--1aec67a3-2022-4a69-8641-b367ba4ab9b2", "sighting--ab55afb5-b0e8-46f3-890b-bd5aebf9aa6f", "sighting--ef3e7690-254e-4f5b-8724-fcf6adda560a", "sighting--1dbfc791-bbcc-45b5-80f2-40189d08a819", "sighting--53edf65e-89d7-45dc-94a9-d81a27582c65", "sighting--9470cc77-e3f9-4729-8f86-c6539a61ebdc", "sighting--6f7985c4-3ff8-42d5-a7dd-cef30aca4c8e", "sighting--c2663d3e-06e9-4952-8bf7-e14032845da2", "sighting--11fa482e-2943-488d-8029-971193caeffc", "sighting--77381b0a-2189-493a-8005-92927ce7746a", "sighting--ba398aa8-695c-4fc8-8a19-6d247e619f42", "sighting--f43504f3-627d-4e9c-81f3-084fbd8b797d", "sighting--aa2159ae-9202-447d-bab0-f8cc7e787a34", "sighting--24eca0f0-0709-4044-bae7-2f55ff6dd9e3", "sighting--0ebeade7-0c5b-4a2b-b141-1e301658602a", "sighting--0a8cbd42-dd02-4439-9e2d-84e88ec91d5d", "sighting--d2aa2394-b934-4d73-ba58-5e30b48fa4b5", "sighting--de242963-5d3e-4643-ab46-d695d823791c", "sighting--e2cc1efb-bff8-4332-aa17-020e8450b1ba", "sighting--1fb0b526-280c-45d0-a0f8-1f2e8204a019", "sighting--e8531bc8-ff39-49ae-95da-02d0ea9ab46e", "sighting--493e3d17-0efc-45fb-aed5-0173b698924e", "sighting--7538e303-d665-4fb7-939f-111d1616fd97", "sighting--667b0824-3301-4a06-acbb-0b5d14efc636", "sighting--07d5950a-2a6f-47a3-bfd3-32d22bf26292", "sighting--ff53f3d7-a93a-4ab7-bdf0-4718a6c88af3", "sighting--0ff03273-a36f-4c21-be78-92c706b8c905", "sighting--9afcdd76-840e-43cc-97d4-ea5d1d2792cb", "sighting--59f865cd-6e0a-4625-ac61-0e429d130cd0", "sighting--5bcc3709-cedf-4e31-b128-42ab5d931b3a", "sighting--d3f7102b-e80e-4a7a-9960-5ed02ff4fe9c", "sighting--7bfc3ae7-acbb-437b-bf79-26622dad31e5", "sighting--cf38fed3-a896-435e-b03c-3b6a9d8a684f", "sighting--fd50c0d4-b61b-47b9-af2a-f6bf791849bb", "sighting--5b431989-dcee-4a7e-acee-6bba6ac4278d", "sighting--ca2efb67-6ba1-4cd4-a90f-ec5777dce37c", "sighting--ae2ffcdb-07f0-4558-9beb-0fc1118ad4e4", "sighting--ef57cc0b-996d-4a7f-870b-d13a1893220d", "sighting--c924a85b-d623-408e-9c80-104ffde9cba6", "sighting--cd4db631-51a9-4938-b46b-9bc565a5a3fc", "sighting--c8e410db-b53c-40e2-b5c2-8635a0bebb1d", "sighting--9b529dde-94f5-48e2-89ce-50513154211d", "sighting--c712b633-25bc-402b-b72f-221959839cf5", "sighting--ee2efc34-6be0-4ba8-b704-27d23d084000", "sighting--4335b7a5-bb91-4d2d-9a19-79f5639aa63a", "sighting--2db9f4ab-66ae-4069-995a-ac2a70178bb7", "sighting--954501fd-74b2-42e2-88e3-e19f9d20757e", "sighting--4669d393-1737-46c5-9186-f3106e09d9e2", "sighting--9461945b-cb03-4b88-8dbf-738163fe2389", "sighting--3e0afcd5-e2a7-4658-8f9d-57238a24e6d2", "sighting--a4256164-596b-4fe5-aa3e-bbe9eff64c9b", "sighting--95d0d83f-700e-4b4b-af52-6957c2ed6207", "sighting--b393bb1c-66b8-4552-9d6c-bcf143f99fcd", "sighting--b86285e5-9155-4f6b-8d0d-106043165c15", "sighting--fe10be97-6f89-436a-ad88-c88b57a88d57", "sighting--d0e0f39a-5198-4ae0-a122-ce07d26fceb5", "sighting--2d6aba08-ffe3-4b4f-886f-cee73fa576cf", "sighting--54144bca-d978-4a4f-b6d1-2561e9f5d5e4", "sighting--15337c7c-9778-439d-8009-97d8a722d0ac", "sighting--b175c162-ddc5-4598-984b-2872ffcb4f64", "sighting--a70ef537-fe5a-4ee5-82ab-1f8591bec986", "sighting--ac4056d2-bb04-478b-a120-c079732e4c30", "sighting--8adb7a39-7c64-4ac9-befd-beadc269ec6c", "sighting--0b1f3f0f-0e4f-4a48-82e1-89c9c9fa6f10", "sighting--1bc908c5-02a9-4acc-9316-1565deebc005", "sighting--22bab729-8d41-4b73-b0fb-29d588d0540c", "sighting--838a31e1-7918-4047-833d-74dd15aae1ab", "sighting--ca49b935-8ee8-4b56-8007-04bf7d2b2df8", "sighting--60295a65-8a46-4eb6-a64e-4fe942b42921", "sighting--34369760-c6ed-421a-b3ae-81494aed9cbe", "sighting--ffeb3c26-3033-493a-bf85-8cabf261d086", "sighting--79332897-885b-45e0-adaa-88f57174ea7b", "sighting--6348c34c-e8b4-4c7a-95fe-c43ef229d234", "sighting--ea20e9a8-3d12-40f5-a653-e747027437f3", "sighting--e51c5ca1-0a66-463f-9119-a1f504068aaa", "sighting--ca8e77cb-f11e-46ca-853b-cea5bec12f0a", "sighting--c188dfaf-ed2c-4b50-aa37-e4be168006e6", "sighting--bbd70507-2682-45d1-9562-d746c9c666c1", "sighting--6787b4b4-4b00-477b-b874-f1e79663a51d", "sighting--3f945cef-c85d-4426-b496-e186c74e1bc2", "sighting--03ca7c46-6ad9-40d8-b4e9-07364dfbcb0b", "sighting--4af326e4-9a09-4370-b2c3-3aa622703a01", "sighting--a4b5ea82-20dd-4fb7-861f-51f7cedc5755", "sighting--beef4874-75c7-49e9-b6c3-423818f0988e", "sighting--bd42b178-9fdb-4322-b203-ef0544f087b1", "sighting--35f93b69-515f-4602-9f7f-44f65cbc59e2", "sighting--99d0eaf7-65d6-4b86-8c31-55ca19893872", "sighting--37ecddd5-d797-4237-b7ed-10e187904cb4", "sighting--ae53c633-d651-4861-9f5e-29bb9c044316", "sighting--46b52cd5-9b24-4cbb-976c-20a63bda12c4", "sighting--21467535-5f09-4c6b-9bdf-5991bdad11cb", "sighting--19e1b410-c62e-465f-aa93-665a5846791a", "sighting--be99ac9f-f5d7-4ee0-9452-7a24b0c8d72e", "sighting--64e4497f-2817-420a-86d3-4d596c138201", "sighting--b60eb053-5302-406b-9806-c242ce2fb6da", "sighting--917765e6-ff81-4ecb-93bd-eccc90f3d29a", "sighting--f174685c-6681-4f72-8b18-1268d3349613", "sighting--3de61711-6e75-4316-b988-13a8a161b6cd", "sighting--d5994c48-b732-469e-b40f-00b514d57a79", "sighting--67ca3f2f-a50c-44b0-9058-22f6cc102def", "sighting--537c03c7-0a94-48ef-8057-7c37cd88da61", "sighting--0a9bc406-c344-4231-a51d-9311c0c27cea", "sighting--cd7cdcc9-0e39-4e52-9d0e-9e2bf051d628", "sighting--d6fd993f-b264-4bc1-8b37-f90cc6e3c783", "sighting--b7a6658f-3430-44ec-82eb-0905c2ee94d0", "sighting--626a244d-f256-42d5-b5b9-360e5c7deabc", "sighting--509c47a1-e8b4-40e4-8735-ac8ee429bbd7", "sighting--b4c0c1c4-cf9a-481c-aacc-be15253d291a", "sighting--55bd5878-3b00-4438-a1d8-8fee000ee1c9", "sighting--136de8c9-b96a-437b-81fb-eede40be0b06", "sighting--d20e655e-0240-43e1-9379-9cbbf2b5a788", "sighting--943415c0-9b19-4769-95a0-fd8ad8dd64fc", "sighting--8de8e1d5-f58f-43ab-a571-7171c4104c1f", "sighting--0a7436b5-e4e3-46e8-92b3-74ef62308777", "sighting--1b587963-2d9e-449b-89bc-4da1566fa754", "sighting--6ddd7fc5-441d-40b3-9f26-fd78007488d9", "sighting--bb475533-4b64-47ff-b351-a23b5689615a", "sighting--5a86958f-4410-4e00-9326-c8093442aed3", "sighting--d51134cb-e5de-4f5e-844f-532ef4c2cd92", "sighting--bd7d8f04-75b9-48d2-8476-7f2675e3a36e", "sighting--2de69239-43f1-4b28-811f-2a49ef00fad6", "sighting--8be3136e-ba67-4657-a938-aa91fbb1e10a", "sighting--1245aa86-cd85-45b7-9392-f41a0ede8113", "sighting--29619246-84cb-4518-b5af-9568af972d4a", "sighting--0807181a-c89f-4765-9a02-9f285d039a1e", "sighting--080ec1af-16b7-4fb9-83bd-60b7357287c8", "sighting--fd30fa7b-064e-4de4-a2f5-b5179e600426", "sighting--e9a1c28a-6e8b-485c-828b-174d70766da5", "sighting--f1c397ea-61e2-41ab-ae3b-cd95df296cb2", "sighting--904aee1c-77a4-41b1-913b-52228f6ccd72", "sighting--7232e0a3-77e1-4622-ab19-d10ee1429586", "sighting--37fa284a-34b7-433b-be34-9e83fd20f4fa", "sighting--90db3a27-950e-4afb-a036-6b901a7e840f", "sighting--2b74a5a6-c229-4594-8dd0-f13bc0f76371", "sighting--7b804b72-59d4-46ac-b974-8da1c13fd590", "sighting--a7fdedc7-eab0-4a68-adff-056c9231206a", "sighting--57aa8749-af1e-4c5a-9bbf-30a876384568", "sighting--9ed89405-7d9a-4a20-905c-093409266881", "sighting--407f958b-6c61-402e-8b3e-cdac4db3c317", "sighting--fe558c66-2294-4f46-8e8e-6fb2a08dab0a", "sighting--f7a257e4-49dc-42c8-8a40-ac4cf98a3481", "sighting--47f74b49-8bcf-4d5b-90d2-3f4857fd25c5", "sighting--dbb290eb-afcc-48b3-91ee-5eb99e57fd49", "sighting--85460ff3-1963-4e4b-a501-0b2a801a7b88", "sighting--b4069da5-bff8-4a0f-8e7c-e01298a95bf2", "sighting--c61fa45b-ca95-4b6d-9526-19a1aa8887a7", "sighting--7e802adf-6bd4-443d-b866-25906166e6f7", "sighting--f1c6c005-892d-4e97-b141-3917d2ae0cb0", "sighting--622ddc53-42e6-4b34-8faa-c2121358a0e8", "sighting--8d3874ab-68c8-4bc5-9865-0bbac70a7034", "sighting--f673c129-10f7-46ae-a3c4-b32c60434c32", "sighting--af47408e-ea77-44dc-a9d7-71670a7bfebd", "sighting--0ead4080-ec2c-4d90-b85f-3b4bf29886d2", "sighting--bfa438a4-f90e-4dfd-93e7-962b9b72413f", "sighting--f2aabd3a-5547-4252-a79e-5814c1f9906e", "sighting--2d892080-b9ca-4c2e-913f-bf7bbaed8c5b", "sighting--e8b55502-39b7-4fde-8dff-b5ab4e874e34", "sighting--6cf545b3-811f-46cc-831c-9d0218f58b8e", "sighting--89166d9e-3326-4031-aef8-3491a47bb1a1", "sighting--666038f8-58b6-4913-b861-93f456dc00bf", "sighting--3ba44368-7d24-403d-a3d8-aed24c629a4b", "sighting--d8127ea1-83f8-4266-ac33-755a1b8e92f1", "sighting--19f331db-94f2-496e-9b14-9162c727e7fd", "sighting--5ce8b2b8-9f90-4ea5-97aa-53be2b557c5e", "sighting--5c61832a-0448-43ec-906d-3b0fb6b59fe4", "sighting--c42da289-7417-4bca-9e38-f7c6b2bd7c94", "sighting--f8967f63-a31c-4f89-8e52-ffad9a7ba03c", "sighting--37ff91c0-61f1-43b0-915b-e56afbc50e51", "sighting--08f14277-9e64-47ac-8402-023b2d416f98", "sighting--fddc3869-e8da-4f08-812c-70e69d89571b", "sighting--0d126e65-4819-4b68-a1b7-8b89881456f4", "sighting--bdc4ad81-5f7d-4a56-97d8-0e6d38e46fa5", "sighting--ba735e32-87f9-492c-99d9-48f02818b6cd", "sighting--84e0926f-3c2c-48c8-8124-9f48c7afbf6d", "sighting--ccfa4758-d57b-441c-be8f-f24b1fa4c7bb", "sighting--fdeed33a-38a6-40f7-accb-9d0f7fc5bc3f", "sighting--d7377164-94ec-4b8d-9034-57d686ada806", "sighting--6f6ecd24-699b-4f72-9650-5dd6ba6c10e6", "sighting--d8c698f3-b915-4e97-b27e-b11df251bd2f", "sighting--445efe07-c11a-4d43-a003-1fb0ec9bb451", "sighting--a7ace793-cb41-48be-8e13-4cbed6ab3a51", "sighting--89b6d51c-767b-4133-b5ee-1a7eea610128", "sighting--e6c3f628-33ae-46f1-86f8-78fe5a6e6bc5", "sighting--933650bc-93e0-455e-bb07-8ea26922d4dc", "sighting--678e6ecb-2037-40cc-9c2b-87cfcb0a0dd0", "sighting--86b532f0-7f71-4fbe-b9b2-f20bf0279d6b", "sighting--dcaddcda-5f95-407d-83ed-2c10b88e9e27", "sighting--9d351b12-3c6e-4cbd-bfcc-e9336c90931b", "sighting--ba97354d-826f-41ae-a3eb-1a2275a197e9", "sighting--8dcaf3a5-ed71-4f18-a225-ac7fe9d8b93c", "sighting--d63739d5-2225-420b-bf6f-b33a559219fd", "sighting--b06463d7-0716-43b3-9457-334a0e873ee4", "sighting--e53a94ac-7d1d-4d76-bfe1-35175884d7ae", "sighting--a60030e5-ef73-4f00-8b7c-6bb3f99e9e8c", "sighting--f90aef2f-1657-482b-9794-cb24753bbb9e", "sighting--af64d018-99d5-4187-911d-89964d779fd7", "sighting--232d7e35-405d-4afd-a424-a235fd6f1847", "sighting--b9366cb9-d2c0-4636-8aa5-4c2d02ea69ce", "sighting--7ef79578-4dd0-4ecc-bc79-13a52f088a80", "sighting--e6aad5a6-c757-40e2-8483-ba189c08f379", "sighting--9b572bef-18f8-4518-81b2-fd888baf343c", "sighting--037df26d-4706-4abb-9000-5b3d1f5240d6", "sighting--b6d7dda7-e621-4a34-a0ff-886408df794d", "sighting--539abecf-9656-47cc-b67e-de3d60d60c4e", "sighting--bcb106f4-b1d4-4f78-8ba8-47ec1a7ea06e", "sighting--d3f1705f-c8d8-4712-868e-0010a45b00ae", "sighting--66100c70-39a4-4ac1-ac01-b51a6a5b5712", "sighting--9744a4fd-1e1d-48e6-af0b-3a9231393417", "sighting--cd38b846-4de4-4d77-ae6a-98d795fbb7bc", "sighting--cfda82a9-205f-4cd9-9701-7758771991d7", "sighting--f7836636-c6b0-4e8d-8485-949713539829", "sighting--f4bbbc8b-f1c9-4713-b0c7-d5dfcb31f6d6", "sighting--17642db0-2475-48c5-8dd6-01bf3c8f2a8c", "sighting--a1c6420c-8d4e-4ded-9f87-493d03b7d1a1", "sighting--f6f5b186-34ff-41df-ae57-0f5adf0a0fbb", "sighting--882a14b9-11aa-4ca8-a0aa-4ddeae51db59", "sighting--bbe53dd9-a1f2-4246-ba96-306fca039817", "sighting--6b6b7e1f-0ebd-4bce-b179-9f111eab2d95", "sighting--7a64d509-d752-4ae3-9705-87596a10d0a9", "sighting--d08d7fbc-4a3a-424a-bb46-4874df156b3d", "sighting--e4d36d75-261d-4c99-8b36-356185c2b5ae", "sighting--d4ad197d-54ac-4e5f-95ec-aad2f1c99be6", "sighting--36b66339-d502-48e0-a434-21cfca395190", "sighting--1a6f6b04-ae20-4dd8-843d-a210172c16e3", "sighting--cdb70d56-41e6-4a0c-b9c2-0c52c0eae7ec", "sighting--d1903c29-0e6c-4194-981b-dd186d235674", "sighting--8db1e50b-f3de-498b-88b2-27749cbc4c7b", "sighting--dc35a742-ebfc-40b7-8cb9-52ef123e3e80", "sighting--06e97553-f209-4563-a9f4-2b495943d885", "sighting--051ab3ed-0ba8-4835-9556-5465777a9698", "sighting--b0b08df9-40be-4b62-adc4-3736a1ef0f96", "sighting--f5473389-7a0d-4f62-9848-b716f148dd14", "sighting--e3691be0-48ce-4be6-ac16-b2e578af3dea", "sighting--8733b0b3-6acc-431a-aa3d-d3c507c03516", "sighting--86f376da-4c67-4c08-8a25-80647bd08500", "sighting--99500b8d-ab2d-4262-9e95-72593bee9f0a", "sighting--d7eb7ee3-0c68-4e03-b128-2f3262efb04d", "sighting--da016df5-7803-48ed-abb0-3904624c4e99", "sighting--dbae2b5b-52cc-4752-90e1-9bf0affe62d4", "sighting--97aec25b-c608-4b87-b972-1d618c41d5df", "sighting--40dd9b37-a5d2-4303-a2e4-157ea1ea0482", "sighting--cb219842-81c6-4b9b-ad80-04eaa9cc5cd0", "sighting--bbd812f8-5cdd-4fc4-888c-97dcece8c2ae", "sighting--81f56e53-0829-43d0-8c00-1007fc6e8d1e", "sighting--fb115253-e305-4f4f-a0bb-19ea12f25b3e", "sighting--a77a0749-a3c6-4a6e-8bbb-f152e7f6a5b2", "sighting--d7130d62-5399-4a48-9dae-ef2c5c79691a", "sighting--99656e4e-2bd3-4711-a513-dac489e6d1fd", "sighting--c9c6353a-c328-48cf-9ec6-010d9041466b", "sighting--aed9ea1b-b12e-4687-871e-0603d532a7d2", "sighting--d35d678c-9c0b-4aef-ab70-23f7b92f9121", "sighting--0557104d-56a8-4134-a5f0-0fd9c7ce2966", "sighting--5217bdef-f564-4283-852e-2a6e87ea351f", "sighting--129497f7-2b89-446f-bf38-3cbc4cf720bc", "sighting--11a48667-d431-48f9-87fb-1679a114d5f1", "sighting--34de817d-b0bd-48ca-9cc0-460042a3c20d", "sighting--105526bb-f85e-4382-a8b3-280bd66aad33", "sighting--82a83a44-4138-489a-8936-ff7840cbc685", "sighting--06d46ed8-3908-4f46-8e66-cf10fec5302c", "sighting--85e15aa1-56b5-4d96-9af2-cc9fd8b9b8ed", "sighting--8f6d33f2-0423-45df-b6d6-542139992a3d", "sighting--269d28c7-13d8-47c9-aa72-73956ea18846", "sighting--0206c287-afb6-452b-af7f-5037fb8fdee4", "sighting--6c35e8fc-352b-4275-9229-b7bdcb4ec172", "sighting--350230e3-94aa-4126-8317-b760810817ee", "sighting--906326ef-8127-46f9-a467-63f17b3c5595", "sighting--829be7e5-d659-4ffc-aebf-fe2b2d9f8f41", "sighting--d61e242c-2154-4ae0-8053-d3857d1fa954", "sighting--16aed541-c716-4088-a04f-8d93bff7f082", "sighting--7cce3f96-d2f6-422a-aa77-9152abf8185f", "sighting--9fee2a47-075f-4fb5-b415-901f949f2b52", "sighting--d80029ec-aeda-4d42-acc6-6eb5d2c55f16", "sighting--6bb36aac-ff81-43c3-889d-03a7bd3d8029", "sighting--df42d88f-b104-4e61-b7d1-0bf87f0569d8", "sighting--d9404de2-41bf-479e-8fe8-28f97c103e10", "sighting--94fbf6cc-a82e-4c33-9203-eaf9b427ab11", "sighting--69bbecce-b524-44bb-b676-b7aa8dfd76a5", "sighting--867f7f74-115e-431e-855a-99d4c6eddcf9", "sighting--1ca86ef4-0860-4a8d-8f40-9b5e7effe09a", "sighting--89678b16-f34a-448d-82f8-cd35340abe0c", "sighting--bc394422-0e0c-488d-afd6-2618afe2e357", "sighting--6f819856-d090-4b44-8347-73c42961d79b", "sighting--0bc5841d-7963-48b9-a412-dbf3c2a930d7", "sighting--4470c66d-95ff-455c-8162-c539e7c9b58b", "sighting--fd398f93-a141-436e-bb5a-05a1fb9bb948", "sighting--3a00a4b2-9370-429a-aa69-464ce15b4624", "sighting--c8d9c781-f4f2-49a5-9215-08f12ea6d193", "sighting--2c04f0d2-e907-4df7-a0e6-5d72889d8e25", "sighting--2eb13e4f-a830-4e60-91e0-8f6d3eff9bf5", "sighting--d9c52c89-a741-4717-917a-d078422a8e0d", "sighting--50080e7e-a270-4b43-bfee-fe44dec9bbd9", "sighting--63f4352c-e015-4347-91f4-91f8423b38fd", "sighting--2f6511dc-4020-4d0f-8b3f-f3622392ca77", "sighting--91d56816-ed42-42db-9079-9d44ba7412e6", "sighting--9b138945-ec46-420e-8a5b-4b14b8c7ea29", "sighting--bf5efc24-f7ca-4003-a6fb-0bd4072f169d", "sighting--fd69b4b5-0816-45fb-9d15-a91c4a8c0362", "sighting--26786748-0275-4ed9-92c4-c0337aec4f40", "sighting--dac42211-6ef6-46ba-a59e-d7e08386f594", "sighting--d778a745-2aa0-4ec4-8b2c-62d2c75f7d0a", "sighting--a3c1bdf2-7724-4ad7-995f-7f765a791bb3", "sighting--18e8b619-1b67-4dc7-8ed1-df972628915f", "sighting--ea1a6ad5-14f3-4fe0-8204-d7ada9a3b031", "sighting--f8210104-8d25-4f9b-9fa9-14eaced8baff", "sighting--c13ffe26-84ce-48ae-9d91-d02c7e7d2d61", "sighting--596a1c60-5323-4e7d-abc5-d765345fedec", "sighting--fabbcf6f-5856-497a-9bb2-9d32943d0a05", "sighting--994658d7-a13f-45ec-bf96-cc16766dd32d", "sighting--7eb5fbb8-7b53-45f4-8e63-92c59954e011", "sighting--bcc7c34c-9c1f-48cf-a304-e1e780e6bf6d", "sighting--c38b0465-94c8-4eae-9042-7e20c6d73bb7", "sighting--8d0dc026-fe64-4631-bf7c-ae9a16b90e0d", "sighting--58758235-580e-4ad6-9b8e-2a21971fecd8", "sighting--aba4d466-c91c-4814-a405-a524979b24d6", "sighting--af2d2878-439b-49ca-af3c-af158f9ad0b5", "sighting--49bd76b7-ca53-41b5-a2dc-59aaa4a34eb7", "sighting--006b52a4-b6f4-487e-9939-3db33b5059aa", "sighting--5f6cb32d-6e14-42a8-b690-38aafb4830e8", "sighting--93a705aa-55d5-4999-9b48-042148bfa729", "sighting--47d2644b-bac6-4b62-a987-f02ea5ac902c", "sighting--12dc2d2e-c5ce-425c-807d-61f578c85f4c", "sighting--a5503865-eb8e-4c9a-b724-38b45f8847bc", "sighting--40dd97fa-9a89-4853-ba4f-2992110ccd50", "sighting--44ac788d-cd4a-404b-98a6-dca8b1b80f8d", "sighting--871b36a2-6f3d-46bc-845a-873af5223a9c", "sighting--fcde1f55-f7b1-497b-813b-df664f1193ec", "sighting--1ccfe55c-ce02-459d-b0a1-1cba601d2519", "sighting--d27d4c5d-8e3b-4b6e-9e31-28a0e348e702", "sighting--8cd82b25-7a99-451c-911d-4e14f92cce8d", "sighting--c4aa441c-21c3-4fd5-ab94-0f55b211bc65", "sighting--93bab966-4b2f-4cfe-b1e6-d4fd7be16313", "sighting--50e22015-528e-4315-b102-b3a3520e7bb0", "sighting--bda40aca-02df-4565-ae75-0c6bc346101d", "sighting--5c47c878-bdde-4119-bf4a-3cc5de2a4712", "sighting--d5a101f2-d633-481d-b067-e033f985bf8c", "sighting--8f769836-b1a7-4047-ba89-1be695494c76", "sighting--a77f35e4-a8e8-4e89-ad71-5aee02b4d005", "sighting--e5139db0-f1a8-4ac9-ad72-73c3fa9973cc", "sighting--770dda29-22bc-4a2b-add2-638c58129f05", "sighting--fe1a88ab-6514-4ceb-8393-249476901ffe", "sighting--dab8d2df-fc9b-412d-91a8-215c23ca8be1", "sighting--1d718625-0f98-4b3c-8fd6-948a5edab7ef", "sighting--c5a0d359-04b0-495e-90a7-fc97b5de85d5", "sighting--0b365f6b-b738-4366-8c23-97b9a2e3815a", "sighting--72dbbec4-2617-4ecd-9c57-514d84ece72f", "sighting--1caf7bdd-edab-4022-9959-31770918b6aa", "sighting--0453fb6b-7bb3-4762-9c9a-82a18d58afdc", "sighting--df06f8e5-85a7-426b-9d4b-a44f5e7db93f", "sighting--7e5c1e81-a708-4340-bf5b-840ab02a57a0", "sighting--dfdf9a89-c240-4c08-89c6-ea299b3ccfdd", "sighting--9cb7605b-3765-4982-adcf-632566244eb8", "sighting--d851bf4d-4085-43a9-b7d9-ffbf2e2ec6b6", "sighting--9fccf25d-21c0-421b-9ada-617cb1d5daf4", "sighting--f98c7caf-5163-444e-90e1-5e17ccfeb703", "sighting--008c92bb-9b21-4259-9cb9-0035c86876f0", "sighting--50a0e894-99d1-4ec5-bde7-059c2b029b36", "sighting--1a4464e6-64b0-4a29-adc9-c11bb702e24b", "sighting--3a38fed2-cda6-49c5-b1b5-4eabc0d83ed3", "sighting--82ef475d-1b97-419b-87c3-33ee4f4dff95", "sighting--1ab95fb5-9f85-4be7-a25f-e3c0a3ad4ba9", "sighting--0e223193-2175-44c7-99a4-7a0e4949aec4", "sighting--f762990a-76d9-4106-a095-0ca6733d1aca", "sighting--4e547042-0f63-4f0f-9483-da88d01d11e8", "sighting--7803e8eb-62b6-47a0-a064-c5a5cb783fee", "sighting--97ec6b15-388c-4f04-90fd-ba9ba18eef46", "sighting--371ba1dc-14e1-4433-9f04-9884cd908adc", "sighting--4b15379b-8019-4816-86ce-1874c960ab2c", "sighting--d8f56142-3709-4166-94ff-106413887ff0", "sighting--dbc882bd-b641-448f-8dec-c6e4e30d37b2", "sighting--1a115132-5977-4de1-a3f7-5cae71020a7e", "sighting--e1b55fc2-4c9e-492f-ac65-1cab0bb6a2ec", "sighting--1ce87b78-d87e-4c71-ae60-50bc36e64d91", "sighting--7bfc3cd4-aea0-4553-9da6-0dcc44da2dd6", "sighting--ac4e1fb1-ca8a-4b0a-ae13-c14f046c1b49", "sighting--68c30216-28b7-477c-846e-2aa6f003303c", "sighting--80159bc1-891f-4b4d-b673-0333dd91ce5e", "sighting--4f2e55ab-b77f-4c6c-8b21-48c6a5060974", "sighting--c42df04a-27c5-4db1-8436-0c5fee23c2bd", "sighting--5326ba2d-e35f-49ca-b85d-8fc0bc799c19", "sighting--34ceca9c-a1bb-4231-8ef9-b5061fb8bd1f", "sighting--0db29432-0237-4be5-82ca-222292999ced", "sighting--17ba0309-c141-42b3-8736-77bd14d23c1c", "sighting--16ecb2e2-5428-490c-8da5-c704e724886f", "sighting--26af27df-b135-4d7d-9509-874c979741fd", "sighting--16041cf1-903c-4811-a2c9-e70fea253db0", "sighting--6e661af8-133c-48f2-adba-e0cdbcc84741", "sighting--b7417b54-eefa-4eb0-b8c3-66d4e7d6c2a1", "sighting--1599b713-d769-4c8c-af26-d93526209104", "sighting--c5260c89-fe1e-4d90-bb63-652fdf9d987a", "sighting--256b28dd-f798-42a9-93e7-4ada4db20110", "sighting--b15ce85d-92da-474b-b368-f6ff4227fdf6", "sighting--86fb3874-63ff-4e7e-ab01-47fe83e464ec", "sighting--645d1f68-1450-4e62-bead-290351e8dea2", "sighting--223b53c3-b76a-4e53-9d6c-73ebe355eddc", "sighting--67fcf157-d9a0-47f6-8b14-0ffd92286b14", "sighting--73bc5f51-93d7-49c8-ad9c-706918777b2e", "sighting--db49f0c9-5c36-40a1-87cc-95a52a0fb655", "sighting--66322229-5e84-4c7e-a95c-f2dfdf51bfc5", "sighting--61385dc3-a2be-4c08-b927-51fb9588d11d", "sighting--bbbee950-2c2c-4c99-a324-6f27cc1396d4", "sighting--132e7627-3559-4db3-b001-a0db3d1ed7ca", "sighting--d706f364-3de7-4dd3-aab6-7fe815979e19", "sighting--2eba54e7-93b3-4821-b275-66c82fa5ddbc", "sighting--f593c494-846f-4b23-826c-64960a0377aa", "sighting--beb8971d-6f1c-4ce9-99dd-58156b934ccd", "sighting--4965e0d1-9881-4a9c-9301-8b943a830bba", "sighting--1793833b-a22f-4cde-a0dc-9c1349e20ba7", "sighting--a0bbc0d6-3a52-49a3-8498-cbd2a07bf2f8", "sighting--558bc429-71cc-4d3e-977b-9e24027a8e26", "sighting--fb5155b1-6c8c-4e79-ab78-6835e1e8ba87", "sighting--8d6ece51-eab8-45d7-aa86-c17e1162ee41", "sighting--335f18d5-f72c-4be5-bf85-934dbb163fde", "sighting--a3609458-bc1d-4138-870c-0f79947f1970", "sighting--66eecb36-4564-4f09-932f-824dd0054a19", "sighting--fb735573-6f93-4a6a-a48e-5dd269bcfe27", "sighting--7fe0270d-379d-41ce-823a-839c71b595c2", "sighting--e109aee1-51b3-435e-af82-360d507af19b", "sighting--f25d098e-e06a-487d-95f2-85e2e072e939", "sighting--a44af2f3-2de1-4877-829a-c816e4bbafaa", "sighting--90fea67d-5bc7-41e8-87da-892f9f2a0d89", "sighting--91edb9b4-84aa-4cd6-b42f-f01e7c484c42", "sighting--271d29c6-6384-4d61-bb9f-4e2698ddab70", "sighting--b7ee3d2b-2505-4fb4-8110-16b81da72ffc", "sighting--0fc6af83-0422-410b-907b-1b8f7a1fbe5a", "sighting--adf8c3ad-844a-410a-9571-71f39c84bfce", "sighting--e82db704-ce9a-4517-8d99-841ccfe38c3e", "sighting--34614bf8-dc79-4445-a0db-502d318827b4", "sighting--536d5ceb-0727-4892-aae8-5af1b16cd175", "sighting--7871bbcf-76b9-4f3b-9da5-076fbc98fb70", "sighting--52b363cf-49ce-4e0c-a72b-8fbbe089ab32", "sighting--aefa1a21-8b68-4395-aa6f-b0725acde641", "sighting--8a80bef2-2c70-4e40-84a7-f301cfcdaf5d", "sighting--7f82425b-4261-4b91-a934-a3fc3d5f8ef8", "sighting--0bc50d1b-7eaa-480f-82f7-01ac703ff647", "sighting--4cae029d-d919-4b0b-bb67-2529402081e8", "sighting--41f48dae-aa56-4a6d-91ff-729f1c63d93a", "sighting--01b7ebb5-4057-490a-86b4-34c953a4ea06", "sighting--5b81aabe-2981-4b97-ab9b-559402274dad", "sighting--bf912511-2e7e-48b2-946e-a908d8681110", "sighting--b4858976-96c7-4a2b-a3e0-1c49baeeffdf", "sighting--abf52d99-cfcc-470f-b3ac-0da093788f19", "sighting--5a8e0fd1-9b0b-449b-aec7-c12519e5b131", "sighting--b35524d3-654d-4283-b8cc-fceb3c85de8d", "sighting--b262547d-f64c-49c5-9d7e-b760c7e9e298", "sighting--44cad15b-fa29-4ffe-8729-584cdb719eda", "sighting--42faba03-d73e-4e6b-8150-d20c803fa9f9", "sighting--e01c2a7b-0eb1-4c28-9345-cb52b75539e1", "sighting--ca91e698-9c51-4f23-a499-f34e47d1165b", "sighting--ce713d26-34ba-40fb-b2e3-c966fd9fe6fb", "sighting--34890bbb-c3ab-432e-b571-f1010b15f58b", "sighting--50e60c76-8ef3-4eb7-8292-eb1c2ac384ed", "sighting--6f9040c4-8173-4d6e-a2ea-27fe6e0c2d9d", "sighting--7285d13a-f9be-4083-89e8-6f320d978a60", "sighting--c534f721-f3b7-4794-aa88-12ed399b3d33", "sighting--cd6a3ae3-335e-4cf5-92aa-5e99a4e1b542", "sighting--7ccc5b05-e4b7-49a5-b3da-161b4015196c", "sighting--6e441ffe-1c0b-45ec-89ad-4a29b03fac5b", "sighting--a8f97931-50a9-4aa9-aa5d-e7d433bb1a3d", "sighting--c3408b3b-4f25-4e6d-af3d-ddf52f2e6836", "sighting--8edf2bfc-8c06-4dca-8f6d-321ad3a8db71", "sighting--76e75dbe-8cde-4baf-afee-b742cc4bcff2", "sighting--1683c583-0f51-4541-83ca-b793e121de0b", "sighting--6c1bd275-99de-4d77-8c95-674408068838", "sighting--ef4ff5bd-2555-4c27-94fe-023f05a87718", "sighting--0dd7b902-6df5-4d65-ae9a-20a4fcbeb807", "sighting--b588eae2-a07b-4716-97d8-ed3352b6128c", "sighting--cfb18d18-76e0-455a-acdd-71398bf2f6c5", "sighting--850268f6-9b63-440e-9e94-442c765bde87", "sighting--63e4da2d-ead4-4d91-a060-78635c8a8659", "sighting--c545f85e-d66f-4e10-abc4-7b4826e1b4d6", "sighting--21abb4d4-fe7e-4144-a60c-07f126981f91", "sighting--90b11d1e-1dfc-481b-8b57-4c9a0fb31ff8", "sighting--076b96f6-23fb-4b4a-877a-674c154e4412", "sighting--2debee1c-a325-4296-b36c-0d40af7b3bad", "sighting--b9f8aa84-4fda-4975-9945-f5e099a3bdae", "sighting--8401e0f0-67f4-44cf-8fe5-355aeea9a1cc", "sighting--6a034cdd-7271-48fe-840b-ecb3aade7ab3", "sighting--dfccc2fd-033a-4401-a343-2ad2589712a8", "sighting--5aa64fd6-79e6-468f-afdb-9b4b67bc4ed5", "sighting--8a4bb563-1947-42e2-8040-aaee6c9a0a7c", "sighting--8cf7589e-16b3-4357-892e-9a0b84aab3d2", "sighting--0d4dfee8-0f20-4a3d-b756-1a1a8b805b89", "sighting--be415883-7e43-4cc0-b057-82fbf52683e5", "sighting--a6730142-5fb8-4610-a6fe-cff00b47c7fc", "sighting--223b99c5-2660-4a1b-86fd-0061164a31bd", "sighting--0d4ff1d3-c573-499b-a32c-e977e05ad2be", "sighting--0f09ce4e-eaaa-49be-a533-cd4a961f8e35", "sighting--bd3dc956-3abe-4337-b6a7-dbaefd433475", "sighting--eff68f6a-128c-457e-8b7c-5ad58814c57b", "sighting--29f71aad-5906-4836-9570-0dc3b19e34d7", "sighting--22480cc0-f972-429f-aa51-0b6b3e0aae01", "sighting--a0cc9b28-986d-4d37-8c3e-493271b484f3", "sighting--d3b269bc-5c0d-49ec-9da0-5d1437eab783", "sighting--0e93d2ed-be6b-4bea-8bc3-abba27308bf5", "sighting--f1ee34d8-d096-418b-b76e-dc868c0a208b", "sighting--bcb121ba-a59e-4d76-b981-f04e584f75ba", "sighting--7634ecc3-db3e-4b1f-b361-f04ec39c2d60", "sighting--3f40d321-4df2-4081-ab68-90fc6c08b553", "sighting--0fd4999a-f46c-4603-9c80-7606941c6c48", "sighting--bdbe6213-058c-43cf-972f-5f6e1fd4c28f", "sighting--7439a5a8-204d-4fe5-8436-9c2dc9576ab9", "sighting--5c2903ef-5f00-4ab7-87e2-f0759089c77b", "sighting--a6e76c74-a8cc-49bd-bcb5-9205aa4be29a", "sighting--3445eee6-edec-4db4-849e-3696556e4e7f", "sighting--1491ede4-8ff8-4958-a982-29fc98717754", "sighting--c95de0c7-1ff9-41bd-baa0-2084b5b856d1", "sighting--647bb8be-fc8b-4430-b661-ec246bb1c68c", "sighting--a93ea99e-2c3f-464c-934e-a1b03e495ef8", "sighting--2cd29e48-88e0-4223-8c74-de33bee4f504", "sighting--be19f844-efec-4da6-aed6-b93955b0aa13", "sighting--32af45c0-b9b8-4ccf-a81f-33f7cd90e33c", "sighting--55e976b5-9d12-4d0e-959d-d036e7a95743", "sighting--f4db80f8-78e4-421b-b12b-757927b22820", "sighting--4e53122b-d64c-4d7e-bf9c-1a0cde64124e", "sighting--d50fc428-95ba-40e6-a5ca-8c2f6459fa0b", "sighting--5991c73c-1dc3-4164-8487-7119aa6ae94f", "sighting--0351c13d-69ce-4f7d-bad1-aa731ff1366a", "sighting--941a524a-444b-41af-887e-3e0222afc9ef", "sighting--324658f6-5abc-40e1-96bc-81fa5f36d2ed", "sighting--b5002366-1dbc-48c2-8b8f-2f7a4e1562b5", "sighting--d43e96cd-4df9-496a-9b0b-ac59c8c91283", "sighting--5e9d5e65-0db0-4bcb-9cd8-0b9ea07f6a95", "sighting--7593a9c8-af1b-4050-9c9c-03033a2fe4a7", "sighting--df47089b-8f4a-44a9-a4ae-7c875ed83b0a", "sighting--878785f4-bcd7-48bf-bbfd-9bc0f5967db4", "sighting--6d481c91-fa2e-476c-b73b-24b0dd2c077e", "sighting--f530a58f-5cb8-476a-aa4b-2dd0942502a6", "sighting--e15d7dca-e5a6-48e3-9073-b768af1ca9a2", "sighting--67a680de-07e5-49f5-a6bd-7a2db4ab30b2", "sighting--535dcca6-5b1a-4362-9098-dc1ad7f55e60", "sighting--ce7f3378-0ed8-4c32-a439-ab91888a51c0", "sighting--3b7c8e59-2f20-4170-bef5-af9e94734305", "sighting--b193568b-ca5f-402f-91c2-a0169fc8d1b7", "sighting--e746db79-feb6-48b7-b85a-328d4c7cec7c", "sighting--7e1ca491-c09f-461d-bd82-2aa19f3f485f", "sighting--5c9a542a-5b59-4c1f-8162-30dc84fd035d", "sighting--ec9116dd-e580-478e-ade8-59ee06084908", "sighting--4edbcb97-5dc3-42d9-b240-81d0f37f60e3", "sighting--f84c4228-930e-4daa-ac02-aab51015c757", "sighting--5a66df4a-2fa6-4db4-82cc-69aa2c5a7051", "sighting--c7d12bc3-b210-49b7-8578-cf1db840d922", "sighting--974f5499-2e20-4722-b2e5-14cb3f6927b3", "sighting--dd04a408-e4ee-415b-9ca9-01098a12cf19", "sighting--0db7c84f-4482-4006-a665-62cef59a7bb9", "sighting--a4dbf127-faad-4250-af53-8d00bf10036d", "sighting--8fb2dc6f-48c4-4e4b-97bc-594be12d83e0", "sighting--d6148f39-8c77-4f22-ad88-d73216a7ee25", "sighting--9f0446a8-12ce-4c43-a051-134e35badda7", "sighting--9ab2ee22-bb63-468e-902c-b9146822f361", "sighting--c26cc234-7ce8-4d56-a8b1-94e7d1ce0fbf", "sighting--84318bba-af40-45a4-a9bd-b5cd00312f85", "sighting--0bfd9930-6f66-422f-9398-d4e64cad7f9b", "sighting--a8b5998e-1c14-470e-b6ee-472cf84b421d", "sighting--90f4b0a6-87eb-4231-956a-a00160ceaf7a", "sighting--86743303-7eaf-4033-82c2-1885a2154119", "sighting--97155c51-f8d4-4193-8a88-7209db509c29", "sighting--93ef0b6d-3a73-4bff-869b-00892710a577", "sighting--4bed8b13-1a03-40e7-b35f-4299f1c9d813", "sighting--519f8a63-a1fe-439e-8a99-05fed9766230", "sighting--144f8c1b-425c-496b-b3ba-798c505040e3", "sighting--4dfc198e-e38c-4585-a4ef-caa8e5626095", "sighting--df8543ee-f813-4ae3-a09c-a04942412ec2", "sighting--5efea697-0c4d-4406-bf2e-811bec01154e", "sighting--5e519746-5fe6-4142-ab97-3203d31ee7e3", "sighting--468b5fa5-6864-427a-9ff5-f1220b10a0bb", "sighting--5352a777-1142-46f3-b320-cc7fc960dd51", "sighting--7d826d07-413c-4780-b8dc-ac302645d0b5", "sighting--b3e2fce2-22cc-4362-809d-be5c71e8c6a2", "sighting--fff10fc1-08b1-4f60-9800-4f471487a6ab", "sighting--caa5f154-64c5-4a8c-96e2-f25b831a09ba", "sighting--a2d9439e-daca-4bb1-aa4b-c8b1b51a7b08", "sighting--9911a8ae-7189-4581-a052-8d6629602aa2", "sighting--4857d74c-cb29-4bcf-8171-9ee461897ae6", "sighting--6a7ae980-5492-43bb-a9fc-1818d5c1e3ed", "sighting--fb743476-b3c1-46f6-929b-a7d7bb814673", "sighting--35e04dae-918d-4b6a-a439-2b8971e59d7d", "sighting--d53a6c0a-84cb-4ed3-b536-83ce33a324d5", "sighting--0cf02010-cee9-41a7-8c97-37ddd7107396", "sighting--f8f71373-68ff-45f4-908e-36d0effbd34f", "sighting--610ed165-6a3d-49de-b782-29aaecfed8d1", "sighting--f79e3c53-375f-47f2-b5c6-4ab08aca48c0", "sighting--05638e21-96ea-41e3-b44a-2e4350ffa53f", "sighting--a6abebef-43fa-4826-a3a5-cacbbd916dda", "sighting--01e7e748-43c6-4470-a410-c320ee8648f8", "sighting--539879ad-05c8-4635-87a5-fba1305f2adb", "sighting--28c368e7-2bce-4123-ac26-155853dc8c81", "sighting--45f3f5b3-7b8c-42b9-b83b-aac0dec48cc9", "sighting--bb2ccfd8-ea6c-40a7-aa52-6c11f3ad3471", "sighting--7145ddb9-2489-411b-b252-7ee593ffe073", "sighting--5f6b25b7-2d03-4d9d-aeaa-81dec6660159", "sighting--c92a4d4c-91d3-4ec7-867e-873c99c7d453", "sighting--1a7d0494-aa4d-4515-8240-9dece3ef99c2", "sighting--fd5ac73c-1bff-4768-8d6a-3daf4bdd0521", "sighting--613f991e-03ba-4bd3-97ce-45d68e908aa3", "sighting--e1c16e95-162f-40a4-bdb4-e8ec0cdbd94d", "sighting--bc5cbd5b-5ba5-476d-a12c-5738bd957b38", "sighting--5d22cf68-ddc9-472e-bfbb-980583f4f88f", "sighting--b4ba6101-243f-46fe-9ca8-e325e428944e", "sighting--c9c9fef9-ac2f-4e70-93d3-4aa234405b27", "sighting--38d159e1-a657-4e8d-8600-96f547d17503", "sighting--ec90bfdd-0098-42a1-a59f-07726bf88238", "sighting--55e2a4fb-74a2-4329-9e38-92fa8df9b322", "sighting--47c3a545-cef1-4f5c-8b1e-dba8ac503263", "sighting--114d81fb-8e3c-45b1-81de-890e8702de74", "sighting--55aba4d8-bc95-405e-9e2a-883686a151e5", "sighting--b1efac07-c0d5-4c14-8fb9-8b10bea9b00b", "sighting--dcdaf274-84c1-417a-a75b-7c385dac0445", "sighting--c5d0111e-cf8a-4ac0-a350-9e0fe3e6e322", "sighting--ceb1be1c-21b0-4b93-8996-e447b7121096", "sighting--edd28048-9632-4541-8097-0c3f91c0341c", "sighting--a048eded-378f-46a5-aea9-4467630c3e22", "sighting--93df08ca-808e-40d4-816f-290cf2f41d97", "sighting--87f0ad89-0056-49ed-b56a-81b4bdd981eb", "sighting--0493cded-5b3d-4a99-9605-85a80593e4b8", "sighting--1d4053e9-fce3-4a73-91b7-c5c0c36893cb", "sighting--5946bf32-d58a-47f1-b701-72eb5c8784d6", "sighting--cf0c99b2-a85b-441f-8b00-d43a1db4c952", "sighting--09c6c017-5f84-4cfd-b58b-057a54ac62f7", "sighting--8dbda9b1-d5d6-4d10-a56d-fb8f60dad7c0", "sighting--4f26929a-5f38-42f3-8a41-2a9665e47b32", "sighting--3b738b05-f858-464d-9ae0-c881cdec8ef6", "sighting--60c22294-a14f-4ad2-8b80-76065d563b7d", "sighting--fcb4ded8-c5d3-45c2-8753-850ebe6f234d", "sighting--3947370d-6a23-4196-97ee-7489224901fa", "sighting--4b7c56ab-ca2d-4198-a15a-14479b4cf91a", "sighting--0feff8c5-e185-4a29-a780-c44963a2ded1", "sighting--c288a9e7-7d60-4441-9b09-9fc6b72b2afa", "sighting--5f541f5e-3403-47b3-bcf8-dd312d1a2012", "sighting--4c0e2f1d-37ab-400d-b6c9-e6c33f35fd5f", "sighting--580b25ca-db28-465f-8b2b-aa72e9ac3e54", "sighting--7fecff7d-899a-4d26-8b9c-f37a1cbb0929", "sighting--6565b0d4-df77-4533-9bcb-6fddbee0a83d", "sighting--5da5e368-b92d-47d1-9f4e-4a06c2e22955", "sighting--66acc1fa-0fd1-43dd-9ca0-da0f3c8ed36a", "sighting--8984b458-6b8e-4571-af3c-852bdee12934", "sighting--7f2ea2fd-a093-4181-8f80-1dd7c91c61d5", "sighting--af72be3e-4b02-4fe4-af8f-2ee365e3e6c0", "sighting--5d3c8e2c-13bc-4bc1-98a3-349d972cb411", "sighting--1f5c211e-2503-4fd4-aee7-4f1d291f8449", "sighting--80214baa-51fd-46ab-8d5a-015b9ac76b94", "sighting--044ff91b-2561-4573-bc4d-ce28d3db06ee", "sighting--af6e5fd2-9ffc-4914-a3f2-9b580b87a9ae", "sighting--5894c35c-c478-4ebb-94d5-25cfab0c1005", "sighting--b56e1609-d119-4323-8d65-4b36e8cb1adf", "sighting--76f60c72-5f5f-449e-bec7-a1425991d6b6", "sighting--8e2a6c66-9905-4cc7-b51c-6f6e811cdc04", "sighting--b52710f9-6d95-46bb-b52f-d796c7487175", "sighting--266b506d-0a6a-42ed-9770-cd4b3e9def33", "sighting--7d79b23f-fbba-42d3-8c81-4abfd7a03111", "sighting--1cd10d4e-80e3-4d6c-8e5b-acb7d9054eca", "sighting--4af5088b-aba5-41ca-a7e4-07622a5c3fc1", "sighting--5cd9b001-6977-48ab-94a7-db20f96b0077", "sighting--038d1a91-0322-460f-adbd-28bda13bfed7", "sighting--daf3dbfa-aedf-4c8d-ae05-f5932a7bdd72", "sighting--696d3dc9-9189-47f0-b5e4-c3f331e0c278", "sighting--7dcea204-8de3-4b46-a3ae-821a8dadba8c", "sighting--08b4aee9-3ab8-41cc-832d-8972c1bbb3a1", "sighting--e2cb0e0f-0505-4537-ae02-f0f703e0f146", "sighting--0723d743-3d85-4117-a860-2308545395f0", "sighting--861daf01-07fa-4369-a848-28fe3fa8620f", "sighting--da9a8fe0-5882-4f0b-a8e1-4432875c5944", "sighting--3acfa14e-5685-4924-96f7-2a70089a395f", "sighting--5ff1333f-e4a9-4173-8f77-461f6bf9f2a3", "sighting--43dad27f-3e8a-46b7-918b-0dd3858ce158", "sighting--16e6dff6-2491-40d1-ae24-7fa64913538b", "sighting--46d3be08-2e7e-4696-8b73-eb09e29e0b06", "sighting--8eab0192-6a3c-4d33-a82a-e3cdd1e7a165", "sighting--e28cd01d-6235-467c-aec3-0af7546b2932", "sighting--19303ebf-e9f5-444c-8c6f-a97e720263d8", "sighting--a26c6abc-b778-40e7-bd3c-5d7114c5c695", "sighting--12800461-73a5-4781-9de8-e6ffe9aa042d", "sighting--9e7f08a8-bb5b-4711-83d2-fed27fda4bb0", "sighting--5252105a-d0d3-4532-8bfe-d0b91fe32883", "sighting--73e7c465-3eb3-4224-b7bb-0c11da805337", "sighting--87618df8-f5e7-4254-a925-00c2795d986c", "sighting--109f41e0-b558-48fb-8f96-fc3064f3bdda", "sighting--c341b94a-b96e-4ca8-be4f-34db2a86357b", "sighting--9f610299-9f9c-4c43-bf1d-68b725862f89", "sighting--f9b47317-25a1-46e8-9e5c-6e04bbb910b1", "sighting--cc0b0a4f-fd60-48c5-bd3e-b3334020d1cc", "sighting--7eb4c4ff-30bc-42c1-8746-e87197e55072", "sighting--0732f6ec-b8ab-4931-a258-b5ff30a4240b", "sighting--d050ead6-2c64-4244-ab54-e1f13ad6bd72", "sighting--bbfff127-3dff-490b-9c7f-5e08e22b60f2", "sighting--a51479b1-31d2-4bf3-8aed-87ebb88c8b75", "sighting--5d1dcc02-4662-4e10-8b75-076a0cea77d4", "sighting--fe1f87e7-4e5b-40c1-823c-e973dcb2a469", "sighting--02a8bcdf-8255-4a74-b1bf-f113db84dbcb", "sighting--1a11b4d0-824a-45bf-a4c0-4c02101f0e20", "sighting--c60701f6-6960-4d8b-b265-fcdcccb94e5f", "sighting--fe8ac093-07ba-4911-838b-b7e44d4d30dc", "sighting--887616a1-3a4c-4b40-987b-f393c5ffd97f", "sighting--10ca3a7c-fa9b-4a5f-99fa-d5b58c8a24a6", "sighting--35156355-56c4-4035-bf55-5cc164cb3e62", "sighting--a0962fcb-bafe-45c5-940c-478da113ec0e", "sighting--d408e524-d452-4413-b1b4-b9537d027d93", "sighting--afec4ce7-f63e-4dda-bc0e-f0c074be2ac7", "sighting--290dd484-99ba-4d17-aab6-a15f20d06f2d", "sighting--06f0dd57-53bb-48dc-89b4-32aafa658253", "sighting--a500bb89-0620-44ac-bdaa-187b2947414b", "sighting--9eb8ddf2-0dfe-419e-a88e-db6d9bd5c3b8", "sighting--e6efbbac-7555-4f80-afb1-9bbbb21734b8", "sighting--ecb1bb6f-5340-42d2-a773-7dfffc7cabcb", "sighting--9afbc965-0cf1-44e4-9479-7af7455cb1df", "sighting--8b83746c-a384-4cde-b5f5-10c09840c4d9", "sighting--1059703b-379c-49c5-9bf8-4d6aced589d5", "sighting--46653ec8-edef-47f5-9180-8c1377ebf3bd", "sighting--950b0c1c-393f-46a7-a2f6-95bda3e0b18d", "sighting--793d5cbc-4ddf-4e37-b2d0-2ed3048fd9be", "sighting--5a5c178d-20d6-4082-b0ad-bb68b072a899", "sighting--40465bc1-ab6e-41b7-b98f-d7860fe8c5f4", "sighting--0ce951bb-2690-48a2-ad7b-81442e58fc32", "sighting--d7f0c109-975e-49f4-bc03-b4328e9b40d8", "sighting--7a2bba90-fa94-4628-8010-e454cbeb5477", "sighting--4a821385-3eda-4cb5-83fc-2e19a4a2481f", "sighting--d5afafc9-ee10-4117-b3d9-c97e8184b743", "sighting--a509f78a-31df-4889-a7f7-edc691b4fef5", "sighting--160f7a88-9cc4-4c16-8c3e-2be1a6db3c2d", "sighting--392ebc59-4cd0-4f9c-b25b-449fa79c5bdc", "sighting--d0758dc1-84e4-41ed-b5e7-4a733498d93e", "sighting--7f2d3bdf-cc69-45dc-ae89-ae492e62d680", "sighting--6901160e-5d9e-4372-b941-0b80611783a2", "sighting--ed32cac1-92dc-49a7-9f4d-6c0da49eab00", "sighting--f53219ef-0055-4906-afa9-8a20dc34cec0", "sighting--dbb5dd51-2f66-4172-bfb8-6d33acc33752", "sighting--8e14a2d9-1fce-4b32-ab47-c4612e88284b", "sighting--db9fd544-8f7b-42d0-aa72-845b3a7f60ae", "sighting--3e95f691-4f22-4673-a234-387fdc500f9e", "sighting--3c283456-4f1f-4ccb-8c8a-9933e5db6f3b", "sighting--9741a694-069c-4d9a-83b9-a78ddc125678", "sighting--c0fd3feb-65b3-4260-a038-4ddc99228a61", "sighting--b1608cc2-2377-422c-b7d3-7aa7e3d92114", "sighting--34e38151-f045-4d83-9ef0-e2de5a7bb270", "sighting--95e385e4-9426-4c01-8c22-1b2a5be75f0c", "sighting--74df2c96-16aa-46b5-be04-6d984592826e", "sighting--23712dc1-7b12-4884-8332-a011ce44da84", "sighting--ba065633-e88e-426c-a53a-6c7c6a3ba3fc", "sighting--ef07850a-2783-46ce-93b0-7aa253fab598", "sighting--dc0e9821-a744-455e-97fa-f57e027d0cb4", "sighting--77674a48-56b1-44f9-838d-1635f0795586", "sighting--efb1f8cd-708b-4b39-92e4-87e10f4cc616", "sighting--5cbd9394-7752-4c8a-bbba-3afc9717c5a6", "sighting--a26d338c-6044-46b2-8077-3e5a66fdb2a5", "sighting--3126c273-476b-4aaa-b2cc-7f3f8caee6f6", "sighting--f7e64c6b-6860-46c4-8ccf-c94dec1fecc5", "sighting--89ff5468-1491-43e0-a903-1105d7286908", "sighting--9f3e4111-0b37-4d48-99f1-5a5799542f0e", "sighting--298be70f-4cc5-4942-8fd6-28af96402c93", "sighting--a9fe29c4-885a-48be-9448-40672d84d2f4", "sighting--698217b6-977c-43f0-a1c7-bef2686f1999", "sighting--29664ebd-fc05-4fc5-ae0e-58d670c4c866", "sighting--e0725074-cdcc-4245-b483-e5d5f83b0f67", "sighting--3be2dc16-90f3-4608-804c-8b67d1ce64eb", "sighting--12126ff6-0c11-42db-b05a-a21f720ac652", "sighting--692d2042-8a87-4b5f-9bf5-16c9c704dadb", "sighting--780f6a2f-d9ab-4c1f-bc6f-7e19df0f80a9", "sighting--14089997-673a-476d-a778-ba8d0b35b96f", "sighting--230e147d-cbc8-401c-aefa-e1cd00fa220c", "sighting--be639800-33c7-4d86-bfaa-6c93093f64ed", "sighting--436838f4-cfbd-447b-8947-b37ef2711fb8", "sighting--e71aa64c-b557-4130-aa9c-9c3d1b30faba", "sighting--02b40d79-1f51-481c-abdd-2d753fd4b6ce", "sighting--e8d80054-c20d-4efd-bafd-5a6756578717", "sighting--6d8fec1c-9ba9-448e-85a2-dd190332e350", "sighting--da46cb74-0445-4f95-ba68-625eb38f1926", "sighting--ea14ec60-d8e8-43ce-8e0e-c4e038dca8fc", "sighting--2a0fb7ee-3468-4502-91b8-c0891ff40833", "sighting--f7a5879c-1960-4d38-bcc0-cc017a43a80d", "sighting--68fe7b69-4afa-4b4d-8f70-145146262a51", "sighting--05113808-5b21-4bf5-a324-83e9280b8f24", "sighting--1ec3ca12-db3b-4dce-a6e8-3d074055bcb9", "sighting--cda4a390-0641-4f23-9872-64b51db867e2", "sighting--2ac6914d-c893-4b57-be63-79dada0e7e93", "sighting--34e683bc-3b7e-4367-8531-953edb830963", "sighting--c2e6e219-3366-4774-a855-8cef2d9d3a7c", "sighting--c817e10c-13b1-4a5f-ac5b-d8146df8d35c", "sighting--d710bc56-9940-40ef-b925-07664e13da3a", "sighting--914e83db-9ef8-4a6a-ac40-aa26b23cc8b5", "sighting--e87cdd6a-dcae-4619-ba5c-951c2e55776d", "sighting--cb44f460-c33e-4c34-bc8f-4c521204cf7b", "sighting--d6b6469c-9213-43a8-b020-c972cd0ad278", "sighting--9b715a2a-d8b2-4408-b8e4-0c3137b2f5ef", "sighting--d56fa9e6-638c-47e2-b67c-572e65f310a5", "sighting--c1ce48c4-bd27-40c7-8242-d8fa4b4104c4", "sighting--5e97383c-231f-4131-bc22-815854a49a13", "sighting--3ed8954b-2266-4dbc-b839-7032e813648b", "sighting--49e833a6-fb15-44ff-bc10-af7c2cc5d8e4", "sighting--88762713-f6e8-44ee-906b-d2bde583b16c", "sighting--90078287-9d0c-476f-a5f1-be8b3d4cd9b5", "sighting--af3c1de5-9bf7-4129-aac4-8370754dc983", "sighting--da1a5da3-0cc4-47b2-98ec-f09087a5c690", "sighting--f7fd2f52-5801-401b-ab14-8e9adac7e131", "sighting--5513087d-9201-4a73-b858-1ddcbb4376f8", "sighting--22626f2b-1e3e-4ec3-ae68-9399fd59caa6", "sighting--21f5d489-d026-462d-a7b8-3facc7726cf1", "sighting--b7ed1d44-bf35-41e1-9f47-987fee7065fd", "sighting--982e5b91-6faa-4fd8-9489-684a859d9028", "sighting--b50f47e7-3e6a-4454-a273-d6e3fcd4055b", "sighting--499d4083-4c4c-4784-9f99-f4662f06e044", "sighting--6ec632cd-f4bb-4678-9198-832ccacd183f", "sighting--3015986c-f67b-4f33-a878-102641d2d198", "sighting--6cfde312-23e2-4b00-8f1e-5472ab1f51c9", "sighting--e3516d61-269c-4e4d-9d08-2b616660600a", "sighting--6d9a1ec3-e20e-4734-a704-90ecfdb76fc7", "sighting--1079e02b-3318-4ff9-bc0f-50b10066d217", "sighting--bfebc8e2-d575-4240-8996-c35d12cf0528", "sighting--ff71d253-89ea-48f0-9ab8-b69ee6068c9a", "sighting--eb480660-f55f-4e2c-8f27-52e909093936", "sighting--7471deb0-758e-4a71-8af8-74a04aa91abe", "sighting--4cc1551e-11aa-4ed1-85c9-7c6333ecaa6f", "sighting--d5f597f3-a87e-445c-bb73-91cb0bd6a662", "sighting--9e35fad9-3056-4fbd-9776-6918646fca94", "sighting--66d8aab9-c1d7-4997-b619-525f1cbf04b8", "sighting--1324aedc-18bf-4ec7-97f5-2bfcf1a5537d", "sighting--57072823-a17c-40c0-8c44-15e481f27968", "sighting--416d1253-0d91-4d03-9392-3f001af453d5", "sighting--f388abf2-5dbd-43e0-b093-e3d3e82185e3", "sighting--ad159fd1-b3dc-4b3f-945b-f5406c4ed5b0", "sighting--56d77828-476a-404f-b1a1-ff363780c72d", "sighting--662263eb-eb4d-4113-bad0-adcd842e78d5", "sighting--05c42aa0-7273-4a92-8f6e-a29b528ade6e", "sighting--defe8e96-c767-4de5-969a-a19a32e3df81", "sighting--0a339346-4085-41f3-baac-2f5b1fbd1a23", "sighting--4181326c-881e-459f-8fa8-6fef2cf4f360", "sighting--9d5490bc-ddac-48bc-ac7c-5d62b0cd6fd3", "sighting--356f146d-d7ba-47a3-ae13-19ec9f344a79", "sighting--bf993700-6820-47ce-8233-00e378f1109c", "sighting--b49d1946-908f-434f-bded-294c874ca24c", "sighting--fd508729-7dcc-40b6-899b-f1d707a2e738", "sighting--0c9540ba-db19-493f-b497-3a542172868e", "sighting--547919a6-9c36-45e9-8f2b-24065e9fe329", "sighting--c62936e7-3424-4e2e-837c-ca183bcce2ee", "sighting--674309db-0795-4963-89ba-9049bad7dfb1", "sighting--5040dfb3-eeb5-43e5-b44f-235ea36ece49", "sighting--1400f03f-796f-4ddb-817c-515f59626c50", "sighting--6b24e1d9-7a21-4c38-91a5-c3e48107f39b", "sighting--a9cda0a2-e265-4b1d-bad8-3ae2afb7cfdd", "sighting--0f1e9800-3979-46a3-95ea-cf113b5f806a", "sighting--e31dcf3b-368c-40b4-8491-4a7ff1a16ef0", "sighting--0177fb4e-bede-4153-9ad3-930013764947", "sighting--5d374a05-4fd5-4e4b-9ff7-4e439941850f", "sighting--cb5b5371-1f4e-443c-9054-f96ce0c58cee", "sighting--79a0d582-8d84-43de-8c17-91ffbe066a55", "sighting--2e0bd0a4-8105-42d1-a41a-65aa97790ad7", "sighting--bd186571-66dc-4794-88aa-0e441bbd5720", "sighting--11db4c67-5f5b-493f-a27d-93e84c27d3d9", "sighting--94a936f0-4c69-4a3f-8d43-91347fdde5b4", "sighting--56c8f89b-74af-43c7-bd64-c9584f74a7ec", "sighting--1f63949d-693a-43e2-bfce-b4c5a8134c0c", "sighting--a1705a74-0b6d-4207-a193-c3fdd6faae91", "sighting--6c98a842-045d-4340-b7aa-ad4f8099ecf6", "sighting--8200a92f-ccc2-43e4-9dc1-0fc1e1514dce", "sighting--794883e9-6258-4e20-a283-b1976a94ca3f", "sighting--88db4eec-891d-415d-bee4-72c20d1fff8b", "sighting--0c4582f4-9aaf-4300-9d85-7ef7e6401fc3", "sighting--76cbf128-c68d-46e1-b7e4-b81863227fc1", "sighting--0b899c1e-b9ba-4641-b5fb-6e89bf638ae5", "sighting--7c4d7e41-e532-4f9f-94fc-6b5d6c9bde05", "sighting--295e4943-deeb-4c20-a2c3-92087b4af2dc", "sighting--d5c01b2a-f152-45e8-9eef-b24b919de2e0", "sighting--dfbd739e-1bf0-4c4d-8824-96471a9e2886", "sighting--8dbece85-65e0-4a5a-bde3-c01380f94734", "sighting--10e77baf-e75e-4f6f-a37b-120b6f6820c9", "sighting--42e17ad5-f487-446f-bf46-08746a359eb2", "sighting--aebe3ab4-3509-437d-bbab-1f51ec691270", "sighting--a4df3386-88f4-4a0e-b138-63803e2f5f4f", "sighting--4a5d233d-8f36-4a88-8b10-9109549eabbd", "sighting--e97ff16c-a004-4c0b-ab2e-eedaa7b3a34d", "sighting--3de22a41-d468-43c8-b705-44920b95e686", "sighting--565f7ca8-4840-46d1-8a3e-58ff06d5e0f6", "sighting--31343f88-33ef-4eca-a644-e53dacf31e10", "sighting--152dd86e-7774-4a70-9652-e80cdc5cb255", "sighting--d33f1315-029d-4cff-bfeb-e778d016bfe4", "sighting--15247052-632e-40d2-bc4c-301713a72ebf", "sighting--6586d618-5efd-4a00-abfa-01a9733d8d91", "sighting--894c2434-64af-48f0-a0c2-a6962f61f0c6", "sighting--257657f7-71a5-425f-8b03-b88ce2a30c11", "sighting--3e6a5d39-ba24-4d87-9197-dad945e31655", "sighting--519e3976-fb46-4216-b0a8-f331b3ba226d", "sighting--e9514252-848d-4f03-9abf-3dc81fa57ae0", "sighting--9f19f7e8-8a0a-4947-aab2-63294fb3c4b8", "sighting--f5b99090-b601-4e03-a322-cb92eec763a5", "sighting--78f95253-e50b-409c-8b06-0b56e3ed4455", "sighting--9b6732a7-c9d2-4e5d-9012-2b54f41c7662", "sighting--3e835ed3-e9e5-4ded-9066-3b4353930af1", "sighting--f4ebc420-09f2-418a-92f7-584736d56be1", "sighting--c7207d14-c5e8-4d82-9086-e659784f3de6", "sighting--4a462695-770a-4a68-8e0f-c7308258d6b8", "sighting--82950595-119e-4d03-84fd-428774d721f6", "sighting--3c9f610f-dff3-4959-8e74-a0c909ada412", "sighting--707d8901-3306-4be0-b669-4b2ea0e09718", "sighting--a10a8474-5ef5-4649-bb73-23a4903cb725", "sighting--ad748022-90d3-4f1c-bb0a-790216d0edea", "sighting--a463045b-bc51-4d63-acb3-cb2af6322743", "sighting--72c49a3d-5458-48a8-8bd1-5dfebbe15619", "sighting--2663e5ec-9a7f-46b9-a02e-a01155132bdc", "sighting--75b4b3fb-426e-470d-a0e8-ccfcc423bdc9", "sighting--e39d31e9-5610-44a9-af3c-700027f44807", "sighting--9cbae427-acce-4fc7-9b02-12a01ccdbe14", "sighting--c2ac4453-d5a9-406b-9ddd-83b61bfd9099", "sighting--339188d8-ccf6-4491-8aa0-6265c19a4bc3", "sighting--b2b9ec01-3bc1-409d-b679-84ef88993272", "sighting--5c7a8e4f-8e32-4cd9-892b-1a2d56c31795", "sighting--ca98a56a-1e60-44e0-9862-82dc5338ccb5", "sighting--48e1a6fb-87c8-4c0b-82ed-4a5098441f44", "sighting--d2aa7238-991c-4615-932e-ab7ff049d9a1", "sighting--3c3db138-406e-4ac4-9a72-6e6c7e29bfd6", "sighting--fe002d49-2407-4185-a465-00980662a6a7", "sighting--78d0c372-a5be-434d-9b08-8c048bcb2e1a", "sighting--1c29f0c3-e0b4-4d39-9074-1fa50f137a36", "sighting--1ad800da-5656-49f6-8f6e-d0a7ea2fc807", "sighting--238a077b-2db1-4618-9ab2-9dc5f6b87959", "sighting--8a4ea3e3-9091-4fd8-a11e-35d47dd7d7d4", "sighting--6c154db6-4643-4327-908b-2cddec0f73b7", "sighting--422accc0-51f6-4b68-98fc-817fe9a1a246", "sighting--1511237b-6a02-49a9-bb4f-5eeb7b1ed992", "sighting--13fd5f36-57ab-422a-8036-e7216b448881", "sighting--f2bb0ca7-30c6-410f-855c-8d4d30a280aa", "sighting--ea990ca0-9310-4319-b4c2-f9444ef59a13", "sighting--bc430664-d767-48d5-9c36-d293cb618bd5", "sighting--c19675e1-2abb-43c0-8fdd-2ab8f9c20363", "sighting--84ca42ab-d615-44e6-94ba-ef01657ed3f2", "sighting--a9cce9bf-cfbf-485b-a027-dfba238186f8", "sighting--c53b7305-8193-403b-b72a-cf2932ec73b0", "sighting--070e396e-fe95-42bf-84f3-1e37216f4859", "sighting--769560c2-8450-4ee9-9384-ffc8fa8c9aa1", "sighting--ad3bb274-d721-4511-8677-67534da9d086", "sighting--65d1a702-3fd5-436c-b161-dcc21b260765", "sighting--d70b30ee-72c1-463e-b754-3b7e42be8818", "sighting--53b41c5a-d8d1-43aa-8926-66f17095fe98", "sighting--da0274bd-d9a6-4acd-81dd-db586c186310", "sighting--738754f1-7369-4591-95ed-65cc4263ef2b", "sighting--048351ff-dca7-43e9-8181-20ffa9163ffb", "sighting--a0e244b2-e419-4383-b8fc-88c50dd653b7", "sighting--420eab23-0386-4f26-8e98-460751b23fc7", "sighting--603586f4-5f6e-4b82-9f31-664ce8e79aae", "sighting--c9f60e00-1e46-4054-ae8b-0c482f9a1598", "sighting--428bcdf9-552e-4b25-90a3-957d2c6bfcf4", "sighting--835db29b-c76c-4434-9e39-ac29c3ace022", "sighting--82394113-f50a-4647-8d41-2a59fad4f1e5", "sighting--8dabbdd8-499c-4a4a-812a-d66016cb2e86", "sighting--57f7345d-6f03-4856-ae6e-07e7db4689c5", "sighting--4dabc765-9076-4cc7-ae08-0d188e4bb5c9", "sighting--d0bc61c1-1474-4517-87c0-3e271d61b7b4", "sighting--9009799c-0397-456b-a79a-ec979bdda2e7", "sighting--762beacf-582b-4893-b4a3-40ca28c9483d", "sighting--21dde9e4-454d-400a-b98a-35101fb8697b", "sighting--2fdc10d8-907f-4474-9670-0d1c4f5ead6b", "sighting--b3b5bf01-2c48-4e76-92e5-49826314151c", "sighting--1e7def59-2113-4cfa-9fc6-a749d8e08fc7", "sighting--cf8a683c-8ab7-4efa-ad54-75e939f955fe", "sighting--b18ea51f-4d07-4da4-bc88-228d881f7e00", "sighting--04d71869-b25a-41a8-96fc-6abc9ae47683", "sighting--c631c9a2-6136-47ba-af4b-45eda716d739", "sighting--c83a3daa-a432-46a4-aad9-c54b0bc29006", "sighting--57881da4-58f8-4f2d-9d94-b274eef2dacc", "sighting--534b40fd-8b9f-4883-a274-466deea0c9ab", "sighting--53c903f1-26ec-495a-9411-3ca74f12be41", "sighting--6beac0d7-d7c1-4d71-b113-181cec729e0b", "sighting--71e92169-9a45-42f3-a19c-31004d0a38b5", "sighting--a6b3f1c8-cbc6-4b18-a9b3-172a0795d7f0", "sighting--fee1d406-f7b3-41cd-b595-3ae6967f565c", "sighting--87f0ba43-e8a9-4ad9-8613-3bf8c8180d66", "sighting--bd4a5769-1109-406d-9d69-e2bbc8423905", "sighting--f13e2f89-461e-49d0-aebe-1a3976390f63", "sighting--8a4370c7-e22b-4c43-bd95-e849ded1bce9", "sighting--c2ca3d71-ef1d-4bcb-84fe-d10203368d8f", "sighting--3e9cace1-c4ad-4b0d-882f-196ef081637f", "sighting--d9318de9-acc7-4ec9-a307-1779674e692b", "sighting--bdfc439a-73cb-4dd3-bfc2-f7b3b31b9d01", "sighting--b8e278c6-ac6d-4944-a068-d5369792febb", "sighting--5aa1a2d3-428d-43ca-a776-dd89d03e1f1e", "sighting--052f20c7-916c-420c-bd69-639892916e18", "sighting--cb4c6f1d-17e1-4d75-8bfd-d3baa16e5194", "sighting--09c80412-9d5d-4c36-a5eb-34a396497936", "sighting--09b182ce-e806-49ab-aeb9-ae148016cbd1", "sighting--b15b1cb9-90eb-4627-802f-185dc0a45b85", "sighting--f0fc79d2-9b1a-47b3-bf6a-5831cff112f3", "sighting--d8637403-a555-4b5e-94dd-6aefd29f0f78", "sighting--320a65c6-886c-4c99-a9dc-dee604694f6a", "sighting--ac0f08b2-e6fd-4205-8bc4-81d5169c2dbe", "sighting--9b34f87a-833d-4f35-acbc-8d8da6707f46", "sighting--3718a021-f6f2-4e32-9419-b30818411e67", "sighting--a6fd2c60-fb2f-4f94-9ef6-02c8deca2897", "sighting--928a5e78-7841-497d-8868-98a959c0b590", "sighting--ea31b237-71f7-421c-9b60-e46dbd15f907", "sighting--e13cf3df-2f18-4858-8882-233dee3df806", "sighting--b0852b74-fb84-43de-a405-59ba1adb5815", "sighting--8793dd51-43b7-45b6-9358-bf64cff92963", "sighting--d0c7d735-3573-4ffe-9401-f7e5f903fbac", "sighting--96606ce2-b98f-47af-80f5-0df1bba5ec9f", "sighting--a78a778c-f133-441d-8ca7-3c3e4c22b633", "sighting--66358ec4-9589-42e0-81fe-058b82d27361", "sighting--35aeee2b-5392-40da-a6e6-ea3093b3d7c9", "sighting--167f4f52-a882-4425-8527-bf4989656a41", "sighting--16d8dcad-dbb7-46c2-8888-aba75b85d5d5", "sighting--12bf6363-f4cb-4aa5-af74-d4af22415533", "sighting--da5e35b6-3256-425f-80d7-91d351b6a1db", "sighting--3617dfc8-c2d6-498d-9562-af7e342f3f18", "sighting--3c5e4e0b-2e89-4619-af46-a2fe109885a6", "sighting--4b3febd7-a70f-400f-b446-91f66b0f2386", "sighting--7ec87ced-7afa-4f87-a24d-a3d04db9659f", "sighting--90b4e697-a364-4899-858e-f441008b9c6c", "sighting--ccc9065e-8a98-4a1b-b4f8-9507859f9737", "sighting--46624ec6-65cc-4c4f-bf64-65f8246c4a99", "sighting--519e3ce7-196b-4911-b409-90ce2503da8a", "sighting--a3c64534-9dc9-4ccc-bd8e-05aa65da53f2", "sighting--cd51dcd6-ad34-4364-878a-0323b0b28aa8", "sighting--2553b3a4-4612-4572-b71e-45254e249b99", "sighting--a36f5f62-b6da-4bb0-a5e1-8e3161d0caba", "sighting--dc3f1fad-8903-41f5-92ec-d1a86764e90b", "sighting--a6d7baef-d688-4d58-89c0-f41fed4dec2b", "sighting--8dfcd7b7-5968-4484-9fdf-60330505f2e5", "sighting--7016546e-db56-4310-9c45-0d9ced50b53b", "sighting--f5750d35-f942-436a-b410-c84dc5d3c2af", "sighting--5869629d-743f-4a56-a3af-bd10b51d6dc3", "sighting--74b375dc-766b-460b-80c3-ed69b43c13d7", "sighting--93dd1606-095e-4541-a57b-535b95ec18d9", "sighting--2b5a6e45-f32d-467f-8e73-a7889bc8188a", "sighting--6507b804-37da-4ec5-9415-3bba3c29b68d", "sighting--586f5107-9412-4e13-8856-1c368c08bec6", "sighting--a8f95a36-b229-47d4-a026-3edaac780a9e", "sighting--3e970d47-d6d6-4643-831b-e6b4a9d1e1ac", "sighting--223d7e4c-e97c-4b00-87c9-d8cc9131b064", "sighting--8516bd29-3ff2-4830-86ba-f2f82fb59e50", "sighting--021948e3-36d6-4042-afc3-04fc632374b7", "sighting--2e1ab391-7d5b-4c97-b7f8-346869eb9cd8", "sighting--b3217722-c090-440a-a085-f397ec2f3de1", "sighting--39f840e6-e4b9-4764-bd30-887d875b1785", "sighting--338ecffd-e275-401c-869e-d6cd744c2c23", "sighting--5ee69c06-e52d-49c3-b4bf-16d23b7336fd", "sighting--ebd8f996-f1b5-4073-ba19-eb656cf2f409", "sighting--f20d6da6-e996-49ff-b7eb-608fe832bf67", "sighting--3b76a2fb-433e-48af-8337-2c4899896fe5", "sighting--7d0f4a0b-a60b-4f49-a9d1-afd6db9e7384", "sighting--a97abc7a-79cd-4ba8-90f0-233be06c1184", "sighting--d8b7a515-1d9b-4fe3-946c-6a40c7161d7e", "sighting--30ea49d6-bd32-4b2e-a450-dddf5632391c", "sighting--2977648d-96c0-4560-9eb7-255ea7216d8f", "sighting--bdd08cb3-59cb-4333-b13f-19343a7e812b", "sighting--883a40f3-7840-42ad-bb12-3150d60bce7d", "sighting--8cd348ea-d4dd-45be-8fed-0419021423c8", "sighting--cee79d87-a063-4e13-ac88-bcf886b67e7c", "sighting--c4555628-283f-4c2b-90c6-ee1b5d060ac9", "sighting--d048a863-095f-4436-b75d-1d8ca6fa430d", "sighting--930207e2-3fdf-47cb-987f-0b6dcd1b3243", "sighting--d69915ab-3d6e-4a32-a722-336017739a22", "sighting--1a4133b2-a912-44c6-99c3-9c733c7cead8", "sighting--37dc3cd7-6b53-47be-8364-8c0ae468cfb0", "sighting--f27fb035-a2a8-4afb-b651-dd6899a78973", "sighting--0cf02bc7-fa83-442a-a0ac-13b614806a3b", "sighting--45fa1137-6b65-4fbf-b6c5-2becf2eec5a8", "sighting--28752039-a253-4fd3-889a-7234a9dac68e", "sighting--f22f7fd9-31b8-4006-92c8-18e144e0c8d8", "sighting--07b19c6a-0799-49ab-b6ca-62f9cfbabceb", "sighting--b8b2c1d4-ab45-4cf2-ae62-55e38df83c6b", "sighting--877e3d1f-1972-49e5-9a72-d8f5d506b3c0", "sighting--9ad30058-97c9-4a56-aa9c-9e5a300f8911", "sighting--a56cf88d-6a0f-4f3d-a62b-5e641b6805af", "sighting--a446f332-ed4d-45fa-9f9a-12a849be23eb", "sighting--195cd498-2642-47ee-8cfe-4aff50061417", "sighting--dd992947-7f4c-4818-8742-bdd117b7e060", "sighting--549cdd49-e9cb-4084-8b70-1667043779e7", "sighting--3913696e-72e5-4abf-afa5-b179eaea1c70", "sighting--fd5061a8-7511-434c-9d1b-35155523ee06", "sighting--d285b346-998d-46e1-b826-aa4e4fd502ed", "sighting--b997b985-467c-4510-adab-476e20006b07", "sighting--974978c5-5e77-4879-b545-fe41cd128acb", "sighting--ebacc519-9ed6-46fc-95e7-ae85eaca266c", "sighting--aece25bb-4f79-4dc1-877e-b0c59093d3e4", "sighting--489c4974-7c47-4d9f-b787-26858c5d7561", "sighting--4b490a60-e7a0-4635-9018-3f5f63cfaced", "sighting--81ae18ce-4f0f-40cb-bc85-1497d69ac48b", "sighting--2e4c11c4-59ff-4605-ba52-b9dc3aae621b", "sighting--0f54d882-fda7-48e6-8495-6961426f53b9", "sighting--cb40c5e4-9601-45a9-b7ff-33b1ee4cd16a", "sighting--929b2dfc-da0f-420f-931c-591ef51946f0", "sighting--9ae6ea63-6746-40cf-989d-3d9e4456c4c7", "sighting--6ae8eb1c-4669-435c-85b2-e0c94550feb1", "sighting--66c08e59-5417-4f5e-9d2e-f4005d68c967", "sighting--0f9bc080-d2f1-4b80-84a8-6aef07b0e77c", "sighting--950aca12-9612-4ce8-8f67-e8ac5a22a2ee", "sighting--f8b3f1a5-298a-4f80-9f21-ab1cb544dbf4", "sighting--ca574006-9429-4f85-a1b9-6c41f7184ca8", "sighting--83a51e2a-a644-4cee-b262-535f613591e4", "sighting--90d3ea70-0efa-41de-b50c-61ccf7639d34", "sighting--d887c185-4b4c-4b4e-829f-907dd46d7ba0", "sighting--f33ed0b0-a09b-4c5d-b5d1-03b787a4b4da", "sighting--959fa14b-ef1f-4874-9bfb-96f4b94987ac", "sighting--d64c1358-7de5-4f13-90aa-ded8f6ba5982", "sighting--2db913f4-bb0b-424e-bdd8-5b5a613dce96", "sighting--e9dd6b4b-58e1-43b6-b182-fe0474edd6ed", "sighting--90d271ef-4a25-4f9b-a444-df436c85ffce", "sighting--4a171906-cd92-4348-a934-ffc56aaede68", "sighting--23776de7-a570-4bd2-a9cb-60c038ca1daf", "sighting--6ce3aa6d-e994-4f1f-9b84-09ce7f55240e", "sighting--8a1a2bf7-bb95-485b-8b86-a8dba022ee72", "sighting--055e40ba-3155-4d83-9a5a-8f3aa73ca921", "sighting--ae909c93-c659-4ef3-a206-15a0de8d868f", "sighting--a6a2d7ac-bbac-4cd2-816f-896d5792d655", "sighting--7b18fc45-7db6-4b6f-939f-740ffecb7740", "sighting--09dac08a-e0da-4f2d-a332-146f38e63816", "sighting--34291faf-88f5-4db6-bc88-1ef2f63364b3", "sighting--f0730d9d-cfe4-4fb8-a827-75e6d3ee9f50", "sighting--708a66ac-0f06-4fe9-9c38-681f76d8f2b4", "sighting--9ebd3c75-b3f9-4f23-aee9-e751b6ef4283", "sighting--16a8ce23-d3e4-416a-be2b-ba15d37ac0ed", "sighting--2e2ef681-36c4-4147-ad40-d9b7e127aa05", "sighting--e56e4ffc-3554-4fd2-bb70-990cd72473c1", "sighting--b1453ca3-8122-4595-b239-052d64f877d2", "sighting--2ceff50f-58a6-476c-972a-b435057b632e", "sighting--106932d1-4718-47b8-8d48-5069c099d4fd", "sighting--fa98f616-3f3f-44b5-9a09-517c32558e78", "sighting--2a9124b7-6a27-475a-b4ed-0c938a9cd33b", "sighting--c5498a62-da4c-4ba4-bc0b-f90106e129f1", "sighting--084ccea3-8c0e-49e3-a346-b2d232238e78", "sighting--cb27b455-853c-4901-aba3-ad3bf25d9b0e", "sighting--724b458a-6772-4e44-b44c-9119b087144b", "sighting--615db064-27d7-41e3-a5f5-ded1a5f8166b", "sighting--23833041-715f-4349-b1f7-805d4dade3fe", "sighting--12f1bfd5-14ac-4c63-8015-09e2fda2f97c", "sighting--481369c3-31cf-43e3-996b-53bdcc283f87", "sighting--291c9f32-235c-4cb4-a808-2311cac9de9c", "sighting--e2bb8300-425b-4309-a9b7-94af3bf90c0d", "sighting--e0cb2ea6-16bc-4d45-8081-707fd0d65990", "sighting--3f615222-ecaa-46a6-9d49-da7f345c7e6d", "sighting--5b6f2f58-dcd3-40bc-b2f1-d7875248e46c", "sighting--81fe1f56-ce7c-4d65-9ec7-2912243ffbaa", "sighting--da7763ee-d753-4139-8955-f22a010471a4", "sighting--f3b65994-a4f5-424d-839a-c0b73c9f5f4c", "sighting--7a430f9d-c00e-4b10-b0be-0cbfde98e4a3", "sighting--d9cf2ef1-84f7-4372-8930-32d613136bef", "sighting--c717bafe-abe6-4b1a-a0a6-d18c2042d3a2", "sighting--f2e16bdb-5cb9-490a-b959-1174926e729c", "sighting--6ef025f7-414a-4de4-a6ec-4d845c37c429", "sighting--6057b409-5080-48d0-b0d1-539c0794e1d6", "sighting--46b69092-3412-42c6-a2e8-1c4dbe3c6957", "sighting--a162d98a-0796-400a-99b7-48fb3a4d312a", "sighting--97a1060a-2d0a-4b92-a5fd-c2cebc802434", "sighting--952cda92-1cd5-4b20-8e93-f05db58c5199", "sighting--e5cb507b-eeca-4e8c-86d1-6de50e24bf65", "sighting--bddf0f87-9a44-42e6-9705-5c72e8adbbb2", "sighting--7260d20a-ae70-452f-816c-14ef03699427", "sighting--b92fbdfe-e878-4089-803a-a43733fc8c0e", "sighting--bdd55655-ea8f-4f9d-8df3-770ce0eafc5c", "sighting--b24cb6f8-d06f-4915-bfbe-3e955895d53b", "sighting--dcb40e24-2802-4984-8e59-85c217f7b96a", "sighting--4d5e1869-0e95-4b54-a267-480739a1954c", "sighting--a9f43018-c70b-454e-bc0a-52a6a8e5c521", "sighting--6b4da21e-8e88-48f8-b59b-e8c7e90aaf47", "sighting--5423d202-a54d-469d-8e63-bbacc479061b", "sighting--5a21c5d3-dc0a-497f-9319-58a3e1bc2576", "sighting--9f8285cb-b7e2-4697-b196-099d74e6cde0", "sighting--2452f34b-34df-4542-b092-23e4ec56d5f8", "sighting--37f1c915-5605-45fc-9ee5-d47de87252be", "sighting--869d4157-af0c-40d3-8a5b-c09a1cc4669b", "sighting--e46a32a4-d764-407b-967b-fa2ebf129b27", "sighting--2db967fa-dac7-40f8-872e-9f32409da200", "sighting--25eb55e3-9bc1-4e7a-8d17-63533810cbd1", "sighting--2911c769-4e52-4fb1-a10e-17b882092332", "sighting--8969106e-e2a6-41f1-ae96-7a3be7c13774", "sighting--afe7b145-661e-49b6-a0d7-5cc7fd2045f1", "sighting--8469650a-a097-44cf-a356-daa84296d0e9", "sighting--17eb557e-f2c5-459f-9885-9c2794ab18b8", "sighting--7349f413-4c43-4fa3-bd9e-5b371fee9b77", "sighting--713ace04-7e09-4b2a-ab00-1f4af07533e8", "sighting--749beb50-a8ce-439a-9202-280142bd964f", "sighting--00087530-043c-4d17-b619-68352dd33bb7", "sighting--0e6a7761-be7c-47a4-bc85-11a7d71829e6", "sighting--a6290021-abf9-43cb-a06f-c5efa82fc1af", "sighting--9b1ca871-ab00-4281-af38-1d992eaed65a", "sighting--a058b6be-da28-48d8-b366-cbdbab1076ae", "sighting--a91781e8-b24d-41f2-baa2-2d8a1ee61df8", "sighting--e2b1807d-84b3-4eef-bad0-c7bcd90d0c42", "sighting--67123b35-bd5a-4eef-8aa8-eae9ba27a661", "sighting--2e7cae1b-6875-4cc1-8d69-853d02edbf36", "sighting--1ae01b81-c876-45be-8910-762936626d20", "sighting--7632ea77-933f-41d2-9f29-52bb3c0ad95f", "sighting--99b7afaa-f197-4ae5-ae38-0aabdf9deb28", "sighting--f8432d26-7243-4024-84ba-9a0a8f2970f6", "sighting--91a89fd3-d98d-456e-99c1-43046328d93e", "sighting--88e6b452-9def-4e86-8a86-ea94bb90e732", "sighting--b13335ef-77bc-4aa9-ba44-2883c80652be", "sighting--3d4b1a8d-48d0-4db8-ad66-dedb789bc361", "sighting--6aae87a5-6828-4a53-b063-5eac8d09f3f6", "sighting--ecda297b-1832-47b8-8a98-811a2469aa45", "sighting--6d62a867-b60a-4a88-b554-8e135af3c5f4", "sighting--511f4b17-fcae-4e93-95c5-62fe18c8826b", "sighting--7cab222a-bf49-4082-bd64-a152c79e91c7", "sighting--ca80076d-89c4-45bb-932a-70c5663dbca1", "sighting--174dacf8-a082-40b6-b2fa-a57c0b9b60c0", "sighting--cd44ed30-201c-42a5-a2dd-011fdcb996d0", "sighting--341d9986-8abd-46fc-b80c-f47a1ea150aa", "sighting--5f33a2ba-36f5-41db-802b-89b064312aea", "sighting--a25f5407-ef59-4f47-880d-67123694ff9d", "sighting--0844d518-1e88-4e38-84d2-5ed2f13ddbce", "sighting--667fbf25-5b8d-40ec-aa33-b186a05195e8", "sighting--7bed45f2-54fb-4bb1-b7f3-d034f2b20406", "sighting--07494ee5-ef72-4c35-ba2d-7197e449d28d", "sighting--2e9a86a2-a643-496c-9af2-b7d960d5ac3c", "sighting--f1198858-8488-4ae8-8161-853701fa49e4", "sighting--a3a2fe76-af57-4650-9878-023eab81c743", "sighting--8942c988-01a7-40e3-ab4f-e97718e2a28d", "sighting--85a20022-d332-4992-8ada-2247515498b6", "sighting--616be997-2c2d-4488-b6f4-e40f5762168f", "sighting--69bbfd87-9053-4dc4-ae80-dfe01d53469e", "sighting--92668ef1-3b3f-4e2f-b7e6-d97d28d23769", "sighting--829c3157-6b97-4173-a64a-817ffec4fe5c", "sighting--dba01b79-9236-486e-8313-a37756ae0783", "sighting--0c95e89a-77aa-4c34-abd8-0e46d1e1182c", "sighting--cd192d19-d5f4-489f-b608-a5bee8c1c0ff", "sighting--948f5051-2209-445f-b310-40e8a4ae44e3", "sighting--da0de3c1-5e0b-48ba-ba1d-33ebaa9fee57", "sighting--72461407-276b-4357-a7e2-e14ca3043d99", "sighting--2b7faffb-6e5b-4f8c-8744-66421800299c", "sighting--4e7333ef-e1fb-48e2-8b42-2806f86e266a", "sighting--d66be159-e860-4d2f-97a1-8a0797233721", "sighting--13837623-d945-4a47-947e-a16b9c59edf2", "sighting--31ebc448-cf7b-491b-8562-3c4e00015f70", "sighting--8f1f8794-ab08-4ac5-939a-b4729999b04b", "sighting--850bc673-a373-4235-8aa7-031a36f6d1bd", "sighting--61a016ee-4d28-4e2f-a27f-84733b46f050", "sighting--fc2f5124-e755-4d21-b1c0-1974ae144510", "sighting--94cc75a5-e17a-48c6-b027-6c423bc9019c", "sighting--99d0883a-88d2-4ccc-8fa8-ce5b60fb6ce7", "sighting--29cbb50e-41d4-4c36-8cfa-a3ab449d80a7", "sighting--dbc16300-7258-4efc-81af-00a7bb214a1e", "sighting--72fd4e1f-cb8b-4b9a-9aa2-40ac47baa1b1", "sighting--4001aff3-c9aa-48c7-9409-96566e36cf91", "sighting--419c8fa8-73c7-4700-af23-f97baee7f0e7", "sighting--2ba3047c-e740-4cd4-a61c-129bc016a23e", "sighting--154346d8-fd05-487f-ac1c-d228dda0face", "sighting--6533df4a-9c86-43e9-9a7f-f21927b7ef75", "sighting--ff8c17ba-d42e-4595-9e5a-47e103a9e9dd", "sighting--4b6c6c5d-e3e1-4650-b9c1-41d7cd702f2f", "sighting--2352ec78-fad7-49f3-94f2-262798c70fb6", "sighting--07e50ad5-d212-44ff-ad55-56e174f1d4a7", "sighting--a1470516-c914-4423-951e-67e64b1c65f1", "sighting--8ad5230c-93d6-4404-8faa-87f6dc82a677", "sighting--1d05890a-9fda-4a17-9cdb-62f8eb7b7692", "sighting--2560d05e-68cb-4061-a1ba-c525ab6e1b37", "sighting--75308ca2-8f6d-4f46-bab1-c9e17735d793", "sighting--6a7fa336-5350-455c-a4c9-3c805e420b5e", "sighting--8650d52f-ed02-4ffb-8d91-0ba69c7ee302", "sighting--ae36251b-b179-42d2-89e6-c68431d72ea8", "sighting--e6d2125a-2a35-405a-8b37-833788d3e9e7", "sighting--8ea1e2ed-9643-4aac-a3a2-173fafef258e", "sighting--bdea6e5d-cb46-4b3e-b8f0-3b6e7b846dba", "sighting--e5513ba3-3e52-4462-8a2d-3d4eeb2b6d41", "sighting--d99261d9-6b56-4a9f-ac26-e31794fd9ae6", "sighting--c796eea0-4a6f-41fc-a8a7-b0381774ae76", "sighting--a8a88440-bf89-491d-b806-6dd47a3a07d2", "sighting--8040a565-4fef-4a56-9d42-f8a77afa6b2f", "sighting--ee4ce11b-a713-437d-98c2-ab7f70331f8e", "sighting--46b8712b-6068-48b1-997f-d4698084653e", "sighting--34d86d47-be69-4ed1-9151-50fc7d2c1e16", "sighting--5ec7c58f-5108-4bb4-9ab9-32912eaa9c04", "sighting--c0f54e3c-3ed6-4995-93b1-426e3019f7c9", "sighting--3530b9c2-15d5-4e14-9462-22ff5d8f6d13", "sighting--ae4bf443-0231-491c-b4e8-1a7eec071b99", "sighting--c6c2afdb-f072-4f06-9998-9aa9ca7fda55", "sighting--1e6e030d-18fa-4a16-a2e3-7da61f9b0a57", "sighting--d8d62301-a2eb-4217-bedc-cee390e1e583", "sighting--dd820d8e-56e8-4110-8514-e517f3c36b79", "sighting--cc2b93b0-2647-4494-859a-ea163bf0e2b8", "sighting--b1fb809a-8fb7-4aae-9a6f-c48affae98d5", "sighting--b94343e2-41c0-440d-81ef-604623f78ab7", "sighting--342b366c-734e-41ad-9ed7-2b28ca192e44", "sighting--48413388-58c2-499c-8ef7-c51bb07ed5a7", "sighting--d75d82f3-0244-4901-bc4a-3c2db08266ae", "sighting--89775931-2743-459e-9ff3-c36e8f75ee24", "sighting--2484c7a4-49ad-4bde-8d0e-8bca30e72218", "sighting--30954a9c-b7c6-4774-8e66-84fcadb9560d", "sighting--7935457f-bcda-4446-be57-2dd927ef6463", "sighting--54a29115-9c4a-4820-9ace-1bef49569ba4", "sighting--b7840211-2fef-4573-bcca-01761bd00b05", "sighting--cdf012b0-f386-45bf-b101-bcd6361eb45f", "sighting--a82642c8-7d7b-4c85-bf93-52ffdae115ab", "sighting--9b0cba25-231a-4264-868a-8bc525bcef2d", "sighting--1c245100-c077-47af-817f-113c1c11d32a", "sighting--61fe0360-d539-4d82-a0a1-da459c658386", "sighting--d658b1d5-38b4-4dbe-a7d9-1b435421666d", "sighting--9e51a46f-52cd-497e-8574-a67f70f48cfd", "sighting--8eb4e94c-986f-486f-ac40-1a8893a55643", "sighting--66f83774-8a9d-423b-90a5-3e15befbcb39", "sighting--52bf36f0-9138-4930-b8de-37d5ec8eac19", "sighting--19907dc7-bdf6-460f-bba3-02206344e72e", "sighting--835cd81b-112c-43ac-b684-58d80fe33e24", "sighting--7a11acea-b4e7-454a-8fe3-c172215db8af", "sighting--4c03f8b3-5f39-4641-8693-5d7ab94e74a2", "sighting--6f8c0aa0-2fd7-460e-9202-7cc5932f7bbb", "sighting--dc3dd4b0-c2c7-4b5c-b167-c0d77c23eebb", "sighting--116293d8-200e-4fca-9dda-9cd8cb1add51", "sighting--58cc6f22-684b-451c-a9de-21d96edcfc41", "sighting--af657ab4-4bce-4104-8156-41e08bd141df", "sighting--291a36ce-60e7-4bb9-b20e-ba9e2b85fdb1", "sighting--7e1cd146-2954-43ae-83c4-60dfed950dfa", "sighting--d6dffa3e-5359-4547-9ad9-5a13e63f21aa", "sighting--725dd93a-4aa7-48d0-9fda-56c75694c9e2", "sighting--f500105e-5d84-4bb9-a2e2-ce07a1603e1d", "sighting--7586e81a-2235-412b-af60-e96d7b32d9be", "sighting--e59a363e-e097-4e1e-9c5c-9ff297fb67ed", "sighting--304d2fda-d168-4a08-ac9d-3763ac25722d", "sighting--3921b2bb-1b43-4200-92d8-dc10c9061422", "sighting--0cd9fc0c-60f9-45a4-872d-15a4d331f54c", "sighting--f6c87472-3e40-40b2-bca7-80f4fec7fcbc", "sighting--29b51793-6990-4f69-b1cf-367e88284638", "sighting--c8514835-a925-4092-95b4-b438d370c620", "sighting--957d2453-7104-4ee3-a871-735002f4a8fe", "sighting--aafef490-14b6-4979-8748-116851fcc301", "sighting--0ff56ac5-ac7a-44fd-be70-0db6c22930c9", "sighting--8d3428bf-801e-4984-a9fe-460ee4aa9106", "sighting--0c60b058-630e-4252-8b56-d9ad6c86c3d1", "sighting--cdc6af73-832b-4178-8f56-bc98991a47ce", "sighting--5338464e-baf5-4876-8d21-8e1cddc4ea92", "sighting--34354396-0bde-4503-b57a-a6c95efd9e9f", "sighting--7505ad75-8d74-407f-880c-3a42f854f7e9", "sighting--6d05a1e4-a320-4208-824c-3c34c5b607b7", "sighting--ac3b7647-a1d6-4857-8251-da2c9eeb5b04", "sighting--78bfc605-682d-49b6-95c9-a3c965bde74a", "sighting--54f6f7c4-c937-4967-92c3-608a15c81230", "sighting--ac40d852-3f89-4d1d-ab6c-80cff693f6de", "sighting--0057a669-d599-46d5-a5f8-3dc0c13dbc09", "sighting--4544fa8c-0de6-4eaa-b659-bb12f0b5282f", "sighting--8e62385d-b7f3-47f6-89c0-146bd40edad0", "sighting--6ef89fd3-de3d-4a58-bab2-03f00c89be0b", "sighting--aadace80-5c69-4dbe-9f54-281045c9b91f", "sighting--f00a9e31-144b-42e9-804b-8c7818574c75", "sighting--e116a41e-3a0e-4bc3-9c80-242675782c96", "sighting--d10f3bed-9bbe-4ce4-9e66-e0041f4ae2a9", "sighting--c5e48db8-4f02-4d9b-996b-d49d84921aa1", "sighting--c4cc7a4b-fb49-449e-8386-948889b6ba57", "sighting--c61b83b4-1173-4441-8ecc-86620b2e7dd6", "sighting--949115c1-e557-4d00-be57-bf5ddbb37a70", "sighting--f200f14f-97d4-4191-84c8-c10b2893f7bd", "sighting--794cb11d-0298-41e3-a375-58c0fe292594", "sighting--236bcec3-0761-4bbf-a6d7-a7c24dd61dca", "sighting--f5e0be95-cf3a-4c37-b20e-aa15914f5146", "sighting--859ae591-de8a-46c3-a321-59a75a8664ba", "sighting--41844d0e-49e5-4dd6-b50a-9fcbcd338246", "sighting--403aad44-2930-46ab-b375-de7f7d45faf5", "sighting--2848b730-baf3-45ea-ad6e-75992291ca56", "sighting--81bbd4bd-52e4-43cc-ad82-6be4d1fb9d5e", "sighting--feb17c65-d5f8-4c9c-b660-db37386b7453", "sighting--b22f1c4c-ab06-44ee-ade9-8065f503f883", "sighting--31fef37a-193c-4d3f-a0c2-c30db1429d6f", "sighting--d85c1ffc-7ca8-403e-b915-72595570305d", "sighting--5182efb9-0bdb-4091-92f7-415f1c320e66", "sighting--6ecd8641-1492-4b99-bc5c-0fb5c1a4599f", "sighting--b77b4264-cfe6-4c8e-b6db-944254bcc529", "sighting--ad66a861-5765-4487-9de3-7d343bdf51d9", "sighting--8f2e23e7-2c01-470e-8ce1-7ada6988b82b", "sighting--836c5e76-596f-47e0-82c6-18f4cd2ed00d", "sighting--b17d41ff-45cc-496b-a849-07d80b3a17f0", "sighting--fda2d0bc-0850-4281-ad03-49174252a914", "sighting--e932068a-8d19-4b2c-b723-ba88b639deb5", "sighting--ababe294-c8e3-48c8-b440-b255c8a44019", "sighting--c2b506dc-6533-4fdb-9716-9681eddad2d6", "sighting--2338b38a-6440-407e-8d95-3f08e819fa73", "sighting--fb8e4960-3c27-4a55-83a3-ead6ffdee435", "sighting--d6caec8f-4c3d-4554-a2f0-f9b7a6fbb8ab", "sighting--7a7aeec2-4de0-4d06-82e7-1ddcb34fb772", "sighting--ed2a7da4-935c-4b4c-b7a2-1c50a1eb294f", "sighting--1ebd0641-9c1d-408a-a8d0-d80f673a386c", "sighting--f2845a0c-623d-488e-a145-c1159c5f5141", "sighting--b0eb29b2-592f-4109-b19c-6867edaf6f04", "sighting--a72c06ad-6e14-4dc9-973f-4397f4b6c0ed", "sighting--ff3393cb-04de-4fec-ad8a-69d539d6931e", "sighting--48ddc1f3-9968-4210-a544-acbc08de789d", "sighting--a0574a8f-8871-472f-956a-f3d359b229b3", "sighting--f69e49be-74f1-4943-b348-175e23fed87a", "sighting--5e8ab235-8c0e-4372-8d64-3383604e9dc4", "sighting--0ec2304b-472c-49e2-8e3e-64a1e6c4da31", "sighting--86452fae-c62f-4edd-8c00-e03624fa6226", "sighting--b4dc46ff-d3d5-4fe4-b4e1-3f93f2086a34", "sighting--3f8ce056-a434-4950-8331-cef56a9bf33e", "sighting--028f01b2-87c1-4f29-94c4-86550a63b0d7", "sighting--32ddc742-200b-4581-9320-25f4b539a026", "sighting--fa191d14-a44e-4655-a033-15a6aac1e1d5", "sighting--332be6ba-1775-4a57-8d71-8572a1e8d246", "sighting--6dcf654e-6167-45cc-9669-ba84bda91adf", "sighting--7eaaf0b0-adc9-4268-abb7-bc74fb322261", "sighting--3f9deb13-395a-4587-9f84-1cfcc709b5a9", "sighting--3aad5643-39ff-4065-8a27-ae6649adef3c", "sighting--d69e2e76-9d50-473e-b0a7-e2e025fe5d39", "sighting--b3153634-96bf-4f5a-bcfb-56580d36c471", "sighting--65a798b1-b1e8-4115-9ce5-f824961ee707", "sighting--cd3cb3d5-5ab9-402f-84ff-45ea8f0c630f", "sighting--d42c4841-354b-4eae-970c-91648dae679a", "sighting--218b5867-8c13-41dc-8335-1457c9d123d2", "sighting--864101e2-a674-4bde-99ff-5ecbc0a8ba6e", "sighting--2ae8ba3b-6d7a-4f10-a625-3f87b8ec7c34", "sighting--389a923e-cfce-4ffd-8a38-3fd347e77a5d", "sighting--40debe3a-1349-4fbb-a1e4-8a5bc25ebe84", "sighting--61ef6a5a-157e-4922-943d-5b8c51a90ecc", "sighting--c202a89f-9d15-4f68-ba12-a067abe6dfde", "sighting--84ed17ab-f162-4538-b40a-29093f83d091", "sighting--124a97fe-10b1-42f5-b691-5e8cf0f3c6ca", "sighting--0c9b38de-e510-44d1-8ea2-d8f46f2b8880", "sighting--0064d9c7-5223-4e36-9529-b68125c31f6c", "sighting--961889ef-7938-4ce7-8fc1-4827d7d88aa4", "sighting--61ad33ab-2139-41cc-9793-81eeb87fd877", "sighting--b50dbfc0-e17c-4ee9-bc17-6bf81731ce0e", "sighting--f70d4427-1582-41a1-9752-2fe3a34d4cf7", "sighting--2fe0924c-1fa4-4fbe-9a56-5a6532632933", "sighting--1c89c0b9-7a89-40f0-bffd-0b982f6fb759", "sighting--0fee1679-856f-49d6-a614-8c6b9f2e1ee8", "sighting--97adb66e-deba-45a2-8f54-986954d0f081", "sighting--d982ec84-8388-4c1d-9212-16bc5f85dade", "sighting--552b9eae-d9ff-4b64-ace0-d7caabe945fd", "sighting--518df8de-e3c8-4331-b209-7124372db54e", "sighting--3783e27f-37a5-4e97-b3ac-eee24a54ab23", "sighting--3e45dce8-5873-44b9-ac1c-a56392c24197", "sighting--6029351c-681f-47df-97dc-c4f138cc3047", "sighting--af8a782c-abd8-4126-aa7d-8feeab9451f4", "sighting--2659bdd3-8fb0-43fa-8c2f-78b721586a7d", "sighting--670edca3-9f95-4b4f-ba20-36c87bc3681a", "sighting--d8d56a84-f0b4-4e01-a48a-7773718948f8", "sighting--12028bc0-abd4-4b66-a9bd-fb72113ffa8e", "sighting--2a8f691c-b40f-4015-ad07-155be83e93f4", "sighting--b892d3ef-d2cf-494b-9a62-637bce8054fc", "sighting--b81ba62e-581b-41e2-831a-07d3aadb1eee", "sighting--b12c1de5-d52e-4033-b85e-ddf594d246b8", "sighting--5a95c612-1769-429e-b51e-1b31f16d72cb", "sighting--78953e77-60c5-45c8-bd35-ccc2e69c370c", "sighting--7e3e3965-0724-461a-a3ee-1481d69aae3c", "sighting--0cd5c4b1-e8a1-4a0d-942d-8804e9c929e6", "sighting--4565383e-2fb9-4f7d-93a4-96b6693047ff", "sighting--d12833dc-3a1a-4695-bc6b-17b75dba7b17", "sighting--12ed78de-b320-4ac4-b57d-20902d8afc45", "sighting--d0ef6f60-e8ed-4631-876d-68f4130fa652", "sighting--28f55546-1959-4aca-8efe-9101077eef04", "sighting--5a746264-8177-47b9-9b69-c8d5cf1004b0", "sighting--96c3e566-479f-40bf-9fbd-7883f1a6d622", "sighting--5180c300-3944-48f7-937c-c603bf0dccd0", "sighting--a68846b1-ba5a-4954-b0cf-1dadb8346a2a", "sighting--c5340fdc-b907-4d49-8d6c-d9887d4ebf14", "sighting--0d6b1aea-786a-4ed7-b0bc-6f5ce5da50c6", "sighting--03da5060-7870-4888-94d5-fa6dbf90398d", "sighting--f0bbd33b-ee32-449d-82fd-7ffad18dd4a7", "sighting--73214f3a-2f33-4ce8-ad42-150de4ee4128", "sighting--ebd76f3f-6643-4ea9-8242-5ad9ed9e01e4", "sighting--92caa080-3c2e-4194-86ce-c62b8ed8b824", "sighting--15b5a78e-dee2-44bb-8c67-ca5b56880fcb", "sighting--8d537cbd-9443-4fc4-8a9f-2ae39e69b2ee", "sighting--72723b1f-967d-4d79-803a-eaa1f91cd589", "sighting--c64f7140-a176-4c31-b75c-87e3f17dd017", "sighting--1392a036-7a21-4dd9-b9b9-cc1e27215ee4", "sighting--b66eedda-9156-441c-b6b5-9237391832b5", "sighting--eee898b9-50bf-4b3d-b92f-afa47e35fab9", "sighting--b93b129e-fcc2-49e5-9c17-94dcac3df3d2", "sighting--88deb08f-e8bb-4156-adf4-352b337bb1ea", "sighting--eef874f4-f54f-4320-9625-7b7ff4405bf4", "sighting--1c59cbb9-1ac3-4743-9bf2-f70b6a5f2b81", "sighting--b501ca1a-c7a0-4dd8-8fe5-95828f15232a", "sighting--a9887295-544e-4cdf-a484-82d1203a6263", "sighting--643f3139-4d3f-4392-a5c7-e9bcd43bb0b6", "sighting--fe054d1c-9b69-41ca-97ce-cd233dd4f8f1", "sighting--585b9614-70cb-4deb-9ca8-bfebdf1ba097", "sighting--ecd42571-5b67-41d7-90fb-50e4f2a36a3a", "sighting--51b2780d-9786-4852-bca0-4af7960a70a1", "sighting--fc14c176-d13e-4c88-9a64-5100963a177f", "sighting--834088a7-c032-4078-8b16-98faf2857b47", "sighting--3f51fb84-8ad1-40da-87e9-708f35a3b3c7", "sighting--3988bd7b-756a-46a0-8a37-355554ab298a", "sighting--8c8bbeda-8316-40a7-9e19-ab26bc90a289", "sighting--2eaf6f6f-81ae-4f0a-92cf-a41436d95845", "sighting--291143bd-816f-4c6a-9b3a-97873198b1a0", "sighting--3a7a17e5-df62-416e-937d-f3d4b9f9aa2e", "sighting--794e2da3-a5f7-4a6e-b0ee-f4f2e329c800", "sighting--6a99d944-f2e0-42ab-ac52-64991e231528", "sighting--95f44aee-f5a5-45b0-8f9e-e6fc97f1a1de", "sighting--d29d3d48-296d-47cc-8535-4149e449ae76", "sighting--ab5ac32e-fc93-4c45-8047-8a0e342088a3", "sighting--1281d6d5-4049-4353-ba00-f5a213f84605", "sighting--8dee6aa1-a022-4439-a54d-97abb3985375", "sighting--3b61b744-be68-4823-87ac-4b9d5b95c426", "sighting--bc3799e6-2a2f-4b84-9499-435dbec8c758", "sighting--1bdca12e-bd32-4978-a066-981313497b7b", "sighting--c0daf520-2f2b-44a1-9e41-831991b16fe5", "sighting--513905d8-ce68-4d14-94b6-f1e4984c3578", "sighting--b395316a-d8b7-41e5-887f-7630e7cccbb6", "sighting--9c7f9de9-9a54-4562-99ca-54e31c2a6279", "sighting--8f360cc2-6983-4850-8706-f7b137ecfb1b", "sighting--84e0ac03-fb1c-484e-a606-67e24dba98e3", "sighting--2969ccfb-7d3f-4cb4-a49b-868f7794d05f", "sighting--def142c9-cb00-440c-bc0c-306eecf60e8a", "sighting--92f6425b-b6cf-4484-b226-3b93f6448b8f", "sighting--ef984c8a-8299-4438-8e0f-65074a913509", "sighting--c21446a4-b121-47a1-9dfb-781587b78bb5", "sighting--b0fe03ba-5ca4-4b53-abc7-1fabcf5d8173", "sighting--5cf209e7-e446-4dc3-be10-be0f41ec27c1", "sighting--1d9ec91b-b46e-4458-a476-da3b73b74f00", "sighting--20b5ccf4-ff16-44d0-b39c-fb54d6d93184", "sighting--c194d31e-674d-4cae-a784-b8fcd88bb78b", "sighting--6086728e-96ac-4d96-b33d-f05729d79aef", "sighting--83c3afb2-434f-4b84-970e-7869b0dcd496", "sighting--d92245a3-e182-4a78-9e73-4e3940a8ec4f", "sighting--281b08ca-1f84-4ea7-8fb0-712ffaa1bae7", "sighting--a56bc78b-ed9f-4538-be4f-b5bc6fc3cf2e", "sighting--db8e5f30-517f-46bf-b5e6-fe35138dc42e", "sighting--3211d0cd-a610-4aeb-ace1-eedcef0587fb", "sighting--186bc0de-8e72-4b2b-a3d1-817dc3dd47b4", "sighting--31d5ff34-3a35-4161-891b-6ae7df531c82", "sighting--85fcfc52-0ac7-4a0f-aeb7-1be3a0dc6fe6", "sighting--5860ef75-9786-45d8-8a2e-0eff34041198", "sighting--1463b7a0-afb6-4506-a3e0-2e9ddd682910", "sighting--95808f0c-923d-4bfc-86b9-6c7c3d031f80", "sighting--abc1fdea-494b-405e-9a87-dd8ec64f29ef", "sighting--c8980f93-f40c-43a4-bc22-ce8e412b3376", "sighting--475d5b94-8f76-4f4c-b4ae-bbd6e207bf11", "sighting--eeae4dd3-ba96-4416-a509-332f228b5eae", "sighting--18ee0f21-50f3-46e3-a564-e6e3f2eba506", "sighting--dd3c3653-d49a-49ef-8a87-a116a277ea00", "sighting--8ba06ba7-7b06-4aac-a905-3a6f24d46846", "sighting--510b897a-62bf-4bec-b8f9-ac527146380d", "sighting--05cb2a55-95d6-41d8-b59d-a753348be17a", "sighting--40db209d-f614-4918-a49d-b2dbe983284c", "sighting--b26b7e08-fdbb-4927-b592-074bce154c42", "sighting--6211dc07-fad4-4c64-9948-812306be0995", "sighting--3201d0a9-e493-4c45-beab-dea4a4aae5d3", "sighting--75f3a65a-5009-4732-aa10-16a29b9f6cec", "sighting--690ef0ce-6ad7-4867-a407-8e7aca3cdbc2", "sighting--d39dee4f-bd44-4938-bc5e-7b16be89d3f8", "sighting--52975d35-3048-4782-b71d-5ef17d66816e", "sighting--df7c4df0-0dff-47c4-becc-69daedb35e33", "sighting--9fba3393-1a30-4c14-81b2-43017f1bb21f", "sighting--18c81bcf-b2a2-4ed2-b587-4de5b403fe89", "sighting--03b50326-83e6-4f84-b52f-9c323f50be78", "sighting--9a5109ed-1004-4d04-a67d-0494b8c471cd", "sighting--797dba24-9ba5-462a-a496-2150a18bccef", "sighting--632a32f2-bbca-44dd-8a7e-61a173edb723", "sighting--6d6add51-1fb0-45f2-b69c-405f19008426", "sighting--57f8effa-1798-45c4-883e-323a38ae1777", "sighting--692d44aa-c3d2-4399-979a-3e9fb182df8f", "sighting--93f3f688-641c-46ca-a010-f26141f21f9f", "sighting--62a0e105-6729-4185-9485-6f2c00aa639c", "sighting--0bea4a3c-eeda-4d2b-87d7-c65694e16b90", "sighting--7d44a045-1f56-46c1-8883-f6883e5de971", "sighting--bcaa4e0e-910e-4076-ba81-77708c2b5eb5", "sighting--10bcf364-84a8-4450-8e3f-f6f9ab5c4fa8", "sighting--8283109e-dddc-40ff-90c8-d6c2d997b2d5", "sighting--46a731bc-8537-4707-a7fd-02292e4f071b", "sighting--e4df0cb9-447a-43e3-9c4d-d2a41b6d7b45", "sighting--48067363-1ecf-4830-a641-37ed52d09e70", "sighting--e73f658a-c48c-4802-8dab-cef14b4a47a4", "sighting--1ff228e4-52a3-4b5a-818b-c9568ba8a685", "sighting--8b9169c7-b024-4fa3-9cd8-ebe435fce2f2", "sighting--361377ad-419c-46d2-bbb3-6105e3c2d78c", "sighting--969855ec-9561-4530-826b-a81cdb1a1600", "sighting--4d84c008-8284-4f3c-a6db-3edae0d793c0", "sighting--bd39c2a6-6c32-4d1c-b881-9f49e985ed55", "sighting--b3b4da33-7e82-4da6-ab66-24fa7d17b65d", "sighting--b30a27db-8e54-471a-bb1f-04cb74500e1c", "sighting--d1e259b2-fab5-401c-bd74-4a6479b6df3d", "sighting--5c6d17c9-9d71-4a9a-bc52-dbd0df80b43d", "sighting--de5fba8b-5fcf-4935-9a18-bd0a0186de21", "sighting--a8464f49-8206-43de-baca-9be5c1a4108e", "sighting--843e8b2e-ca58-4b48-8cd4-f55d2e7b8ef4", "sighting--a1d952f5-0e6b-469d-8ad1-599174465d84", "sighting--cd7cde52-f21e-4ac9-a97f-19ada3d7642c", "sighting--1f104e1e-59e5-4358-b30b-681aaafa6e8e", "sighting--dd2cd66c-91b2-435f-bd1d-7648bdcf5ea6", "sighting--ef54145b-ce24-477f-96ed-c7a6aa0fbc15", "sighting--62ca5b26-0b76-4d18-9417-43fc9788da76", "sighting--a656aac3-3bd1-4420-96ca-81007207e233", "sighting--5809eee0-24f9-4b8d-afd5-d32a50639f0e", "sighting--8a9706ee-b9e6-4927-90bc-2dc92dda21a3", "sighting--c87efba2-8273-42d4-934f-83c12d0388c4", "sighting--01eb226f-1746-4228-a542-083561f6ffbc", "sighting--70cb87e3-7f2a-4ae5-9ae5-83d8aacc5a7d", "sighting--2eb03e28-2302-4751-91c7-75f06e46ef1e", "sighting--d9b9dd87-43ea-4892-8024-80de1441afa8", "sighting--6b561b2b-b894-41ce-bcd5-754cd7e53bf1", "sighting--7c74de5e-b046-4b1c-afdb-ff9449bb806b", "sighting--974c4964-d6b3-4e2c-8edc-5d88897e8917", "sighting--af3cf3fa-b293-4165-a7e8-d03ec37f73ed", "sighting--287b9b9a-6c40-4ac8-adf7-86efb1405d51", "sighting--aed76e17-98cc-4a33-8550-3ccb6e660e87", "sighting--19b751a6-f4c8-4b17-a148-66634c2c0825", "sighting--b93f2570-12eb-4699-a1c2-6ad5e252870f", "sighting--209c66a9-fcf0-4c7c-9103-85ef4a625191", "sighting--d221eff7-00ce-4dc0-be11-bf9926766591", "sighting--138955fd-1dd4-42c0-b5b4-a5f29b800bcc", "sighting--2fd40552-d835-4260-9664-e28c14ca567e", "sighting--b74cbab2-e42c-4a18-9895-d134216cb855", "sighting--3d8c18aa-049b-4039-9df2-8b97195730ed", "sighting--75c812ab-af52-45d0-b915-094e4ffd397a", "sighting--97730155-7ad1-4e16-8047-7b289919a41d", "sighting--696a1591-0580-43f7-94a9-cb0ac545cec8", "sighting--cc7cbc57-1c45-4a7a-8adb-c60040f56f32", "sighting--1223c538-cc0f-4c47-8797-2175ce3a910b", "sighting--bb421cc8-fda5-4e38-b161-22cd022f4c11", "sighting--d2a9cb6d-76bc-4f5e-8974-b041c14b0bce", "sighting--16bb1ca4-49e8-4e1a-a278-6fc7e62ca153", "sighting--dd235e04-ce3b-40c8-9140-b4e7a54cf0f6", "sighting--20d52038-bcfb-4dba-ace6-10d4b1889304", "sighting--b5354531-fb7a-4c4b-8cab-39eb456406b2", "sighting--6c153c7e-ef8a-4465-bb46-94011623f9c2", "sighting--5d279926-5061-44fc-a752-98524afd13ce", "sighting--98b328b6-3cdd-40f9-a19b-e04d478bbf1f", "sighting--27f9f61f-2284-4968-b995-08a050c1bb4f", "sighting--e1918a83-8383-45e5-8e39-c8e0fce54b06", "sighting--e1a3b394-3ad8-434d-88ea-0692c717f52b", "sighting--f6be5daa-dd90-4595-bd6a-994d59380eaf", "sighting--d4061703-d01c-4165-a187-b73b31204baa", "sighting--cccaa9fd-d86f-4ac9-a896-6d007f412d1b", "sighting--7aad1fc1-d60a-4a31-a4b6-e1786c8126bb", "sighting--6a5fad2e-56c4-49bd-bfd7-36208ff1e162", "sighting--9d361462-efb3-4967-8775-c195b5b1209e", "sighting--6dc1dd0b-27c3-4fc2-b4f5-1020dbe75a6a", "sighting--8a2225b5-e508-4fb2-8541-fc2fb8d5a535", "sighting--81d6f421-c44e-4e2e-871a-58c2e42a9dc4", "sighting--6d4ad2d8-c5de-4dcb-bb93-f9b8e2101a29", "sighting--cd125e5c-a733-4931-9cb9-e21287c39a6f", "sighting--68032cd7-e615-41fb-b49c-bb28975cde9c", "sighting--a3c6a237-ab93-46c7-803b-6f4ac5a00d8c", "sighting--bede81c1-17c2-44e7-ac0a-feb47a33701e", "sighting--bcb784a3-a833-4b24-a00a-045127206f0c", "sighting--fb546804-792c-440e-80a8-c887bbbcee20", "sighting--75220787-5289-469e-90c7-37b443b5559b", "sighting--2e161dec-840b-468a-837d-442613bd00c6", "sighting--b0f9c47a-0f2c-4f81-b787-aca81bc06fcd", "sighting--17ea3500-f295-4fb4-94b5-3fa9b9d58cdb", "sighting--4f4bf3de-3ab7-43c3-9804-64fb761cdb0f", "sighting--7ebff3c3-ac3c-4646-bf04-347a2d192915", "sighting--81f5fc4d-1182-4fe0-945c-01741b104f61", "sighting--1fcc62ab-3bd1-406a-a4f1-3583856f4d77", "sighting--12e22423-80f9-4c25-8932-abcc59613032", "sighting--318f987e-c1d2-47a6-9d01-98ef8b9fa3b6", "sighting--8e10cbb9-ca87-4970-a416-975d007dffac", "sighting--807ee938-e749-48a0-afbc-18dede7d9f40", "sighting--ef603748-513c-4101-bbbe-0249dbb9a2fb", "sighting--a4cc6570-e6ca-473a-85c2-4b643e677882", "sighting--4a707ffa-f299-4974-acf7-bd428cf9cd78", "sighting--13671df8-2e2a-49e8-84c6-487531048c61", "sighting--44cfd455-bb90-420c-a5c9-de79eda25e33", "sighting--ab501685-0240-4cd9-9fc2-cf777adaab3f", "sighting--e09a3c30-5c5e-4e1c-983a-ef4d2d4bbd7f", "sighting--066ffd2e-dd9f-4d38-9adb-6a598a1827dd", "sighting--46cc06fc-34e7-437d-8868-09d6ec619f9c", "sighting--a38e2ebe-20ce-4501-a16d-bf303eed9b76", "sighting--1dc1014e-b6e3-49ad-b400-7a0b0fe8e107", "sighting--25c05e9c-535a-44cd-b50f-40db5f9266c8", "sighting--f9980104-228a-4873-910e-fd8f8a5712a3", "sighting--360ce1ea-7e73-46f4-ad16-7b7e24782780", "sighting--fa6ce68f-0e00-484e-a940-6ade183b73e3", "sighting--9ef40de6-c558-4b84-8db1-6acaa7aa4811", "sighting--fd71977c-eacf-4f49-8081-f5fb6ebb8527", "sighting--541cfa19-e782-4c68-b8ce-6b28efe7606b", "sighting--a15e6d54-c40c-4afb-b5fa-fb9a243997b2", "sighting--057cfc60-780a-41ce-98e3-1a60470ca452", "sighting--ce11a96e-305c-42fe-9d61-1aeeeadddcd1", "sighting--d78a09d1-5752-4053-93e9-c276b1c5cda2", "sighting--c3e8611a-1895-4820-bff3-41712bba72b0", "sighting--34737ef9-ff4c-44ce-902d-bf1907bcb93b", "sighting--b27d3077-5923-422f-befc-d9a7ee925b25", "sighting--52989f81-20b3-4a64-8559-4ec6b7b510cd", "sighting--d0f9dbe7-6ac7-45eb-867c-a374adad6564", "sighting--8ddaffa9-4ea8-4174-abe0-6e74c1facb94", "sighting--09e84735-21b9-46c5-9924-a98301b6abb5", "sighting--1b0b61f5-2b91-40de-8a96-b6dc1d55c50a", "sighting--2b5fbc74-e507-4b0e-a366-77ba267312e4", "sighting--2ce53a6b-14a0-4f62-8cc1-fe5fdc69287a", "sighting--49596d14-848e-4479-a9ab-104492b20414", "sighting--284dad11-62c5-44fe-b40a-b1ed278db164", "sighting--42b56c1a-a6ec-4750-814e-a882d8ae1f9c", "sighting--b00cc5f0-d0dc-435e-aefc-313a3e0ae67e", "sighting--9be838c0-542c-4393-b792-1be5f2a65728", "sighting--b2e0ec71-02e5-4aa9-804d-d3f9f72acc12", "sighting--f23b30a5-78c3-41cc-8bdb-5bc98fcafed5", "sighting--b3ab81e5-a7f4-468a-9eb1-8aa926e86d87", "sighting--f93d827f-fb1f-4e5d-a7d0-845fa2f24775", "sighting--bac0623c-b2fd-488a-9f41-802a2e6fa59a", "sighting--6dad2eb1-abb4-49da-9ae5-a12fe5c38698", "sighting--bd77a04b-307a-498f-8fe7-6cd57b7563fe", "sighting--47ac3c2e-5730-4293-859d-05abc6e60840", "sighting--70f694f5-8269-4e01-987a-d72a6144b774", "sighting--a1acc369-2387-4327-88d9-18700d2633aa", "sighting--06b42275-109a-4af6-ad13-6cf213d50789", "sighting--929b6187-21d5-4a7b-847f-7b344bfbc270", "sighting--8830a093-c1df-4f43-95ae-cf9219c42da0", "sighting--c01fc1e2-8c70-4be2-b26d-a047b5f6b657", "sighting--b73ea3f2-c010-407b-b478-ad9569e418ec", "sighting--d0820a4a-7f0c-407b-9aac-15a6e94cc578", "sighting--1efc62e7-6999-40f1-82b1-ae289d3b7625", "sighting--3793f0c9-3fab-4a73-8d89-45fbf6b58b98", "sighting--09601ba5-b4be-472b-8b93-947a0e9329a3", "sighting--85fdb866-9c08-4a3f-8f66-1607ccc6ff0c", "sighting--05cfb4af-ddf1-4c25-9bc8-d8feb8742d87", "sighting--79595c9d-07fa-45ff-aed3-f0e185f9e587", "sighting--29567640-1dd0-4993-a383-5a9f46489c38", "sighting--81f3fc00-8a88-434b-bbff-5d7e64e091c3", "sighting--8b162dec-3388-4764-a760-24e72650dc0e", "sighting--cec20686-b05a-4c44-a8cd-81b3e641ca4d", "sighting--17cc3e6c-bcab-4d6d-8543-2f72bcd309de", "sighting--34dd494b-e567-4618-852f-0789d1352de6", "sighting--f5a91c85-9668-4c9f-b78d-8a2f6724ad5b", "sighting--5137e8d6-92c5-47c4-9fd2-258e9f6b4693", "sighting--f1042b54-90d2-46cb-8f7b-4badf8590ef9", "sighting--5c62bceb-82c0-4f11-8d8f-047b078b3cb4", "sighting--178fcfb5-e932-41ea-a996-6ebf731a1ad8", "sighting--97d8f476-d6f3-40c3-8c2f-6fbe0c336bcd", "sighting--e0d7ed22-f770-41f6-96bb-263ad0a13d94", "sighting--679d7498-5943-46a5-8ea1-6ba1f27d65e4", "sighting--64079cdd-03f1-407f-8d64-4e699866a977", "sighting--e61fe6dd-aaab-42f5-ac34-3219612f84a1", "sighting--6df53b9f-4d10-4011-8575-6ded38ceefe1", "sighting--6f0c0e95-e411-4b6b-ac3c-4bc71a3ed747", "sighting--d3096be0-9095-43fa-bc2d-787b484c2983", "sighting--1d2b796b-1eb0-4c57-881e-005306a1c16e", "sighting--dc29ec0a-85df-4a20-8230-afa6db02f69b", "sighting--d5ed4b68-36de-4316-8a3c-2b8bccc9d6ea", "sighting--c62946e0-d931-4dce-9a5c-b43edc4eba20", "sighting--66b48daf-52ad-4096-b2ff-4b6c0d9d8e60", "sighting--9c98b498-6303-453e-9afd-7ccdff4457af", "sighting--47d24781-f2f9-4dcd-9c51-eeaf6f3e34dd", "sighting--2e0d9b36-a9c1-4958-8903-3c87d66e5df1", "sighting--ed070697-b7c1-4bd2-8547-fe3a7383517c", "sighting--dea05b06-7605-412b-a1c6-8c1aa9d35cba", "sighting--4e87491b-5393-4fbd-914f-2ed4ce23b54c", "sighting--6f969776-785c-45b5-896c-91135e1f132d", "sighting--59a00a63-3a73-44d8-889b-c01bedce0ac9", "sighting--83130285-ee46-4a9d-a194-d15a89ccc47a", "sighting--e81c3609-5fad-446e-8ecc-02a8be7b0e2c", "sighting--02bdc870-0c0b-433f-943b-64e7533afae4", "sighting--3f5939d9-7593-4e2b-b703-bc1f08497613", "sighting--07a205b3-73c7-4aa0-8f9a-81aa8b27a9c4", "sighting--f91a6723-c84f-4723-93f3-730ffd86b475", "sighting--fbd14265-cc62-4ce8-9d88-2f48256d63e6", "sighting--2ce9dd50-de48-420b-addc-e2736bd9c593", "sighting--3c4614bd-f105-4bd4-94af-d77f5a0dd8c1", "sighting--8defe1ee-625d-468c-ae0e-1edc1f17d6b5", "sighting--63e2a4e6-8c34-4038-9bc8-0b8da65ede3b", "sighting--4c7fce39-1251-43e8-931b-21800a105bce", "sighting--02f2a17e-e124-47f7-b868-503acb7bbe8e", "sighting--5d53386f-bc19-46e1-a64e-c6d52e72916a", "sighting--33d8654e-15b3-4717-a174-67b3a0bc52c8", "sighting--2abf04c2-8b01-43e1-a513-816232b8ff6c", "sighting--ad0e29ce-ce7b-43c9-9053-52b85941da43", "sighting--e7cc2e85-8f0f-4b2e-8e31-4a3263555d0c", "sighting--1f6fff2b-1da3-4a99-884b-e476d3b2545a", "sighting--77d08b35-6328-4563-9546-b5d65b11d2e6", "sighting--e884e63e-a287-48f0-b083-445cc8f82f36", "sighting--976a7107-93a5-41da-a43b-3524acbea57f", "sighting--5da84636-8c1d-4b34-8987-59b24fa230fc", "sighting--7e1f78ea-0406-44bf-90e1-86860b26c186", "sighting--6e1f915d-98dc-4049-b0d4-a4890be82b4e", "sighting--5a15ec5d-8546-4986-a2e0-4190284116f6", "sighting--79edf0d5-c6b1-4023-a419-00aedbce5d65", "sighting--49c0a29c-7c78-4652-a80d-d0fe6ab4f2d7", "sighting--074b24b5-a965-479b-8786-2f1d8c0dbc13", "sighting--caf6a90e-02c7-44a7-a827-ed6e99e402d7", "sighting--a2b37318-d565-4928-9282-624551c74990", "sighting--aecc8b5e-dc3a-4d4f-9e2d-0f9b4e8cdc28", "sighting--8a4ce37d-8809-49a9-8830-83ecfccba822", "sighting--f1599bcb-91b8-4429-8d7c-cfaa797de54f", "sighting--1af76660-2247-4169-be60-72da7b1489fa", "sighting--590845a4-6c57-4b3c-9bd5-7fa910943727", "sighting--596a2d73-bde9-49ca-a5db-be3745161f43", "sighting--29f18657-ff6d-48c6-a003-874ada45ebd1", "sighting--4af99268-7c06-4691-9162-957c4a4885f5", "sighting--14c36e0a-6414-4b48-bdbd-10c771e958d0", "sighting--f66fd053-f111-49a8-a03b-54706fe93026", "sighting--99751ac1-3f7e-45ac-ba25-f96fc13bb27e", "sighting--b52df729-8e4c-434c-bbf5-7127b42abcdb", "sighting--d1cff31a-04c3-41d5-966f-c7ebfbe2be80", "sighting--9ab7fc95-3cb5-45cd-be44-e5f68d3601f4", "sighting--a5d0dd01-a847-4367-8265-bdd5b9efbb88", "sighting--76d27481-e69f-444b-9420-b5d1b4f77a96", "sighting--819b25bc-f9e9-4521-babd-dd85a87df522", "sighting--1be91c86-24be-4b99-a9f1-4b289d7cd745", "sighting--da8dcad4-ad3c-4722-b4d5-a988ff994175", "sighting--c070fe28-0a5b-48b1-97f4-2d61390f348a", "sighting--c0704970-b84a-4d55-af0a-34f8e9499063", "sighting--a1d827ae-c996-4981-9f42-a3e889234b33", "sighting--f7be9420-947c-417e-8c66-8d5969bd5300", "sighting--465dcc97-7232-48c0-8dd5-407105aba264", "sighting--246352c5-0aec-4400-9b4a-2270383ce82c", "sighting--3f9642ee-13d2-4af4-ac07-76d8be0b5c09", "sighting--fdd50b0b-12a4-4bd0-9236-84ef9e17dcf4", "sighting--e4e8421f-cad3-46ad-8454-c5f9092222e8", "sighting--0d28f6ea-5f5e-4b14-afb5-763ee28a1a0f", "sighting--319d1d2d-d4f1-4b87-a1a6-8fa7251a0b8f", "sighting--7bb91db3-195e-4d5a-b4a1-6f7d12397ecf", "sighting--665242c0-b2d6-4145-bfd1-8aa42b80e8da", "sighting--6fbe741f-cbac-454c-8734-fed05d3eefa1", "sighting--02e11031-ee29-4e7d-927a-d13e68485222", "sighting--0b0a69ed-1931-4123-ab9d-bf8f12d35731", "sighting--d6e86220-b0ab-4c85-ad2a-980df6330eb1", "sighting--a0d8e957-5428-4238-aa6b-208a560ef3a2", "sighting--adc2af59-97ba-4b42-acd6-e868f4669107", "sighting--aa25fea9-92b8-402c-b9ec-323b32a6599f", "sighting--52fb7348-06c8-4aa3-a64a-4c192dd884a1", "sighting--1e4ed536-c07c-4fdb-afd0-5185cffe1616", "sighting--5a874895-e27e-4692-99cd-9aa2cf85e884", "sighting--ceaefb72-941a-42f7-95cb-e1fd24796748", "sighting--b1550da6-9b31-40de-866e-d568e4b974df", "sighting--480a9074-a88c-4161-8167-1f93beb09e76", "sighting--17513c97-d1f7-43ed-95ea-064f60777641", "sighting--a013c123-4e54-4ae4-9213-dff5c4cfe1cf", "sighting--b75517bc-bd78-4e52-9ad7-5dbbaa50ac6e", "sighting--5848fc5b-d27e-45ef-91b3-64c4a4c798e6", "sighting--f4680506-8fe3-4018-a2cc-3942725d19de", "sighting--56819977-3c76-4d69-973b-f76559b45828", "sighting--404999b5-a6da-4b20-af3a-5e3a7276228b", "sighting--78d6bc07-16f7-41d7-90ba-71677efe474d", "sighting--8591f4ed-d519-4a09-a118-7d8b47df72ba", "sighting--5d771331-0b84-4bd6-8f53-bd071e1ebc73", "sighting--d57e7a19-3cb6-49ef-a599-3333d2f7b93a", "sighting--f3074219-53b5-44ea-af08-fc554019391c", "sighting--0e4812da-fddb-4490-895a-1e9acac4c3a8", "sighting--803d20b5-cb84-4c85-8e8d-1b5a8601648b", "sighting--351a1253-a4d6-4614-9e9d-f7bcfe69dc72", "sighting--3c2f33fd-5abc-4335-b91c-33958f9e2410", "sighting--692ea582-2e5f-46d3-bc15-753d1fd147d9", "sighting--ebedc41c-abe4-46d8-9d1e-9a62e3609c4f", "sighting--7f9dae1e-aa40-4fe4-a727-eddb778dd39a", "sighting--38ff3b9f-9e76-4546-8971-0b8b26c8d0dc", "sighting--7a583975-0458-42d1-b682-669ab6448b80", "sighting--146cc04e-ecde-4338-a3b2-26a050aa19bb", "sighting--80700583-4979-4382-acaf-f484e9b990da", "sighting--67c399bf-c7fe-4203-b29b-2d140ab9c292", "sighting--2276085e-95c5-4832-89c4-451c8ca35e4f", "sighting--76b9e357-f80b-45b8-8c13-a9506cf94e13", "sighting--4c223810-1aa9-452c-926e-f1f1221bf9af", "sighting--d2b9eb3e-5411-4bc1-8d81-635c347692c4", "sighting--97f41b2f-548a-48a5-ab6a-f055655d65ce", "sighting--2e1e50af-d358-4c6d-84a9-1c014b2cdfdb", "sighting--551ef42f-0492-4db2-b005-b49f75eef961", "sighting--fbc08a6d-cc70-4e90-b885-5e577d3f0cc6", "sighting--d832f6f1-61aa-4ef6-9604-c2b8a38f0c2e", "sighting--12f89c27-d681-4a06-a8f9-fe2a72158c9d", "sighting--d3942abf-b514-43d8-93c2-a900291be4d3", "sighting--1f5a8139-f356-4112-9c00-88ea1cefb162", "sighting--f86a01a0-40f7-44db-bda3-7fd68f46e243", "sighting--3d8db67d-d443-4116-8767-1e6317b84791", "sighting--d7951aea-58a4-4449-b59d-6742e3958dc7", "sighting--e648b28f-1116-41bc-b7ac-5556c8a9c9bf", "sighting--f0a0edd8-6130-4ca6-b412-2bd3abbf9cc0", "sighting--2220a603-ca76-4aef-a68b-91d187d7258b", "sighting--1f42aad3-4377-4f87-b9c0-0d9238f7200a", "sighting--90a25a0b-3f98-4b2f-9887-c7dfbf676405", "sighting--c42b3a02-6848-4a74-aa9e-179ea3591a0c", "sighting--19e64575-9912-42dd-a11c-107299f8b606", "sighting--4cfa21fd-1b89-49ba-ad19-c8e0e71e88bc", "sighting--6836eed2-7489-4dbb-aff4-b7efaeaa3ad1", "sighting--24705dee-12f0-4af2-a5c0-e8979bf8c91a", "sighting--291bf705-02ba-4af4-b7b2-1d5ebb3b6c04", "sighting--bc1dcf06-3ce0-4e43-9a0d-69d94b4177c1", "sighting--4eb24381-810d-4eba-8f10-5d449a4ab7f4", "sighting--d14cb5e4-0c8e-44a8-9ef9-959f8246baf8", "sighting--9b7d8080-cd23-4e72-9567-69c35b600e3f", "sighting--f9241f85-8f0c-4b13-89e2-de84c9a5cda7", "sighting--c225895a-93bd-43ab-a5ec-39f2e4df88cc", "sighting--f39fb004-63ea-4d58-8ff0-ee330988eae0", "sighting--fdd9fca5-3107-4a4d-85fc-39b2f53460c4", "sighting--c6e13891-a5c4-4570-a87b-2df5e48359f9", "sighting--00d21f46-d921-4d62-b7a2-0756f3063cbd", "sighting--ba948abd-8db4-4297-8494-184f236d827d", "sighting--61043234-dcaa-4c21-95ab-12935f63a8cd", "sighting--361b5d97-b108-4882-91fb-a34c1de700b6", "sighting--436d525e-84ce-49d5-874f-45cac68320ab", "sighting--d5589cb5-e223-49b3-bd18-267d54751ff6", "sighting--1c7f35ae-b8db-41d7-9e91-62e64e1362d9", "sighting--07ed0e65-8207-4862-9cec-d8a05fe991d0", "sighting--8b10d5dc-528e-4ecc-b79e-622859c12684", "sighting--1a168044-0d83-4347-8192-1e80aeb18fb9", "sighting--88376128-fbc9-4d35-b97b-69209c5a277d", "sighting--ad848dc7-a328-428e-a7b4-b89a6aa15168", "sighting--d50771f0-afd0-4f28-98d2-2d825dba8840", "sighting--1ca4fd0b-aa0f-4bec-8a6c-7a5c2b53fe95", "sighting--9fecde17-a602-4fc7-ad7c-818877e359d1", "sighting--ef1715e1-e0c4-4af4-a4ed-22a5bc11857c", "sighting--e5e7524b-3ee8-4ff4-9c4c-de1d9ad13228", "sighting--2a80d357-8ae6-4ceb-b7e0-d1a5d04ff086", "sighting--468824e8-8000-46e5-8e3a-7cf686285d39", "sighting--e51b277c-1dff-4228-a3c0-3cca0023803e", "sighting--423b9f10-8fa9-4432-8aa0-c25a8dcbb0f2", "sighting--381dfde8-f99d-4ac1-99ab-7943967d1c37", "sighting--d5d94ac6-06a2-4042-8cdb-f6b31b2a94c5", "sighting--6320424a-e675-45a7-8aff-99386f7f45cb", "sighting--a6b2373d-a09a-4ebd-81f2-c949c41abbd3", "sighting--9d0ff848-633d-4998-9797-69b4d659088f", "sighting--5071e9d5-969f-46fd-9722-66c301636036", "sighting--73426e12-47ad-4b38-a415-98f91d1a6f17", "sighting--3c1cca9b-62cf-487b-89d6-fbcaa1eb7a96", "sighting--4ef4d315-fdc6-453e-8e79-53c94cd04584", "sighting--dcb027a1-c333-4a42-ad9a-b21a1f0a0428", "sighting--d06af19d-074e-4372-bb6b-6a93326bda8b", "sighting--d33720a7-4851-41d1-a033-fe43ad73758b", "sighting--3ce2979a-0510-4e82-a5d9-9c9025351048", "sighting--d42b49ca-aa49-4f57-b625-dce2d4d3cc0a", "sighting--9cfc5c0b-4550-4262-9548-7050b7a993b7", "sighting--f451f1b3-7312-40ec-a852-60d699e40fa5", "sighting--918df72a-cf95-4e22-a447-18f2f0a66c2b", "sighting--72913fd3-d72b-4a79-8cf7-31bef9920666", "sighting--89b31bda-680c-43ca-9093-f4c41b3af601", "sighting--e2774e1b-1a83-4b2b-ac04-0a9a7c1a6c4e", "sighting--5c52a711-aa2f-44bb-b2fd-7fa2412b8d1a", "sighting--67eab6b6-5d36-49e4-b0db-b178d34d652e", "sighting--bb3a3413-f254-4e61-bd9f-083e102f17cb", "sighting--6a5fe8f2-b12f-4a88-80c0-47fcc78622f0", "sighting--ecab5c7f-42f8-4b44-865c-466ec31a0396", "sighting--13e3db51-d75a-4e1b-a561-84f339e47679", "sighting--ce8f8d02-62ba-4dc9-b390-687d5584163c", "sighting--c88a9d08-27c4-45bb-97bb-f69e8d2684ac", "sighting--7f192978-0245-471e-8153-9cb98bf194a0", "sighting--2f4548b1-0e67-4db2-9d1e-8f87e7774f10", "sighting--3c4b897b-b33d-4d49-9bbb-b2eaf32c13fc", "sighting--28c72553-b99a-473d-b117-5220ddfce4d0", "sighting--202c3a5e-a50a-41d3-8e25-fc3aa283c7bc", "sighting--195b4f13-cfa1-4c4a-98cd-8fdc3ae4c736", "sighting--b83cdb63-ad9d-41ec-afa0-9f50dad7c4cc", "sighting--e5d979ac-c59b-4a64-8c33-cfcf5ceab4ff", "sighting--6bcc81af-95bc-409f-b906-5fb237b26dc6", "sighting--804a67e6-8795-44e2-b23d-578b772c4cdb", "sighting--698ad920-396f-4f74-881c-ea0982d67c24", "sighting--20e21806-f74c-4fec-a185-e0a570ed38cc", "sighting--bf939c7b-44ca-42c2-b88d-ba78661de635", "sighting--08f5220c-a321-4beb-8803-2800aa227ba4", "sighting--e62a68f8-df4b-4e53-96af-8647330348ac", "sighting--5704788a-91a3-496b-a016-cd146cb0ea13", "sighting--68bfdc92-5111-4ac5-a13c-3ce9cf96ffce", "sighting--2a7327f1-403c-46e3-b3f4-bcb4f429fd7e", "sighting--8313e1d6-6393-4177-8280-62e258224164", "sighting--93fb6bd7-8fe1-4593-a237-287918b223a3", "sighting--3aa93054-5c13-4f4d-8b0d-c6e1432585c7", "sighting--75000658-cdfc-4794-a671-cf86719cf6ca", "sighting--05bc72e4-02c7-4dc6-8097-780928a4c8d4", "sighting--663a8561-9ef6-4327-a00b-56c435954810", "sighting--f300fa85-7f48-45f5-abf8-b6bbcade060f", "sighting--b49f47c1-2e38-46ce-b9ad-33c45cacc771", "sighting--4c43e9d8-de82-400d-9802-b57920239bdb", "sighting--5456b423-0b91-4550-b0f0-19d22a1f757b", "sighting--af6517af-87c5-453a-99f1-ebbe5de29f74", "sighting--105bb3b1-7169-44e8-93f0-12db0e3cb932", "sighting--ad03e6dc-2252-4d96-b29c-1284dc3f1f25", "sighting--33016c85-77da-4295-89c0-d7c62f97dccf", "sighting--6410d1cb-1c5c-4eaf-bc43-2cc241ea01fe", "sighting--461f760e-071e-4b08-9798-925819c12d49", "sighting--e33a77a1-56c3-4101-b7de-a1fd5bbcce34", "sighting--46830951-75b8-4929-ae3f-2978c6decb55", "sighting--9bd849f9-8bd5-4979-81d8-1a76c970fc06", "sighting--3a998d8c-59e9-4528-9d5e-976e1f4aaa29", "sighting--bc7a49cc-ed53-4f49-b274-eb13e4403aa6", "sighting--0441a698-4d29-4881-b7a6-4bca61606762", "sighting--848cac95-0cd0-4630-8d1a-60d9c817020a", "sighting--cd17e47a-0e32-4fef-9315-29b0246fcb7a", "sighting--6f62d761-e39c-46ba-8b96-0bc1eab92408", "sighting--5cad070f-365e-4ba6-ad68-3db626ed5db8", "sighting--1e83bd70-2d77-4655-b7f3-5e370a14aaf6", "sighting--4e76bfb4-f670-4ae9-89f9-e37c8c9be82f", "sighting--9a2277c7-5a60-42cb-a1ba-ecddffd6288c", "sighting--11c791db-a2a9-417e-a820-a541ab62085c", "sighting--8ff4e2d5-7e19-477b-84ba-7b6793c8db31", "sighting--b48441de-f2c9-41ba-a96b-e481260bc8c2", "sighting--856a780b-5338-4853-beea-da38d74f6d27", "sighting--fbbd4628-a038-49ec-a0e0-bc7e051365da", "sighting--5e71e257-2c32-417c-ba87-cc5a98b2d822", "sighting--d46497c2-f79b-47c9-826e-e8b912123090", "sighting--3b41326c-734e-4dab-97f2-9fbce74b3685", "sighting--374cb53a-349d-48f0-a67e-c18b47c08b09", "sighting--e2b3a7d3-3f03-40e5-bc4f-d3915f2ed2ac", "sighting--76155b23-05bb-47a2-97d3-cd8393716456", "sighting--d704dce6-1943-4df5-b967-d7c49cd8357e", "sighting--2c395c74-b64c-4b21-8afa-893c8d314eda", "sighting--d2a03655-e1fe-4428-8d7f-3b450f34794b", "sighting--b1288ce8-7125-4412-92ef-caad5c5df22f", "sighting--8022651a-3293-4f25-9f78-e3aa5e3bae95", "sighting--b0918b04-381c-4791-9746-fdb534b917d1", "sighting--8bb40442-ecf2-42b5-8f34-bc47c92ba15c", "sighting--5e6908d5-c851-4e2d-b1d1-6d34446e0fb6", "sighting--eb473839-dc52-4d17-87f7-4cee25bd78f7", "sighting--aec865eb-3f15-45b2-bcfe-42d59bd3373d", "sighting--e7e8122e-b893-4815-bb96-8b3dfab67783", "sighting--6d2a41b7-f1a9-402b-8d91-e03dc1b2da3e", "sighting--73f91c91-f132-4906-9be7-b6c1c562a31e", "sighting--9df5d2cc-73df-4d49-a13b-7f6b3a27fc27", "sighting--aec1c107-8679-4c39-8ad0-ff305d84cd11", "sighting--9d4f514c-abd1-4a46-8d6b-37b009b88f93", "sighting--0aa37b50-6893-4f15-8956-77bff07801f4", "sighting--93bcf3c6-9b07-46cd-b684-8deb78015f1f", "sighting--49fd30d1-31f8-4a61-8a5b-2c8b9b27d4a4", "sighting--5d414b12-e947-46dc-adbd-2fe5e6bc60ea", "sighting--7427e525-13d0-4017-ba62-6871aadd6944", "sighting--c371a8a1-0cd4-4d95-aadc-5980434a589e", "sighting--fb2d4b9c-002e-4a66-9ffa-12278b561944", "sighting--576b6a35-fde8-43d3-acf0-e09ec61ea67a", "sighting--db3dda2a-665b-4468-ae5d-85529e5dfe35", "sighting--44ef0b72-77a1-4408-9393-50c47b64f622", "sighting--66539491-a972-4e50-ab82-2cd665431c74", "sighting--38ed7f12-62bd-4d49-b0eb-04228b47d25d", "sighting--5fdbe35d-4cea-43c0-aacd-88713cbd7ed2", "sighting--3503285e-27c5-4942-9a1c-15b20d0f5e71", "sighting--daf65b47-14bf-4316-bda1-c915c083d61d", "sighting--1581bbee-bfe2-4657-8023-ad73ffbf0219", "sighting--a7591cc7-bca0-4871-8611-1d51a2ac8d1a", "sighting--611e4677-c544-4ee0-bd0b-88b6da79f421", "sighting--bc638ec9-18b4-45cc-9df4-ca5b43609627", "sighting--28eb34ad-47ce-4537-a367-d2b488dc6ede", "sighting--1158be2d-cb50-4ab3-b4de-99442807b982", "sighting--fd76ff7d-82cf-4c81-a4ca-def250ecfff7", "sighting--5b78faac-fbd1-43d2-9603-06d1cadf88a4", "sighting--25080081-547f-4efd-8a1a-9970bc29d079", "sighting--15d38d5b-dd16-4fcb-a438-f8062dabda07", "sighting--af3ee46f-c702-4e7c-9625-852b3a4babeb", "sighting--b302a6e4-7ff3-45a3-967a-225940049681", "sighting--cde0f8c4-fbc2-413c-9098-4e226961ecdb", "sighting--0ee35cbc-c5cc-40f4-9d0d-9236ee622a6b", "sighting--832d0db2-54cf-4b4e-aa01-99a67fc50c2a", "sighting--c4a3b23e-32e1-4ebd-871a-4e433e8674cc", "sighting--e6777f68-65a9-45de-a4b7-1162b44a11b2", "sighting--f6aea2a1-36ad-46c1-bac4-651bb080d126", "sighting--9f54fd76-4597-4c97-a4e3-bbfd8c21c345", "sighting--8a355891-5fe8-4e4c-8b7b-1c7ea0c7f2be", "sighting--d61fd989-7a97-45a3-9109-be54b6cfe109", "sighting--62314096-b120-42c9-acc3-dca9acfffa65", "sighting--cfa6f19b-d1cd-4cec-9c56-4546cdfd7a51", "sighting--90a5cc6e-5657-4e04-9ebc-1945d936e622", "sighting--fa7a64de-245e-4b54-9d23-0b1d46533049", "sighting--ebc8e4a8-2326-454a-9467-7d958792870a", "sighting--93b90470-e727-498a-a7ea-ebdd23786605", "sighting--111c5e11-aed7-4490-94d0-14b7302a346d", "sighting--86a40fa1-2439-4c7b-856b-9bdf92cad6ac", "sighting--dae0266f-9ebc-4331-bd44-63d1319a12cb", "sighting--5fba5253-08f9-4971-b0a3-7e93f131e518", "sighting--375fc399-e62a-4181-a714-d9b8948d5ed6", "sighting--20a3545d-032b-4839-91b1-384efcea2431", "sighting--f1d43aad-bf51-4cca-8a27-64b26ca55310", "sighting--80290d91-3a43-44b5-9462-383cc4be2def", "sighting--7104344a-77db-4e7d-b6c7-285171df9843", "sighting--183434fe-6d82-4541-ba1e-a597b548fa60", "sighting--3a24fe37-715e-449b-81ac-bfeba2dc5a39", "sighting--9f75e4a1-a09e-4dae-bf43-2cae29f1db52", "sighting--1691661b-4d92-4459-867f-02e55aa19705", "sighting--8cd0f149-f639-4865-b824-89ea9e20227a", "sighting--e58a4c44-c0bb-462e-a53b-cfd02720a2e7", "sighting--7e303177-267e-4451-89e1-d5db2a32bfab", "sighting--ccac4804-d25b-45f5-b01a-b2f5974e1285", "sighting--90ad22e2-370d-4095-9060-b742a92b5148", "sighting--8985710d-0429-4390-824c-452423dc4641", "sighting--3d127d47-1d69-4c4e-9128-ea0ae58036b1", "sighting--e9d19170-58cd-49c8-87b2-7ec49504dacf", "sighting--b4f98d6b-f594-4f0e-883d-057b7c6ce6ff", "sighting--4ecb5b8d-96c2-4463-817e-09b2fe15e303", "sighting--454f8d08-08bd-4803-96d8-9f86b5ac01b2", "sighting--e8fdd73e-7101-4722-bf2f-1bdfa58c1500", "sighting--a51b8e22-046a-42cd-a464-3d6a78952b78", "sighting--74309bbb-15c5-4b22-8b29-6968f9800a88", "sighting--12b1cbf1-34c2-4d9d-b3fc-c61b52f467f1", "sighting--f0af51b6-141d-453f-be65-15072751ab87", "sighting--af861027-7b1b-468d-8cde-471ae54361ce", "sighting--6ab6cd5f-15b7-432e-b5b4-d5cdc95ddc9a", "sighting--45442533-077c-48c6-bdc1-84071049ed87", "sighting--7ab91ebb-708e-40d1-a003-a7831f38ac70", "sighting--c7098ba0-2b3e-4a99-ab2c-5e9c1d715167", "sighting--1b1e8d39-0cca-4587-8cc5-11b4091b2894", "sighting--4a310ac8-e94c-4462-9370-7c297ab264b2", "sighting--80c9b49a-8c6a-4f64-ba18-f698989d0ab9", "sighting--6331db1e-364c-48a7-ad5f-d94753e23935", "sighting--77c200e7-7803-4519-92ee-2d4ded6707af", "sighting--b0abd8a1-af74-4911-8d05-bfe5567a6fa8", "sighting--8d84c531-3f13-4376-a3ae-a4ae0ffc99bf", "sighting--adca22fc-0803-41d9-b7dd-f3ba2ad14b2a", "sighting--5a8df96b-a4ea-4dc1-94ad-9fd0f239e311", "sighting--db172ec9-6d42-46a4-b1ad-669586e0b47b", "sighting--513d4be3-162b-460f-85f1-868e568bbf8e", "sighting--544c9753-d5f0-4837-b1ea-7e1914b111e6", "sighting--d0bb52d0-5c89-43f1-a2d7-cf1e7bb676f3", "sighting--ff7c4a55-4b4e-4562-a966-f56ee83bf9b3", "sighting--c0deeba0-7b49-4fb2-8256-788735fd0d94", "sighting--d59fdd59-eb0e-4f8f-a4d0-9ef190bd94e3", "sighting--8752b6ac-cf49-4a39-a732-9b5a8295104d", "sighting--b8e03b92-2590-4fe3-b18e-530289f86839", "sighting--58fc80e6-a1a9-4e31-a845-efe43c18bcd8", "sighting--df01b391-8dde-4607-ad60-ca921d62b3c4", "sighting--9febd48a-1d6f-4859-a263-4aea01822bd7", "sighting--da1e0eb8-18b9-489f-a529-5624a15b6aed", "sighting--f4c3475d-4818-426b-9216-047e60846771", "sighting--e37cea91-7871-45f4-afd4-0f64a882e7de", "sighting--d2b444e2-a841-4793-ba4f-615c37298500", "sighting--e4d4a0d8-73de-4be8-820c-059fe0bbca8b", "sighting--2679dfd3-d6b1-4c35-a021-3570480d6e2b", "sighting--90bfe507-46e7-4cc2-8446-b6efa5eb5017", "sighting--c308c958-be36-4592-9ae4-b7a992dcddee", "sighting--a7b85c77-6971-4da3-845e-06b934a2ef6c", "sighting--44bd6785-eec7-409a-a554-f5fe4f066d2a", "sighting--0141b6fa-a722-4a7a-97ea-68a660987d89", "sighting--5264fe14-2fca-473e-a50c-ab9c9370eebf", "sighting--d7629fac-334c-4e60-8ea3-e852a9d4aab0", "sighting--4750b050-9e4a-49cd-bba2-3a4eb1fdfd84", "sighting--6c29804e-83e1-4d88-a629-aa67beb43ebd", "sighting--d73acfb9-249b-4b97-b4b9-06f5f9ed73bb", "sighting--65398ecb-8427-49ad-b355-80b3af41beb5", "sighting--753a583f-22bc-4458-a945-849fafd8735d", "sighting--c154507f-8842-47c6-9354-fa6a42d747c4", "sighting--09eb9f3a-3579-40a2-b135-0963057ff147", "sighting--642e5531-0fc6-4506-a74a-2ac0bd045531", "sighting--d1d0a160-b2af-4214-a07d-ebcbada78a96", "sighting--39e50333-f0f9-41bc-b17a-a15cafdb5cfa", "sighting--79e18f38-f6f9-49d1-b0d1-86f63c2d50c9", "sighting--53ca43b5-2182-4d20-903d-b707612c5e16", "sighting--e4371ac2-1c7b-4c81-9618-ce319867cbe0", "sighting--ef065bfb-f01b-4b18-bfc4-2cbed4d67969", "sighting--5df55c93-7f8e-46f4-829e-d84802a53fb8", "sighting--da411bda-1d73-458e-b313-6b7ceabc7fe2", "sighting--30b1280b-e12e-4f64-adf3-26e244ca77ea", "sighting--6e3ba9c6-078b-4298-8886-4e67c6477023", "sighting--2439d63c-a233-44ef-b102-887dc565f97f", "sighting--6939be1d-42dd-47cd-9739-f3aaa90468e0", "sighting--4f54700b-0496-4237-89e9-4e8bce01abac", "sighting--d8858e52-d158-4dd2-8dfe-5c13b81fc689", "sighting--1f74343d-8ebe-43b9-ad41-f9c3d72c0fcb", "sighting--2b7a9daa-309c-45d0-9f32-f3ae9f6cb377", "sighting--07b22c6b-4f4b-40a8-83e9-df3b083e7ece", "sighting--d036b51e-83b5-4fcb-95e3-1ef2b42cb241", "sighting--f4193afd-6df3-4c87-9a6d-816ce52d1795", "sighting--c07ce653-5ba6-44a9-90fd-3de2e63d8236", "sighting--e09dc57c-f426-4c47-84c4-4fd095cf1ee2", "sighting--f9b257eb-10b7-4c81-a778-77fcabd2c609", "sighting--da715357-0b40-49d5-abf7-0e836ad0f281", "sighting--829378b6-d0c9-42ac-89f5-90bb13cf0887", "sighting--ac6ad9f3-47c5-4b04-a8d2-528b0168d609", "sighting--243b7380-54af-4f7d-b04f-5ccfab411fbb", "sighting--7842e009-de0d-43da-8f2d-779359d01e15", "sighting--77f08c7a-c4bc-448b-a161-8378ca648846", "sighting--fcd708d5-c9df-41ba-a53f-91058ce54b59", "sighting--443c2477-82f5-4bdb-9560-90c7ad7f8fb7", "sighting--092d5e46-c84d-426e-a0c4-cfc2ed96f651", "sighting--1e8415d9-0880-4798-8d42-ce5ce29d29c4", "sighting--2931c14e-7562-4edd-8460-aab847ec5b72", "sighting--03ae8caf-a986-4234-910f-89fd22146e01", "sighting--3aa7ec02-141e-47f2-8b82-153abbbd9ad9", "sighting--c9a58224-99c5-4933-acee-79f3bb583e9a", "sighting--e835df3d-94c8-40d0-bcee-be42281c7b9c", "sighting--dbec0ae5-7117-45f9-8de3-07b5affbf1de", "sighting--3756b1cb-f272-4c85-8c00-bcd93e078108", "sighting--e2f77ee3-650e-496c-85d9-0deb4b374ca7", "sighting--feee6b73-1afa-448f-a933-c85439173112", "sighting--466d1304-07bd-4e1d-a369-260d6f4260f8", "sighting--b9f8f2f4-c8e9-472d-819c-ab6a0d2b5ded", "sighting--54c68807-6a01-4977-b817-82ec5a7b0448", "sighting--72419458-8f4f-471c-a5cf-f34114a9fc75", "sighting--4bfcf221-5ef9-4fe0-9fdb-693379776b49", "sighting--51d7a5dc-2fc1-4f8c-93d7-812fb89df011", "sighting--178a65b8-5d56-49b7-a969-22080d49c198", "sighting--3b049da1-deb9-41a1-b8c6-716227bf69a7", "sighting--1d8a6190-2d9d-45bd-b6ec-fbbc31a03926", "sighting--2c647044-635b-4b63-916a-6510acf71780", "sighting--9725f657-8c4c-4803-8b17-7d9e97ba32df", "sighting--c7af4d0b-6837-420a-9797-75e95c3f9a0c", "sighting--a6d1fb1e-0763-485b-8ddf-54190308fc79", "sighting--2447adef-3d36-4c1a-a75d-755e6364aa09", "sighting--bc007494-4771-4bea-8cf4-e411de572ef0", "sighting--28c90eaf-3f44-4a12-a05b-5b996bfb3af9", "sighting--0498da38-5e34-43ef-8fb1-15f6dd7c16b4", "sighting--1babc4b4-12ea-4795-847c-e889ac6a710d", "sighting--b4e452be-899e-4c3d-9d66-f1eaedf1fe2d", "sighting--8ed91fa9-4cb2-4e20-94bc-d9fc88824a8b", "sighting--cb4eff69-9250-4455-a643-307d6c991e36", "sighting--374d8d17-42bc-46e8-9183-26601a4ae6e8", "sighting--cd148bb3-e03c-4615-b2d8-9095b81e9582", "sighting--da9bd19e-210b-4c18-8776-2f7e8a83feac", "sighting--421370ed-a0d7-4d2c-8d31-12854daf9b06", "sighting--fb8238b9-5d76-4be3-9e55-44ed66c627f6", "sighting--3233f2db-5e19-4ddf-9ec3-ccbff18e8410", "sighting--cf442e57-313d-4544-8531-8807688051b4", "sighting--68f2ab6e-699a-40d4-9236-9b74f7fa4f4b", "sighting--ef94a75a-e6cc-4556-be0e-f202f5c51ca4", "sighting--e76b855f-a610-4c2f-96cc-832d7f2e8f3b", "sighting--94aae54f-4939-4b39-8905-32f89cf30b89", "sighting--58857415-dc4e-4d1e-a140-3e80cf7d4716", "sighting--5e71bbb0-bb55-485a-8aee-9d4e7426e246", "sighting--c0ea8efc-045b-4139-b577-c7a10b83c194", "sighting--28ef6823-cffc-4e2e-b466-dcfc2b8e873d", "sighting--bb45347f-0435-4316-94c8-aa2b4cbd884b", "sighting--284ddf6c-2510-4d6e-80d0-b2952046923c", "sighting--b7a452bf-14f6-496a-a9f8-743f3d2a3c39", "sighting--b3eb86db-90d4-433a-a785-1bf4abc6f090", "sighting--ebd25da3-218f-4931-9828-6c5bf25a0122", "sighting--a5922799-a9ca-449f-b224-cc4b6732af52", "sighting--de134f01-91c7-4c60-9b8e-2c28a26286e6", "sighting--251945bb-f04e-40fb-a487-0e222b70f908", "sighting--5a3506e7-ced0-45e7-8603-bfde032f6eef", "sighting--0980dffe-c126-47cc-9c25-c0288a4b2933", "sighting--cb7780ed-feef-4b30-8d3f-1162d1527698", "sighting--0b23f180-9e53-438f-a79c-150a7e6f43d2", "sighting--c23f4215-43b8-486b-ac5f-0c0faabe73cb", "sighting--af28fcff-50ac-4018-bc7b-65f313e5b2ae", "sighting--164e6626-b619-434c-9500-a64a9b1639a9", "sighting--a878dd79-3e1d-4efc-b0c9-59444fd90c31", "sighting--c2dc46f7-f246-4791-b76f-dd5239c91c75", "sighting--ca3ba42f-9eb2-4922-9950-aa15620642c9", "sighting--b681041d-1147-425d-a3eb-1605e078d9d0", "sighting--fbfcb453-c650-47c0-84fc-78c70dbf67b8", "sighting--71786537-30e6-4350-9a39-501911ec26c1", "sighting--e52863b7-732d-4cb9-a2de-75c10f799760", "sighting--27921ff1-96fb-4079-8e2f-4ee4a9e1f91f", "sighting--da78fa8a-8554-415a-aeba-f9ec4f1f60c6", "sighting--e2bbd206-d373-452b-8fce-ee43c6a8026b", "sighting--4fc66459-3483-4e16-b0c1-28071beb33f0", "sighting--7dd6ca83-d42f-4de1-a425-7906fee9c2de", "sighting--2763c7fc-b948-415d-b47d-a874f79e38eb", "sighting--5906f928-1a3f-41ef-ba8c-c48757757c93", "sighting--06506249-702d-48a9-9a13-0b7c779921fa", "sighting--562f993a-843f-44b5-9406-a63d45420f62", "sighting--6a9bf606-f84e-49a9-8715-ee40026e4db3", "sighting--9d406cc2-52e3-4abb-80e1-ac65ed2d6022", "sighting--7256d20c-f1a2-4bff-a5f8-f5cd95adfab2", "sighting--d246bfb8-2423-4d21-aa2d-cfe0e9d43042", "sighting--3fb0e1c5-3626-442a-b38e-a54eaac9a8a9", "sighting--83bbf34c-22fd-450b-bf77-3175b4b57244", "sighting--344a9246-c1c1-4ede-b03b-c5b7dc9edf5f", "sighting--77138703-ac98-4a90-8cff-6e1a87ddaa93", "sighting--d4390704-9581-41b4-8cba-1ef37688903f", "sighting--686a9845-2cfb-462b-bcc7-cd20689ea2df", "sighting--5c5cd9fc-ac6b-4784-b6d6-3f8157878d19", "sighting--113015e5-fd70-4dc6-8026-b9aa4c83492b", "sighting--b28d8a13-20e9-4203-a1b4-6058f5c1644a", "sighting--c38c60f3-3a15-4cf8-ba9b-65dd2c13ce7e", "sighting--eee92510-b2b0-41d1-8099-58e61aaa932b", "sighting--ba759ed8-beee-4f0b-ab8d-a350b2f7601f", "sighting--bb8f9b23-7c79-4d55-9b90-f201ac1e0cc1", "sighting--5c94b864-27c6-4ba7-9e75-5414263964dc", "sighting--b1011007-1905-4579-aaa8-19c39ec1c833", "sighting--6cd89d60-a2be-4023-8801-bb07bb7761fd", "sighting--ac654d19-e1c9-4cf0-a87f-cd4a0751a2f5", "sighting--fd8f62aa-9aa2-4fc0-91ee-2daba09b89c0", "sighting--ba83d22b-b28a-445a-9969-fba5509955d2", "sighting--9795f4b5-4dee-47ff-80cd-2a5103605dc1", "sighting--eecd9d28-4f56-4428-8ba4-a6108c90568f", "sighting--4f222455-74e8-4c16-96b9-4fe1fd10af35", "sighting--7b8cb095-65de-4a89-b7d8-e40d78e679a8", "sighting--45433f37-3ed3-4be3-a908-5027c5f1a26d", "sighting--d974750e-0136-4507-8914-db5c8bfe64e5", "sighting--4de7dcb1-8494-4f2b-b2ae-7fb8fa45b464", "sighting--43701358-2cc0-4eba-b52a-9804941ea863", "sighting--32b9f989-cc7f-41b6-a9b8-087ec1068d1a", "sighting--855fe2df-0d87-4a92-af18-99e17b57b6c2", "sighting--ca4bd086-3487-44af-88b0-f263d0ca95c0", "sighting--6923d4d3-0de2-49f1-a190-672e30b1eea6", "sighting--cd804baf-6013-455d-961a-de85087a776f", "sighting--736f1cda-b813-43ff-b3f9-1ec6eaabc004", "sighting--c9c557e3-0bd0-477c-8afb-e419293bd167", "sighting--163bccf0-d5ae-4cf0-a5c9-5f4363f0a1e4", "sighting--84b35f1e-e59f-4546-8ac0-8618f3f17b8a", "sighting--d42e24c9-d973-452d-9f4c-0e18f7ffa85d", "sighting--dbee9d78-ba39-455f-9277-389d450acc54", "sighting--51b4a399-b711-414a-8ebe-4b21ccaaab9d", "sighting--b1f48b3f-7328-4c94-af43-4ae8aaf1385e", "sighting--d4b4d9af-60a9-4d59-8b1e-2ac9bff1402b", "sighting--d22e4b35-539a-4cfc-90f1-7422bfe197c5", "sighting--3f585c62-e8cd-4364-80e8-bd780a087dfa", "sighting--48127a98-882c-49c5-8a87-37c3e0cd4885", "sighting--80a124a0-2ae0-492c-907f-bec619805e9b", "sighting--908cd065-e6f8-4abf-a4fe-b41b6d3f42a8", "sighting--c8bfc104-c7f2-4203-a87f-2ea47e1ce516", "sighting--92d0c369-cc1e-4da6-b36b-06b92b3214c9", "sighting--b86ba641-1d8a-4fc7-9b2b-70acaed91a38", "sighting--1d9b8f07-b32b-4d13-94e1-d9a5292c33db", "sighting--8443d03f-774b-497d-988e-de9762896ed7", "sighting--b5a56183-f007-4568-b8b7-c80e1704b93b", "sighting--a4864004-a0a1-4df1-9947-c27c1a7220ec", "sighting--9940f5d6-4418-4d28-b972-8254272a4a2e", "sighting--b7f0854b-33a9-466e-9cb0-65a3510b3769", "sighting--88b91bba-a5f6-4ea1-8535-c130ef8c3eb3", "sighting--0cf7be80-0073-4a10-87d4-e4916e32bdbc", "sighting--0f410567-f0d9-417c-b32b-910ab5d25896", "sighting--bed75dc6-4889-4297-877f-4050a621c30b", "sighting--6cb8db17-f2ab-46c6-8a7b-d0044fcb9dab", "sighting--aa8a97a7-1b0c-4b92-9aa9-44db5e46df4b", "sighting--a7974052-2122-431c-b2e8-793c527d4e4b", "sighting--4f424067-c46d-4ec6-85dc-63270878ea43", "sighting--2d5240c6-c636-486d-8602-0e3693918f24", "sighting--85af029b-a22f-44f3-bf92-976fb5a9e089", "sighting--843fd353-d393-426f-8112-491bcaccf438", "sighting--032dcca2-e9c3-4b12-badf-bc583bc2b8c0", "sighting--535ca5c4-b2c3-47a8-bb7f-4a6288947e8e", "sighting--47dfeb66-0228-4c87-9fd6-b377f8a42cb0", "sighting--5133b675-fb43-4c49-8d32-93adfd97d296", "sighting--c4100595-df7a-427c-800e-2d8e0006539b", "sighting--6959e89e-c5d1-49c1-b31f-5c700263b7f8", "sighting--630d916a-2593-4d71-a2e0-50fb587b8568", "sighting--4ab9a8c6-998e-41d3-a278-b96a699bf6cd", "sighting--bb1683b3-ade0-4d92-9dfd-3113e2b61040", "sighting--8e268f95-35d5-417b-ac50-9a1217bb99a7", "sighting--2764fd1e-7485-406f-9a44-8d4509a1ce7e", "sighting--a94ddaa6-88fb-4824-8a85-919b7fc96040", "sighting--c8c2aeb4-df7e-4ba5-881e-af97fec75bee", "sighting--2aba3b34-a76e-47cf-9449-0fda8b861bf4", "sighting--ff952d77-6699-46c9-9d18-b2553ca7d9e1", "sighting--d10554cb-8954-41f9-a2a0-ee8640d8a39d", "sighting--f0c0b97c-d53f-4901-a214-e3b36ee77c62", "sighting--172b13d9-58ad-4018-b0e6-0827c7ef8c6a", "sighting--20a0947d-7ae3-429a-a2d3-f2e3b4865958", "sighting--06a7b60c-e693-4935-a580-1b1ef70ae4bb", "sighting--ebf8c4e6-b9d3-4899-b05b-6b4670129f73", "sighting--143359b2-b11b-4fc6-a5c9-edd1dbe7f2e2", "sighting--35bbcea7-3d32-4cee-9fec-bc4cb7a6e8be", "sighting--f0d3c2c3-2142-4e7b-8f1e-69b80cbe3a5a", "sighting--bfb08ab0-9a32-4bad-9cd3-1eded45c319b", "sighting--fd8fb714-357b-4ce1-9844-d1f3c4f0f40f", "sighting--4becd0b3-b49b-47b0-b589-ed14b6cf2afd", "sighting--7982d725-a863-45ea-b23b-19bf8a81221a", "sighting--b4b59b98-0119-48fd-82be-f1e6acdc1461", "sighting--2dfc30de-ee48-4605-9a37-6fb5477b89a1", "sighting--da5616c8-0cf5-4739-84ad-97ec2c22e13f", "sighting--8ca43b85-086d-4801-b5a7-0fe13faa5788", "sighting--d4b98065-258b-43ab-a4b3-73ed36e78bd6", "sighting--185c4f6b-fdae-4134-9186-75e8d166efac", "sighting--12eb5588-3c42-40e1-88f9-45eabcb6114a", "sighting--07b703be-5eeb-4dd7-8799-b9a72531ee7b", "sighting--15e4d8e3-f470-48e9-8afc-c1dfba2474ed", "sighting--a871e3e8-de87-4ac4-910a-29c760a59219", "sighting--809dd2a4-2e24-4489-af7b-637b0ad1cf27", "sighting--6539f737-389c-41c1-a1d3-6e650e4974e7", "sighting--2bc71c7a-ea5d-4059-85f2-308a6207941a", "sighting--ed096fe6-3c20-4106-bb65-97df2dc06063", "sighting--76739e8d-f035-4b57-b287-db7ee3c4c787", "sighting--c15ceee8-b7d6-4e0f-b1d2-2533f7c7b09d", "sighting--e8a1379e-5fb7-4521-8fbc-5615e82f8b91", "sighting--1a77171f-ec15-4f5b-b975-d2cae8802503", "sighting--122eb532-110e-43ec-83d1-27976621e1da", "sighting--30d17fac-4fd4-4042-a66e-236b202d4c22", "sighting--78188842-7623-4b3b-afc8-2688313408af", "sighting--d43ce87e-585b-4dae-9738-cf3f7238994e", "sighting--16f869b1-6af3-44a1-bcd3-9f83774e2ac7", "sighting--35de17b0-2a46-41e9-8cf7-1bbf2e453063", "sighting--4d7d4b54-6ea6-4b1b-a632-76ea9eaa03d0", "sighting--8efac0a1-f070-4f98-8795-bdb2a09008b7", "sighting--fb58ea06-3168-4e21-bcbc-d58a5d7a2e6b", "sighting--fa2eac09-33e7-48dd-97ca-e70b6c0361f0", "sighting--ae2a63b7-2fb2-4785-b7d9-1077e5431bf6", "sighting--d740152a-ee03-43aa-ba3a-a4753fc854d6", "sighting--ca32bfcd-1b1f-4df7-96e3-632b1bc79387", "sighting--29d48b45-f2c9-4088-9f1c-e93a91bdce80", "sighting--4992719e-2e5d-4042-a1ad-e43886bf845b", "sighting--e0d65a9c-1f72-4cb7-9955-84320e2e05d8", "sighting--10c275db-bbde-4512-a060-cbbeb2e03038", "sighting--6b6187b8-83c9-4a2e-860b-373051e151ee", "sighting--845b9d7b-514e-411f-8ddb-f45646dd7402", "sighting--250de749-9fb2-479d-a887-ad1b87531855", "sighting--ed873cdf-ae1e-49c0-b60c-14ae45e1c8ee", "sighting--ed414eb6-7abd-423d-bdc5-1c1b77197046", "sighting--f1fc572b-4622-4afe-b6b4-18aa8f4ed17a", "sighting--d3f394b1-0c4a-478b-9965-98ddad237b4f", "sighting--c7d0d9e0-fca0-485d-bf5e-51299e26743a", "sighting--167a12d3-0804-4905-b291-bc9d72fc4470", "sighting--8a8ce92a-f9be-4f1c-ae6b-49ec607f34d5", "sighting--5047ac8d-2b4a-4fe4-ae18-3c69bbe72b16", "sighting--199433cc-ff62-4c93-920d-82affd4954c2", "sighting--dd722e9c-9c24-43e1-98c3-b20131dcacbe", "sighting--cde3e5cc-21bc-40e6-80f7-aaab7e4421c0", "sighting--90602f09-6db7-465e-826d-279f41fb0312", "sighting--08bcc87e-1831-47c8-be09-6246df1b9da4", "sighting--d398f08a-3021-49bc-863b-f8eb9c0cf21e", "sighting--62e8c119-d802-49cc-a248-2fc13adf2890", "sighting--f0f574fe-42a2-419e-a1a3-44c80c4945b1", "sighting--661a22a2-8806-44b6-be14-43b39e952b45", "sighting--723f7714-367f-4cde-ae7f-bfb0367bdd0a", "sighting--d8e3f6e3-3138-47fe-ac71-71a9d13a6fe0", "sighting--39cb6145-a99e-4a07-9ef6-cb9db8e28e30", "sighting--0318d6e3-6e89-4fce-a9af-8d27f67d3f91", "sighting--0a8ebcb6-51ba-45fb-b66f-ed48731d8e10", "sighting--67c15b98-e511-4f2a-b98c-b3065e4360a4", "sighting--011b9eba-4e0e-48b7-b0ee-0b12ca38af42", "sighting--29c470f8-9781-4692-b5d2-4b571ea0a281", "sighting--4e13166e-a970-429c-b36a-1c4a5ca484e8", "sighting--39fab6a5-30b0-4db2-bb6d-93788f8ad68a", "sighting--d991dd59-c8dc-410b-8fa7-d594f13246d5", "sighting--ccb82f14-091f-4dfb-8cfb-a17a91fd0ca8", "sighting--2c647685-def8-4404-bee5-082cabb63cc5", "sighting--5632ddbf-b254-4556-a19a-b43d524bd3bc", "sighting--735a53fc-531c-49bf-bdf4-265a817ad8c7", "sighting--d754c2d5-bb94-45f1-831b-e602222b44be", "sighting--deb6b549-df54-497c-8c40-ee4f6f2fdd07", "sighting--544607c7-fb67-4e4f-b229-59a4791e7064", "sighting--6a0aac19-0d61-40f2-9d20-c3b1e988464f", "sighting--92f3c590-164b-4022-85a7-be0d49d97437", "sighting--c71c796b-53b6-4621-8483-bad76cc3592b", "sighting--55557534-07d7-4973-b95b-11dd2f7a99f3", "sighting--ee2bd0ff-a3d9-4f49-9e41-58c5d556dddd", "sighting--20690cbb-ab3a-4cc7-8c89-9f0cbf89f1ca", "sighting--fa8534aa-2ec4-45ee-936e-4664cf8513f4", "sighting--2faa2047-6d9f-40b9-a3f4-7f8b8123d722", "sighting--12a17625-eab3-4891-961c-b150a21df74b", "sighting--0b044502-e890-40a9-a790-225f0c75fdb2", "sighting--22e11db5-f2b9-434a-848e-9f4a7bd171a1", "sighting--e50bbdae-0ccc-4e06-a411-1643564b46ab", "sighting--bcdb2d26-2ef3-41dc-bc20-2a62072f0797", "sighting--2c8b8623-b6a2-47cd-99e9-b017571438f4", "sighting--dc4fc1e5-6d11-416a-ac8d-e4e7ca29d732", "sighting--68776656-482e-4e28-ab33-01380c78aadb", "sighting--8947e1af-0e85-4346-9f55-d0ccf681f6c3", "sighting--ecb767a5-2898-42ad-8c0a-7c6add5914e0", "sighting--7b84364c-0473-46f4-afee-849c72f5f55c", "sighting--fffe2d2c-d632-4206-8608-a341dd42ec3f", "sighting--9f257fa2-603c-4321-abaa-020756bab918", "sighting--7f7eb4fa-9833-405c-bcf1-ade4ca224282", "sighting--b4416043-b9dd-4ef9-b87d-da9d89c592c0", "sighting--1513aef3-e11b-449b-86e1-0b1983e07891", "sighting--dc6e085d-1458-4d06-bf8a-846937c596bd", "sighting--61400066-077e-4078-8a64-52a5316356d6", "sighting--0ba8f2aa-8ff3-45b5-b38d-3d14ef733ed4", "sighting--4f877ca4-1f09-43c3-9826-2a8be662517b", "sighting--6f4bf8cd-381b-4ce1-8953-e1e3634d7a55", "sighting--b7631bbe-dbcf-4f75-938e-58ce552b5822", "sighting--7998c4c1-ecc1-4043-b146-f87e6a387263", "sighting--ff597f50-0947-497f-a771-6a109c2de837", "sighting--7d49364f-6f38-4d28-a2dc-e655d7a02573", "sighting--1d3797db-c395-40f0-86d2-1cc32f3e0a66", "sighting--93744147-0ab4-4950-b11d-0796a517d3e7", "sighting--8e8eeaf4-301f-4dc8-9fdd-57f5bdcd6977", "sighting--3abc6eff-d0c9-41d7-b7c8-a9345fdb5c59", "sighting--c836f13f-7a51-498d-ba8e-7a103f50c6bf", "sighting--18d9bebb-40cf-427e-ae5c-2bcdfb77eb11", "sighting--bbc65d82-f97b-4d53-920a-2d4cb5b560b7", "sighting--33e06bbb-4fe4-4ddd-86e7-b8d55d460209", "sighting--ea695e03-2f8e-41a4-8493-c5309344dbff", "sighting--68588f9c-9635-4693-8ae6-bbe1c06a2f68", "sighting--f66437ec-a5fd-47f8-854f-95cf10d4fc0e", "sighting--8d7a1bba-d4d9-43dd-a87f-97d9281be72e", "sighting--577fadf3-5f40-4e52-a544-899651f92b52", "sighting--90b841d1-1564-4dc0-8c47-42959e8519fc", "sighting--b25abc34-15ee-4613-8f49-de86e6804019", "sighting--caa7125c-fd72-4e85-875d-d3ee6cf071a1", "sighting--3698ed08-585b-458d-b013-f78f1fdf0443", "sighting--5e7ca4b7-697f-461c-93d3-886eaef111d5", "sighting--19c96544-df29-466e-b3e0-dbfbc319f8c8", "sighting--e305777f-bd68-42ea-8527-045f88bcc649", "sighting--d4460d73-f261-4623-927c-6e85f729b989", "sighting--bede3791-a24d-4b39-b2c6-054cca626b75", "sighting--70faf74c-762d-4096-9d83-ca202552a2b4", "sighting--cfd1fb9a-44ed-4919-91b0-c5048f73d1f1", "sighting--2d37ceb0-195d-4a44-b729-b018e7a1fbde", "sighting--fef7c057-1e15-474b-bd5a-3f66b970f496", "sighting--9243db74-ef22-4c36-8f39-9f99a1522cf3", "sighting--e4179f5b-4882-4ccf-8d00-b4638a439629", "sighting--27a23b94-8cb6-44f1-b9cb-b14cbc7b4b8e", "sighting--904feed5-7ada-4463-94b7-b3425fb14673", "sighting--b896233e-1185-47da-bcf2-6f7c52cb862c", "sighting--ccf0f30e-792a-4190-9d54-e5e54b4421e9", "sighting--b2070530-ff4b-4c6c-b999-0dedcf3816ea", "sighting--5105fdf1-903f-4438-b6e9-6f942182372d", "sighting--003c228d-4ec8-4756-90ce-4e21f8bced47", "sighting--9c318175-b1fb-4128-9e4d-f876f69b23e9", "sighting--f9bf0377-60e2-4699-b1e4-baefb94c4e58", "sighting--18294434-3e30-4869-9d8f-282610e174e1", "sighting--b5ee8ecf-ef6e-4b40-8fe5-b19b5f9c5db2", "sighting--fc1ec05b-564b-4ce0-9a01-afa8ef33a91c", "sighting--368d172a-1bfe-4771-adc6-804b0b246839", "sighting--2d48894c-5467-4a26-88ae-1fdb385f95e7", "sighting--d2bed21e-84a0-495a-b445-41a88cf11182", "sighting--2783d182-d47e-42b8-89e2-972897ab3d5b", "sighting--b13a9a91-71b6-4e59-a758-1c388876a01b", "sighting--a626c28d-3eb7-4cd6-9006-770f46033617", "sighting--1606da6e-1ffc-4403-af18-646b93e5d3cc", "sighting--191d531f-2897-40a6-9877-b60350fd0bfa", "sighting--c34797e4-a64c-4942-8415-82fb9479dfac", "sighting--9b20e933-f685-4a3a-a173-d87c53ccb1fd", "sighting--0ac85b8e-bc8e-4b52-a740-8a1876da75b3", "sighting--80a33fda-1e99-460e-baf1-4cfa4e189e8f", "sighting--1e55db58-131e-410b-8542-66aa9f4c0f75", "sighting--5ba8b6a7-874d-4c27-8f12-0ea2375bd297", "sighting--0319747d-0970-4dc1-9e0b-f8c50c582eac", "sighting--adc06ce7-3569-49f2-abeb-e899ed865ba9", "sighting--c0257ad7-7b95-43a9-9a55-b9d667438716", "sighting--6cbe5e04-70c9-443b-83a6-d63b306b5ea4", "sighting--cd425d28-189d-4d97-9f2e-d61812d2f55a", "sighting--efebdf6e-6e8d-4855-b154-ca8904bca6a5", "sighting--4f17ab3b-ed84-47fb-9d37-fad22bf09fc7", "sighting--27190e28-236d-4513-a9f3-846ddea63fcb", "sighting--2950aff5-dae1-41b0-8226-35b06b2b0b9d", "sighting--ba50016d-78a6-4408-97d7-5c51230947ac", "sighting--014dcfe3-7c68-446d-b548-fd60f5c71415", "sighting--baca6aa7-693c-4297-bc2c-8707df7c1a24", "sighting--5c37d6f1-6f20-431f-b794-0ee1659ee489", "sighting--d223c122-d1ef-4713-a670-26830db2dae8", "sighting--3775bd12-ef24-4767-ae33-e9697f5ff6b6", "sighting--50cf3340-1cdc-4972-9336-d8eeb33cfd79", "sighting--a375bd90-6f74-4dfd-9712-ec89d5110487", "sighting--0b39d612-ec58-4662-87c1-ef6683b8f5a5", "sighting--df59ca03-9945-4147-bcdb-93dd17b38914", "sighting--f9f21752-e326-4473-8e58-c3339bf5e1c7", "sighting--c8a03686-14b9-4832-a2a1-26b366733850", "sighting--4b896fbd-abaf-490b-9ea5-cfed973702fd", "sighting--2b2e8112-4306-41db-8085-0a5da2f28aa0", "sighting--56c7eb3a-a0b5-47d1-b909-c85c4417f64e", "sighting--09890b5e-87a7-4475-995a-6ba5bcf94461", "sighting--6d3ba0b7-5e76-4549-bb4d-6bebe3b3e659", "sighting--6bc9ed09-7515-47b8-bb65-406e948efd13", "sighting--f3641f0c-5e76-4e01-990c-8b4ffbc24f23", "sighting--2e1bfc91-7661-45af-a6fd-f6e1ecf8ee6c", "sighting--f46cce7b-eea4-42a3-9c98-b140e9147edc", "sighting--8a6a981b-17bd-4ed2-8763-788c9507d572", "sighting--69708e6b-c94d-44e9-9802-4589d2dcacaa", "sighting--92fca5eb-24ac-4ba4-90d1-cea2238aa571", "sighting--b0986862-790b-4dbd-b314-45d511c7f032", "sighting--aee7c232-6245-48ef-8e96-2c7ce0662665", "sighting--88374afa-1fde-4eea-a12b-d759fe839473", "sighting--29e94579-3265-4c57-bbb1-f20dfec100d5", "sighting--52990081-a4bd-46b6-bdb5-eb6430423110", "sighting--1a0fd40f-d508-48b0-a319-aab186fc9763", "sighting--e1697fe5-e251-4afd-bfa7-d631f56d4535", "sighting--db6b2daf-539f-4cd1-a6e0-bf255dc6a263", "sighting--b370ebf3-4167-45c2-8ffe-86e150d2a26f", "sighting--cdb5153e-8305-4365-afea-12665f796392", "sighting--e8773135-bbdb-4733-8353-63a3901c9767", "sighting--88aea90b-5ade-42fc-9789-c35fc130df0c", "sighting--fb95fddb-6099-4e5d-b7b5-e9f384b98a77", "sighting--654d1864-1fe8-4153-b290-f9ccc95e89ac", "sighting--a648dee0-348a-4289-9c35-0836e7241f7b", "sighting--77733dc8-fa59-415e-9311-8e8f5fbaf6ea", "sighting--8f8c53b3-7e1e-4d53-af58-55436399aae3", "sighting--46d3e77b-939b-4915-ae86-8b4e204675f4", "sighting--210933ad-0c96-4569-8d2f-0904dec70234", "sighting--27e4e67b-ebce-42c4-9ff6-c3830067106d", "sighting--a0fe6133-89ec-4004-9a68-ba3d6c8f98bb", "sighting--3a9beb49-b8ce-45d1-9785-b45b4acbf801", "sighting--84e00175-206a-4243-a268-6d99b030a874", "sighting--1bb1938d-7e84-489f-aa94-0776f61bacf6", "sighting--02ab56cc-b5e7-410c-a3fa-db47f40858ce", "sighting--db175746-b736-4654-b772-08a8dc596b25", "sighting--933cbb29-40d1-42b1-ac3c-e6aee5dd0fb1", "sighting--551ef286-d27a-4aa7-aafe-1b9808e599d8", "sighting--846b853f-0758-41a3-b1c7-6a5ecf894c92", "sighting--1e224996-4d8d-4031-a1b0-34d6f8e506f0", "sighting--e69d4d56-33a5-470a-bf34-c8a8a83896e5", "sighting--fed55902-3eb2-4b94-89c5-8fc17905fa88", "sighting--e10f707d-dba1-4d0a-b472-3d9282815bdc", "sighting--8af2d38b-248f-443d-a885-2b6e566b8aca", "sighting--89f1a067-a356-4a04-a300-36315a494f4a", "sighting--1c670cfc-5b3c-4f46-a04b-39d6a8b164b4", "sighting--d59e7244-814a-465d-801d-221d8ef536f9", "sighting--0f1b7638-adb3-47ef-a66d-6c5f3fbab368", "sighting--de2ee0bb-1359-4564-9f8f-36602887e14b", "sighting--ff92b496-c56c-45fe-a38c-b081172f9200", "sighting--886945fe-ebca-4cf7-8a75-36302d2eef28", "sighting--2d783089-3960-424f-af9c-a7b0e3c8d91b", "sighting--a5ee46e5-7d90-4b13-b777-a4545902ca5e", "sighting--4f84cee3-5daf-4242-bc7a-2fa361e580f2", "sighting--5a859246-0ae3-44b6-ac9f-f4fc3bc398a6", "sighting--a2261ebf-a521-40b0-8223-96b71e8a94b9", "sighting--aa1c707a-94ab-42d5-adda-0275a519f931", "sighting--b907e7bb-5d4f-482c-8c33-ec3e27c8b579", "sighting--02bdb095-a644-4e6b-b40c-32464e3b2993", "sighting--9c290ccc-de3f-41d9-a8e8-a73bf7c16be3", "sighting--0070ef90-667f-4f01-a365-f7d93cd4b54a", "sighting--3f239d1e-3b9d-4579-a6b7-f50823c553f2", "sighting--9931239b-72ca-4b48-824e-f65a241937a5", "sighting--5df6e971-5d86-46b2-967b-bee4fd36acc8", "sighting--32151c3a-cb21-47b7-88a8-483611b86130", "sighting--452ec1bf-a17d-4c9a-9159-cec78f62e933", "sighting--fe24be1b-cc92-40c9-b9a8-fd476ef2deca", "sighting--74b4aa6a-70ac-4f76-9417-dc2691ea61ef", "sighting--a2f4c790-3017-44ac-aca5-59af15597c92", "sighting--aed7fdb1-252c-4826-b6d8-6deb20c5b35d", "sighting--03230a48-d52e-40f2-ae83-843c54549e54", "sighting--fbeed4a6-1c25-45b2-82d9-bda51a514ebf", "sighting--05a85d20-2a5b-4328-abab-27d323a31791", "sighting--a597efad-e996-4a59-b583-06d8bd0ea10f", "sighting--e73e6e9e-1e08-418b-9492-4c3fc9ab8860", "sighting--e9e397ac-4294-41a2-a4a8-76bc19b134c3", "sighting--aad04ead-d28c-4860-ae8c-9d54fa133d05", "sighting--8ba57fc5-4441-47a3-ab1c-d74c604b1153", "sighting--60a9a972-df16-48bb-ae1f-070dae65f541", "sighting--5cb327c9-7a7a-4540-bff9-6038f0a6fe5d", "sighting--467a096c-0aee-402c-83d4-b90f0d26cff5", "sighting--60bc3495-ae19-40d5-8592-9bb76f1854cc", "sighting--85089e51-415f-4acf-9c71-d3531c7bc6f2", "sighting--2312280b-c68b-430f-b773-932cc17658bb", "sighting--e79c6fde-803e-415d-b1ca-71ea4d83ba67", "sighting--9d34a289-bdc6-4f7b-a791-128326e8cf1b", "sighting--01f7ca33-d39d-4539-9d1b-5b0de176394a", "sighting--c4e9c1de-82d8-4c54-94a5-719d0ec4ad2f", "sighting--29657c95-ec93-48a2-8359-0d03b4ef7a05", "sighting--06d5068a-40ee-48dc-8aa4-cdab406caf06", "sighting--a9388164-ebf4-481d-a8d5-4c790bc19d51", "sighting--816e4afd-b57c-406e-ba4f-287190814988", "sighting--f0b9c95f-9d7c-40bc-9c92-d61688b1d1e8", "sighting--96063225-d1a3-4a12-9405-0cf862f15cb8", "sighting--bcde2476-6d61-4214-9537-81851e6119cf", "sighting--03cfcd23-65cf-41a1-9afb-728a5d7153da", "sighting--ef5dd419-47d0-4fc2-a700-550edfa7e51d", "sighting--6e43e67a-4ea1-41be-8772-900561a8993f", "sighting--d14d89ee-912e-4d0b-b3c7-c62899d22e2f", "sighting--5766c8d9-7601-4c15-8895-aaabbc44fcf7", "sighting--194c6340-029e-4dbc-ae91-25d5600ad763", "sighting--dd4ce536-a627-4dff-a8b0-9689a08853fd", "sighting--45fea301-6b33-4e7c-a0e9-f4037a602125", "sighting--8b19908e-f969-41b0-8df7-d6cacbf60885", "sighting--796a3d9a-5d7e-4fb8-a619-46e86a47d965", "sighting--671d3c48-21c1-448b-84a8-b448301f4abc", "sighting--ed187ddd-0dc0-41e8-946c-b37220d90fbe", "sighting--61c34ac8-990e-4b2f-8871-4ccc9b5fd1ab", "sighting--3ab9bfe0-126e-4e79-b3f9-82340df2b3a9", "sighting--fc9b28f6-12c4-43b5-914d-ae1ff4ed4e9d", "sighting--39f84895-07ea-46c4-bf0f-b80bd12ebdbf", "sighting--8545da9e-b96e-42e4-b1f6-fcc5fe586d5a", "sighting--5c9e29cf-c6fa-4d45-bc10-32a7e7479e5c", "sighting--d5b2cc7b-19fb-482b-8fb9-87247f34ad46", "sighting--4160bdb7-82cc-4469-be56-13f353b6159a", "sighting--2f3ab4e5-8725-4fba-bf95-aefbedc52e5a", "sighting--60fe66a3-08ae-4216-9e21-983c8ef7f95b", "sighting--f894eb7c-b51e-4293-bb2b-a208a39a8d06", "sighting--3da43fe0-02e8-4e36-93e9-784716688da9", "sighting--cc32353e-650a-4b6c-bd36-7ea3e9de1059", "sighting--0cef7c0a-a4e2-4e57-a577-ba4a5da614fb", "sighting--328c263d-094b-4533-8786-d53cde3c3ad1", "sighting--bf8297ad-8182-49b4-a7aa-d3db02268985", "sighting--242675c8-0146-447a-a3a4-e19d60dd50b0", "sighting--ac90d546-9b66-4c9e-81af-446c86538371", "sighting--3ad29151-4aed-4357-a95d-4b2d966e17bc", "sighting--8c8f935c-517f-4995-a949-813274a47bbf", "sighting--defb8845-2835-4fc0-bac1-97d533e2f8c8", "sighting--01f40793-bee5-4b0b-a0ff-d2f66ff385ec", "sighting--5e1ea168-0406-420d-8f51-ad1aab79d66f", "sighting--7c35ed6c-aaf3-4a96-8c12-37e36f2d7a5d", "sighting--97f5e07b-1630-4a23-b05d-548eacb5a638", "sighting--7ef47c86-3cd7-4cbf-9e5d-777d0c76636a", "sighting--5324e74b-a31a-47d6-9c1f-52fc7a84a78d", "sighting--ffced027-330f-4fad-9da2-fa3838af2aa5", "sighting--deb8460d-198e-4973-bff2-b7ed5fab1975", "sighting--9573f9f9-c288-40d7-b39e-8b70ef16c17b", "sighting--f431c494-ffa9-49cb-8fdb-1e90fe84df23", "sighting--8d02c3f2-89ad-4d1a-bf85-4b532f7d35f2", "sighting--4fab19b1-015d-48d8-8eaa-9441b1f019f5", "sighting--12bd4acb-60e9-41b5-9ebf-e06449401b2d", "sighting--18467a0a-a1b5-4b95-945d-c7f4256a30ba", "sighting--4d13a57f-028a-4c84-b318-2707e5e430fa", "sighting--931833d3-192d-4906-a287-c360f8fcb5d4", "sighting--063fd3f0-0420-4340-8ef0-f3e52875ce5f", "sighting--060a7eef-841e-4f1e-87c2-48e23f51401b", "sighting--3ae2b116-8fb9-4eaf-a478-62a73971367c", "sighting--66534eeb-1f2b-4086-a68a-e04120b71709", "sighting--1a1f48cd-1ccd-4db3-8d51-2c19855034d0", "sighting--341c20cd-70a5-4a96-93fb-67e85329c10e", "sighting--dfd2ad6f-d3c5-4bde-ac53-bbf19e7d1432", "sighting--0c1c8b6b-6ee5-460b-9713-bc7af639ffc2", "sighting--4a5a881e-458f-44b7-9263-bf11d949ae6c", "sighting--e4a1dede-67b8-424b-84e5-12d82a7558f0", "sighting--7af20852-6c8e-4392-9588-89706584a1ac", "sighting--3f0ce7c8-0a0d-4f6e-93df-311c77a45ff2", "sighting--a595b063-be67-4fd7-994b-fd51996658c7", "sighting--39e9c640-e7a5-41bd-8bb9-b9981c529afb", "sighting--83536a87-b806-44f1-84a5-5f930b7b786b", "sighting--7dbec573-bb73-4d1c-a124-6142f0061460", "sighting--7e313fef-f8b2-4b5a-be81-00259b032558", "sighting--8ee38d53-0d6e-4f9d-8a8c-db59edab6eaf", "sighting--30321b62-54bf-43d6-8be7-a48023f42dc3", "sighting--963ce6ad-245f-4698-8da0-fde6c4b1753f", "sighting--9078f1a2-874b-4ba3-a874-c6d25ee84f2f", "sighting--ffba414b-e624-4bb1-8d00-88b7d81eb25d", "sighting--fc80496b-f57d-41bf-a34f-a2e870854330", "sighting--fbdb7fa1-dc7b-4c96-9866-51db4d376b6a", "sighting--5f07a119-e413-450d-913c-627f68f92164", "sighting--84cf7257-15b0-4d73-b3a6-79fa637687f9", "sighting--77582ef5-26ef-4700-94b2-a5a300913c5a", "sighting--e24ae971-6447-440b-acd8-323496a7d27b", "sighting--38d46d99-06ce-4483-8714-82833017b8d3", "sighting--32a01844-ae57-4a68-b10b-8402a78b2fa3", "sighting--004faf38-fede-4875-8dd9-78964d521e3b", "sighting--abdc28c8-5006-4704-bea8-28bf80e88645", "sighting--8a3f57d1-de0c-4cba-933e-5d9a84254f0e", "sighting--2cac1505-cc88-4ae0-8eb7-6a36276a29ab", "sighting--0cf1c1e3-81a4-4f0a-9583-93b9d74cb98e", "sighting--689926d9-312c-4ceb-8113-c3f759c4e50b", "sighting--572cadc8-0dce-413a-b712-f8b9bb8bfa1b", "sighting--452502d5-b2fd-44fe-8c65-5f192ba61433", "sighting--c7401bb6-7b2f-4e6b-ade0-a60b2843868b", "sighting--5b4e3032-3324-4ef6-9251-8b97356b98bc", "sighting--3c239876-3ffb-4f2d-a10d-a18dcf9e2a19", "sighting--d6334038-dada-4f08-900d-f52a8179b330", "sighting--213bd8f4-d014-4f21-bc16-7dd17f865b87", "sighting--46e1a0df-6b59-4d44-9ee3-801dd4294652", "sighting--a1558a38-f83b-4ea9-9040-055132111392", "sighting--6ddb979b-1ee5-4616-930f-608230561305", "sighting--b10ba4ec-420b-49d3-beea-9f04244af70f", "sighting--e535df17-47fc-47fd-a8e2-3cf49f740660", "sighting--332d736a-d209-43ce-9a9a-03a7cef55923", "sighting--9922de73-fa59-411c-a475-70772836809e", "sighting--98db33a1-6eeb-488f-ba6b-93efe4545189", "sighting--0430bc4e-8764-41fd-9423-26e8123fe344", "sighting--f1aa98a7-113d-4586-81e6-7d43ffa843ad", "sighting--7190407f-e7e6-4e14-a1a1-010a0759f7fe", "sighting--f42d180a-ecb7-45a9-95af-495bf2e8203f", "sighting--b3c4a174-89fd-4494-9421-9a2a4e954a16", "sighting--2a70983c-2b16-4f10-8b59-dd1dcb13cd3d", "sighting--33cd60a7-3877-4263-9270-fbe2d684f99b", "sighting--18298a1a-27da-4045-8c93-c8b43014efa9", "sighting--fc6c9aa8-ef50-479e-80b4-f7b468a525ce", "sighting--62aad5ff-c355-4584-8456-e4d25bb4bec0", "sighting--d4027dfc-334c-4e2b-a6c8-bb35bd890d7b", "sighting--79862591-7782-4234-8d12-025717b86509", "sighting--b61cd061-722d-4e7d-b141-4a5fbd1ae18d", "sighting--a8efc05a-bb26-4e40-8cbd-666d34897be7", "sighting--b3df3ed7-ca74-44c0-8eb7-6b516c334471", "sighting--a1320d13-8b36-4fcf-97b3-d327329fddf2", "sighting--0d9dc168-e0b8-43a8-bb72-6bab3ef4c939", "sighting--a7e55a62-2521-41c8-8780-645e191f0ee7", "sighting--555d6c6a-c710-441e-9dd4-0c8f7d70dafe", "sighting--f0ca18a6-654a-4e5b-a5df-fb7a76fb9e23", "sighting--fd202253-5ddb-418f-a316-d15cd5bfa345", "sighting--67971ecb-eb8f-4db6-bdce-bcf46cb99b3e", "sighting--5d62f782-ab92-4ff3-b087-503a0f7a93ca", "sighting--bdfa0bdb-f9fd-4db6-901e-b071cf01cdfb", "sighting--75a64402-caa4-4bed-af5e-920486e655f3", "sighting--a3da87de-306b-4ed8-bef0-6c3c7cd07d71", "sighting--1e9a3d06-2b08-4354-a566-718fe98a5075", "sighting--cf22e189-996f-4dc8-b399-cb90ca139592", "sighting--ac511337-e89d-4064-bac8-86212a8dfc5f", "sighting--9489ea43-00c8-428f-a495-4654ded6e198", "sighting--a4df4206-63fb-4cfe-be8f-964e2bf47701", "sighting--27b1039e-15b3-46b9-bc2c-c475538fe489", "sighting--49bebc4e-6092-464f-aa3b-0f2351b058d9", "sighting--44a81cbe-0a04-48eb-be1e-baba257c8032", "sighting--f7f20fe0-723d-4b7e-89b3-93c99b3a43bb", "sighting--1027fc5a-bbd8-479c-9784-3553b61b2c33", "sighting--695c0aec-3414-4d93-a441-37e2f2ba51ab", "sighting--483e177c-1e01-4929-a777-6da7ee18506a", "sighting--cba92595-4ac2-4539-9a31-596df4e450d8", "sighting--a9af8944-c8b2-43bc-abfe-81b3e8b004a0", "sighting--d876bf13-4091-4620-8c8a-df72bd17ea1e", "sighting--f5c4feae-5e95-4dd7-9a0f-71830175bcd2", "sighting--132ce7ca-693b-4fbb-ba63-c16809d96390", "sighting--d2182b28-c3f8-430e-9958-1a205fcc284c", "sighting--44639a4a-8688-4cfb-ac6d-880f6038e0c5", "sighting--345b1ef0-5569-4de0-8f40-052ff13b1fc0", "sighting--e3d35cd2-e6a6-41a0-b3fe-08082bfdcea7", "sighting--90b70d60-cc85-4d54-950e-59a7fcadffc4", "sighting--7e0e557e-a10f-4940-9d96-16f349f0caee", "sighting--d4e248a5-f805-42ef-8574-0cbe71fb910d", "sighting--f7c08a8f-f4ae-4f04-9f89-31de37f378af", "sighting--e64f1646-fc49-4fd8-9507-bd39a4d4220e", "sighting--067ef2e4-190b-4a6f-b5fb-84d0bad78219", "sighting--16e99fc9-cb80-4ddf-aabc-39048b6a23e3", "sighting--b22a082b-c3a2-4225-89a7-866e21d835cd", "sighting--5b06a636-1396-4371-8b49-cfcce19ad0ec", "sighting--79f647e3-00b2-4358-8efe-4eec455483c1", "sighting--e6e66957-3b31-419b-a810-2e27e4426b2a", "sighting--16937d28-44d1-4009-882b-ebeca46e15ac", "sighting--9427f7b5-250a-438d-bab2-fa98a5b0bf51", "sighting--11c83961-7587-41fc-8fc1-5d0610de6e54", "sighting--131b2bb0-dd7f-4929-b405-6b29a64089d2", "sighting--6820d20a-ff4b-4cf1-a31c-1b018d11fdaf", "sighting--cdfedc1c-3bbe-46df-a0cd-663ba655b6c3", "sighting--3b92332e-ea34-44e1-aa00-9dc3069ee0af", "sighting--663645a2-547d-437a-a61c-e565034125b0", "sighting--06f5f231-eb58-4a27-8a7b-5618054c17dc", "sighting--f200a712-3b47-41f3-84b9-0d238cba0bfd", "sighting--0145d595-8c21-4932-8402-b80439a4bd57", "sighting--ad5375bd-d4ca-4048-a89b-c974d4826ca0", "sighting--4b707d5f-17ca-4f2c-bb59-450b81e2995c", "sighting--585d20a5-d778-4769-a9c5-32720fce4b50", "sighting--baa00bfa-f067-4059-abc5-75266e3cacc7", "sighting--ef7bc520-3c03-495b-b3c0-0c7c3fe6ba69", "sighting--e89dc232-af4d-4883-8462-c952c5e085bb", "sighting--ec33c0aa-952e-4ec6-9110-bc1df89442bf", "sighting--54777d44-5d11-47de-801d-7e939c4c19d6", "sighting--63644554-cb3f-4ed3-b282-587d614a9a2f", "sighting--2e58b178-89df-47f3-8254-30ec8368ef93", "sighting--c935716b-2dc3-4ee7-ba31-ccc12054a4e4", "sighting--6ad96cb0-beeb-4ad5-9c70-865e38d1be42", "sighting--64efcaaf-8d7b-4c6c-89e7-190e86a04f27", "sighting--5a4c25c4-4216-40dc-aff6-4a5ebb864290", "sighting--7d81c449-1c50-4ea2-b188-c06cc8aa9041", "sighting--bd3d8fcd-101f-4566-8fa5-ba4fe4e4746e", "sighting--539d8348-262e-4037-8cb1-18d30f3893c1", "sighting--f7260a93-9045-4a36-9e0b-5e187a064cc5", "sighting--d8285bb2-84c3-41b5-b5f4-7449e2ed40d5", "sighting--8d42a58e-356c-4657-9cf7-dfd39eae9143", "sighting--8466bd29-a7ca-42f2-991a-1e6c70f941c1", "sighting--8107e211-ef07-413c-ad6d-ebf6b379f302", "sighting--b6b8de31-7c25-48b7-9109-56606cd9dd52", "sighting--e7ab2e78-213d-45c9-a4b9-e953b487b4b8", "sighting--65b6e573-2720-4b55-a221-73594f769898", "sighting--fae6c4b5-8de5-49d1-9109-1b26a1337da6", "sighting--bcd98d8c-f39a-4e15-acfe-22f3e0169920", "sighting--8d03a81d-ffb9-4a7f-9beb-081bf0e44494", "sighting--73d36fab-5363-4918-b995-c9fbaa69215b", "sighting--330e0450-6e0b-4c20-a39b-4cedb1df09e5", "sighting--cd945eda-e222-4b6d-aff8-6e1070ff2f4c", "sighting--ea8445d2-f9b5-482b-b659-8e7747eb95f0", "sighting--ad97c36b-a06f-4e6c-8cff-3616177449f8", "sighting--63e935ae-e77c-4199-816e-f98f689a909f", "sighting--466fc481-861c-4286-b3cc-11c788bcadfd", "sighting--95c56def-3a4a-4909-bdef-ac65225b0ec9", "sighting--4f254417-54f6-46ec-87d7-29b93e898a23", "sighting--de695d32-35f8-423b-85ae-b61670f1645d", "sighting--d9ddc334-3ff5-4b72-aedd-d732731d1c75", "sighting--06fa0a88-37c6-43f5-9fa0-cefc630086a1", "sighting--66411d47-0dd0-4c36-8d1e-085b78ddab1d", "sighting--37680fe4-4688-4680-9b01-410f3e65c558", "sighting--52679edf-3848-4bfc-af06-0141a8623a3f", "sighting--e6fd4012-1b34-4db3-9f2b-5b3f9733f94c", "sighting--a35f436f-5c3c-4c62-8fdb-43811009831a", "sighting--f5a4d2f6-3102-4c97-af09-9d9e88ba7350", "sighting--63fd4bb8-6e26-4871-939e-158970d808c4", "sighting--a8b59b4b-9854-4a3c-b0b9-494dc9f6f1ea", "sighting--5dd4ab77-b99f-4714-8473-9f68457f8615", "sighting--1dd9d2b6-4bf8-4163-83b2-c780eb68520b", "sighting--3a6468fe-4dd9-41f5-b3d9-21ff8363330b", "sighting--5459d592-e097-40e7-8cc0-8cdb12d18abd", "sighting--c35a7254-62f4-4f1c-965c-c9274c79f3d4", "sighting--644f3e84-f408-40ce-9a98-4905cb122546", "sighting--5b6df5bb-449f-4f0a-92a9-7aa49aec9cb6", "sighting--564782c8-de81-4440-9f82-2d313a5d1bc1", "sighting--55962f39-1fde-4bf5-a1a0-e8c13bced71c", "sighting--24992d22-19dc-4e44-ba38-1188ddfbff8d", "sighting--396946e8-1cf7-4960-9d60-c24bc3ae1f9a", "sighting--970d4cdb-5e6a-4ebf-9166-03cd26053b11", "sighting--cbc00948-ab3b-438b-b64f-aec2a9da6cdb", "sighting--d7856e6a-e88b-4888-8e05-dc3e0dd44bf7", "sighting--6dceb0e1-8907-454b-aabe-fb4542904dfc", "sighting--92392257-48b4-4b14-82ab-f6938d861e80", "sighting--f3766f35-d627-4f1e-888e-2a8887e36a1e", "sighting--bddef3c1-6230-4a6e-9fa5-fb8829535102", "sighting--b1ec64b7-9970-49ed-a39b-7e29939dc9c2", "sighting--b8b9dd57-225b-4940-bccd-f558a38d4f9d", "sighting--2ffa1b4a-37fc-49d9-b8d5-2cff85d94be1", "sighting--27c6f36b-2959-4c47-bba4-85fbd41a97d6", "sighting--44b239c4-5b4b-4b0e-b797-49da92755674", "sighting--ca941895-b8c5-4a4d-b0a0-de38fed828f2", "sighting--cd0459b9-caaa-4646-b97b-4869114ffb69", "sighting--59a9ff57-684e-4de3-bf67-a7093b6cf091", "sighting--11f68260-a9e6-445e-a3ca-c71b2ae85bf7", "sighting--db3fa400-3a25-4a10-b62b-3a6a70f6c169", "sighting--f2ab86f7-f8eb-4f29-b1d9-f195fd9e0bce", "sighting--fc4f9aa1-2470-4247-bba4-d66fc02801c0", "sighting--ea74d78f-a929-42f9-9c94-8ebe00a2eea3", "sighting--8b2a04e5-37b3-46f0-a963-dba7001f44d6", "sighting--13873142-91bb-4dc3-8d2d-56eb61439f3b", "sighting--9f2f17e7-8619-4e07-8cd2-851e08b8d005", "sighting--d75902fe-c83f-4487-9138-05769bae04b1", "sighting--3790969b-8eff-4279-9318-4052fccdddb4", "sighting--a0d7729f-0aee-4e5a-b15d-193b4935379d", "sighting--e0edff5c-55cf-41d6-8872-722436b9f398", "sighting--24f1f889-489e-4319-a389-b95ca854ccf9", "sighting--52322468-491b-4415-a95e-2b9b630eedc2", "sighting--893bb887-d9e6-479c-a9dd-b8d32dd9aef8", "sighting--3abc9b1d-6e71-4ae7-aa0e-07364cfd8a27", "sighting--09e77276-9b9d-4569-8e1b-88e9cddbf9c1", "sighting--0e7fbf61-d21d-42cb-bdca-7d72ad767ddd", "sighting--f4c4d097-ee75-4767-a92e-1a47001e4266", "sighting--b4e001c6-c0a2-4591-a657-336ad9c016a0", "sighting--daacebc8-882e-4ca9-8403-d9e592b85bd1", "sighting--0fecd0e8-636c-4421-aa9a-efb69f060d03", "sighting--0c298bfb-ff99-4ab0-b33a-54d1f27c5868", "sighting--8edcfb8b-7c4a-4f78-b0a0-4f6f7edfb4fa", "sighting--143e2b35-70f5-48ed-9c6a-d51d0612b935", "sighting--d1068305-329a-473c-99d5-307c2ddf38d2", "sighting--b618f94d-cec2-4426-b1ce-c2e9cbc3d459", "sighting--b1fe6217-87de-4481-812d-92040e99fe96", "sighting--42c63d4d-b131-4736-a8f7-a53d337720f0", "sighting--7c6cfd51-5cc6-466f-8b90-5cfd22e6db60", "sighting--52aabef5-69c1-4e32-9eec-84770cb7ea26", "sighting--68d87c04-01a1-43ff-baec-f55b53800d75", "sighting--dd9555e6-64eb-4517-bf86-b1d5d42ca492", "sighting--897d2624-ddba-4f76-9e8a-5de966e0f410", "sighting--15a5adb9-aa47-45bd-8e6f-61cf956f99be", "sighting--67d8e998-eb0c-4697-9f2f-a5d9863f41df", "sighting--123254d7-195c-41f6-aac8-0ec30ab8dbc4", "sighting--c142f78f-2651-44f5-a083-9d4c709601a1", "sighting--c2ea6656-851e-4fb1-919e-9f0b8622d3f8", "sighting--60d83127-168d-4d75-af5a-0565cfb9930d", "sighting--16818e68-e83a-44fa-981e-5394adab208c", "sighting--5247cbd4-2b62-49a2-bb39-c9685457b0ee", "sighting--52778529-1372-4a04-8cc8-45edb44f9a27", "sighting--72228ebd-4628-4060-9aab-e6f329c9426a", "sighting--908fbdc5-af2c-458f-8771-66b6e8f87e92", "sighting--20c93e74-b057-4886-860e-7f021f366b78", "sighting--bea07ace-3598-4e83-8eb9-c3a2ba73651b", "sighting--b8676024-5814-4f58-b1d6-e230ce544d90", "sighting--9841d4ac-cde8-4372-951c-db8e4aa68d71", "sighting--532309f0-24d1-4baa-99f6-758db1ac4ec3", "sighting--9bbdb353-ce00-41c8-95c1-1dcdc64658f1", "sighting--5454e060-ce96-4fe7-8671-5e546697c6d2", "sighting--fdb7837f-b10c-4649-be64-bff49267742f", "sighting--ba610706-a05f-4fd1-87b4-35cb54a74e6e", "sighting--bea198a0-0094-411b-8ec5-5d85f6175c27", "sighting--6522fc4a-d26c-4f7a-b5b9-1d3a7e351b40", "sighting--8a28c5b3-0d2f-4680-ba68-6b243310984f", "sighting--14dbcea8-3c34-47fd-acbe-ab990c087e04", "sighting--e076cfef-64b6-4ce4-ac25-abc51a096ac8", "sighting--63075a27-ff20-4f8a-979d-8b441342b7f8", "sighting--8b5cb54d-2fc2-47a0-a989-18248e7a18a3", "sighting--ae8de9fa-e533-410d-89cd-04b32965601c", "sighting--4245ddfc-5d6c-4e44-8335-35f3fb41767b", "sighting--cbdb8045-02af-4bd4-8af5-5eb770a41bfd", "sighting--f1b235bd-cf8f-4c64-b020-31af5aa22a19", "sighting--04749edd-9b34-4f52-b47b-0ada53cc058f", "sighting--b594d44d-5f16-429c-b8ab-22df002f58bf", "sighting--36c54630-5d8d-4e1b-90d4-8c6de793d44d", "sighting--15b2c558-7185-4d11-8021-ca7b9c894862", "sighting--4c7ebf11-e743-4e52-861a-bf54ebdfa043", "sighting--019748d8-c8e2-4669-86ed-081ac546d86f", "sighting--c67d4219-7c0d-48e6-8361-cc018331d51a", "sighting--479cb41f-bc25-44e2-9568-b278ad362d74", "sighting--2d9c9af6-1b21-4a94-9de2-e52b57b0e0d7", "sighting--438e6314-e414-49df-91f7-e4883bd5d2c2", "sighting--3adc0015-89b1-4645-b50a-60f4a21545da", "sighting--40bf84fc-b1f4-4d74-8efb-cd45e681d73f", "sighting--761a30b0-56a6-4fc1-bc14-9d462661cdde", "sighting--e20453dd-1905-45a6-a390-9bb650d0f008", "sighting--564a0882-5e4e-4af0-915f-fe1973d90f02", "sighting--a49baf11-3e8e-47fb-a92d-705d50e2a4ba", "sighting--428852f6-fba3-459f-b768-75d7b7bfd10d", "sighting--2596dbc1-7dc7-408e-90a3-c594b3dc69ce", "sighting--7ff88838-5380-4684-985d-863ce99b2f0b", "sighting--6be866d1-56bc-469b-b8c4-ee43a9234e40", "sighting--9c405795-a366-4284-bcf2-3b5abd583f35", "sighting--79fc5ce9-77e4-4580-a06a-7d3341093aa2", "sighting--1a02fdf6-09e4-410a-8b8f-a53394743380", "sighting--ee187a7d-1e05-42c1-8345-d60e6694303c", "sighting--05dca429-8cc9-41b7-b7fc-ed107b440e0d", "sighting--915b008c-6fe9-46f7-beaa-f2fe08f41305", "sighting--9c28ce0d-0e0f-40b6-a98a-aa2d149dd903", "sighting--db88588b-7483-494f-a2fd-ab1886835135", "sighting--6ee69788-f251-496d-897e-d77394d71b24", "sighting--de463ddb-c388-408a-a0c8-c0a51998abf4", "sighting--506ab2df-f3e5-4e95-b6dd-6a445d5a31c6", "sighting--d52f95c3-b934-444c-8f92-ea226084c339", "sighting--61b25654-7633-496c-8280-d894308aacad", "sighting--0cfffc48-eb0b-4c00-8fbe-124234da2a42", "sighting--f1ad3119-76d6-4042-bb5b-546445d06c4b", "sighting--4d554ed3-c741-4218-8c82-1cf78fac0619", "sighting--d0ebba96-cd0c-4d25-a73c-a2a8c104ac52", "sighting--8588a53f-9119-4a92-b86f-043f43d51f51", "sighting--b96bae3a-50f5-4b97-b767-5e4069e872ee", "sighting--9960a872-04ca-4834-a12b-c30cc0b12a24", "sighting--a2e1b2c1-6b2a-4aae-87a0-1e1c91df7960", "sighting--6e8d5c7a-d68c-44a3-87c0-757a963a1db6", "sighting--b55f9aa1-3e52-41bb-bfd5-fdf7368dad95", "sighting--d9cd85ee-314a-4736-8453-67f8f86830f1", "sighting--24015453-585a-4401-a441-4d3221c1f141", "sighting--d4ea37d6-e1c2-4411-b4f7-e7d0442cb4ae", "sighting--fc7c05f7-2315-4b99-8fe5-4c1017d79ff3", "sighting--771ef01f-0b9e-4720-98e5-597f7ca5a3be", "sighting--b84487fa-8cf4-419e-80cd-0cb320bfd2e2", "sighting--4d851e50-4114-4135-9042-adfd36bd76ad", "sighting--cc851e06-c04b-4d15-abfb-7c5bf4e9a651", "sighting--ec691a49-db2a-47f6-aa0d-3d737863958f", "sighting--0c1d422e-4389-450d-ad34-6fff5eccf433", "sighting--0c81582e-ea7c-48fb-81ad-901f9039cdd2", "sighting--ca9759b4-3d41-4a7b-ae94-b102d5cb3b51", "sighting--d6e77696-42ec-4db5-bb78-7911e9805e60", "sighting--7b924af5-460b-491f-8953-facb3f11b459", "sighting--f42b0ee0-2483-4d0f-8907-53932cf7220d", "sighting--b6026162-fd61-41cb-a495-d97b44279f0d", "sighting--71517104-b1ac-4bf6-ad83-46189cd71ef3", "sighting--448987c6-6aa4-4b5e-9e01-7d1e79f2c050", "sighting--69ab3428-35f9-4ce3-b534-e77584c91c89", "sighting--0f26cdee-de15-4542-84ff-d41f20b5af97", "sighting--bd5e6276-47b6-41d0-90c5-44e4b6b376c4", "sighting--c4713f74-db86-4c91-91af-3826dde8a765", "sighting--dbf4c056-ebca-4683-97fc-cba1c16ebae8", "sighting--b76866fa-23bc-4fc9-a800-e3482a851cbf", "sighting--a737017c-5947-414a-9333-9e35a22b01f5", "sighting--23ee4e95-4137-42a9-8003-31a5bfc9cfa5", "sighting--e12ba648-2e8c-438a-962f-021ce3c35546", "sighting--39aede9b-f003-4203-bf23-d7d7bc8e54a8", "sighting--56377caf-3aba-4d64-bef7-d79d418e68b3", "sighting--ad1e30b7-8cf3-484d-a351-6895da19285b", "sighting--9b7a93e4-9f92-4717-87be-c1909aaba3b0", "sighting--955bddcd-ee40-4d61-bffc-d6778ea1c0aa", "sighting--7f2839ff-dd41-43d9-98d0-8b4698a2f57f", "sighting--b15779f3-6dfa-4ba3-b42b-a24839ba3be1", "sighting--2618c7b1-051b-41a6-85d6-af87f1910d41", "sighting--fe0bdba7-d89e-4511-a26a-1995c8eb9a04", "sighting--6c5255ad-a3ae-4ac1-85e4-89013a93fe80", "sighting--d087edf7-8192-4705-9836-97facaed429a", "sighting--3abab331-976c-4bc9-ae07-554119c449f3", "sighting--50e96616-f017-4263-8c68-84234f9e45ee", "sighting--be7a36f2-6399-49cf-9180-7e8c0eb1ea8d", "sighting--005a4d5d-dcee-4e0e-826e-f784bf23fa87", "sighting--b134034e-923f-47e6-a8ab-340d7eea8257", "sighting--95c6c352-7f20-4e61-9786-2c8833e31ce0", "sighting--555395af-a699-4098-9817-ca6e284e56b4", "sighting--6d66395c-bcb8-466a-b120-ba891b815bca", "sighting--0e35a541-1061-46b0-9cfc-02f7451056aa", "sighting--566620b1-d0fd-4794-b58b-923a09f77513", "sighting--6aa4dfdf-e6a4-456a-853a-35c2417f7e47", "sighting--9047798f-760d-4285-950d-62e0f3f80e91", "sighting--991f221d-13a4-432e-aa3d-21b22c664bce", "sighting--ed2d0038-1be7-414c-9040-70c11fb16974", "sighting--0867d9f0-5ac0-49ae-8d11-b147fe262eb9", "sighting--41cc36c5-27aa-4728-a3e7-0ee826426aad", "sighting--aa9ef99e-032b-4716-996c-a3b05dd63f8f", "sighting--f02123d5-393b-4bd7-abd5-d589d484c2e9", "sighting--4e5f6519-acdb-46b9-a3b2-8f99aa4ca311", "sighting--51c70510-b6c6-4b1a-98e7-579ccfd2e2b7", "sighting--8e71b67f-ff8c-49ba-ae69-2f831b474a89", "sighting--2c8f429a-09fa-43fa-a416-221c3b45b495", "sighting--2b128bb5-b848-4976-8fa6-c36f690107c8", "sighting--2cd67a42-44e4-43da-9f17-bd1271fdeca5", "sighting--cb25856c-cab9-4a04-9026-3f4ccba0e799", "sighting--c176160a-e409-4a88-9b13-2c1b0f7be30e", "sighting--1d13c1ff-c458-4383-8e38-5a4eac88bcb9", "sighting--19bda7f2-0033-4a8d-a090-56c7d8d9bfc6", "sighting--87f8a3c2-6b8c-40c1-a787-aaf3781669f0", "sighting--d920f0b9-8779-4276-b120-0a4fe08b1baa", "sighting--a3e37c0c-91e9-4afc-bf92-51806ad1874d", "sighting--74926d02-fc80-49bc-9dc4-7ebc970fd8d6", "sighting--4466717d-40a5-4fd8-ad3a-beea98582ed5", "sighting--10b53115-6000-40ef-86e6-413ef61b3edd", "sighting--f845fd56-5c6d-4188-954b-a1a81dd22f6c", "sighting--a5b5470a-c6f3-4ded-8154-083b11f740c0", "sighting--3a620887-7222-4522-8190-504b788d41cb", "sighting--8ef12583-c2e2-45d4-b332-a39608e8965f", "sighting--cf0288be-22c5-4183-974e-e1b23513693d", "sighting--2815c5f6-a46a-4106-9726-1f048437e304", "sighting--f62e76f3-bcf6-424a-b392-292e208fdc23", "sighting--e19db529-a2a0-43ca-951b-efccae1be680", "sighting--ef64691b-2f24-4b2a-baa5-836ddd3c805f", "sighting--931de024-7517-4230-ba7b-e6a12537328b", "sighting--b77bff17-2688-4a63-9cd4-4506c6b2d907", "sighting--e0a4503f-7f65-4158-949b-8330fd2c13e9", "sighting--4861550b-d063-458f-8399-2efca7105407", "sighting--a0e29712-5d1f-4e4d-9648-abaf46354a57", "sighting--d1fbcdac-b328-4fb7-8607-2ed1355af85b", "sighting--b1f76cfc-7940-4f59-a5de-2170d3a392a2", "sighting--f2cfd5e7-acf9-4acb-b8e3-fac434430d47", "sighting--9356d733-b5cb-4a48-9ab1-152065929fd2", "sighting--c7f8c2d0-8d3d-4549-908d-f97a0cd0406d", "sighting--9f96de0c-2e1b-496a-9ce3-9b5ae4f33e4c", "sighting--a7713c05-5897-4671-a0a6-da62e3d8e245", "sighting--1abc1f88-c1f5-4b12-9775-11f8996d88e1", "sighting--6497e67e-90ad-40ab-8c32-7a753ad7e822", "sighting--fb004144-699d-4a30-bc62-2325bd35d6e0", "sighting--f7171b75-c6ad-4442-8791-f9688a4d17be", "sighting--4f31eeda-b61c-4f12-8f14-d71d21854280", "sighting--e61329d6-da8a-4d75-ba4d-c229b19d2f77", "sighting--ee4ab9af-2203-48e8-87f2-d8512652be48", "sighting--e85621db-91e5-4c9e-9ac5-cccb3b9dec3a", "sighting--ef919e00-b0ab-4422-a781-691278d67c33", "sighting--4230a0eb-c50b-4bc8-81dc-fddb0fa13bd8", "sighting--58189d88-eb23-4cac-99a4-7bf7e6d47fb9", "sighting--0403bd69-0321-4e1f-90ed-68c495ba645d", "sighting--ee0540ba-7bd3-4cea-936a-aa958e40776b", "sighting--0905b33b-9dc4-4cc3-94ce-cff97cae022f", "sighting--6b0b80d2-dfca-41f7-8586-12c5e53c61bb", "sighting--e06e06a1-9c10-40cc-bcc1-0be0b91dd572", "sighting--5c967fb1-d280-4ef3-9c7f-f9da74350617", "sighting--34f1a1a3-06ab-418f-8600-735e0be9ff42", "sighting--605997b3-c963-4ff6-8493-35e9c6c2071e", "sighting--356f5e0b-749b-4d52-aa4d-ba4391f56ae6", "sighting--04e48de6-8483-4ef9-bba9-932792aed33e", "sighting--9f31cc7c-57b0-41d9-ab29-ba9be212c406", "sighting--e80b91ca-ef75-40bc-ad8c-03c58001e0ed", "sighting--55377daa-730f-410c-9972-f60c593a5b14", "sighting--99ecedce-39ad-4e59-95da-d6b026344211", "sighting--37fa0dff-32af-4246-930a-5cee5ed20616", "sighting--15860f5d-7dd3-4f58-9e7c-fa325d2a93de", "sighting--3164e6fe-76e3-4c91-94f1-07fa5770246d", "sighting--30c76477-fbae-4c7b-b887-eeedcc135d77", "sighting--0163b644-152f-49ba-91eb-2ca083ac0ca3", "sighting--7e509cae-556b-4504-8625-79700a987fab", "sighting--c69aba18-8912-46e1-a1aa-9decb10c5267", "sighting--4680f548-ad87-453b-8c91-47e5a3876f3e", "sighting--e0304404-a6e6-4327-a5c1-7c99f94845de", "sighting--9fea7157-2809-4795-9a8b-48a483633830", "sighting--747f26ba-1813-4f94-8bc0-ff31ba85ce19", "sighting--58a437ae-5329-4876-8174-ac3b85b4d556", "sighting--6bbe0589-313b-4bbb-b3c2-c1b41382eac1", "sighting--c49ee1e7-c13b-4cd8-a4b3-d5edfcb386c8", "sighting--d585946a-ee3c-4163-8c1b-a8519272a78f", "sighting--1cb6efc6-985b-4dbf-89ec-5b7ad1b0814d", "sighting--c6834769-92ab-4cde-81ba-f3e8ada69341", "sighting--d850ede2-1b25-4989-8653-7b53093fd97a", "sighting--35400584-3d57-409b-8252-581d6dc88f42", "sighting--5ad366cb-de40-43a9-af0f-54e5a84673b4", "sighting--cfdaec25-ec70-4a61-b870-eb6ac66c5d1c", "sighting--f2f42302-d605-479a-9e8b-6f892919c237", "sighting--1edf8547-1d16-4c23-815c-e8077343fcef", "sighting--b0d37fdc-4eee-4d45-a31b-a1a569e3b0f2", "sighting--f67d3e3a-9dce-4ce3-ab25-deaa824d566c", "sighting--cd40cfa5-465d-43c6-bbc7-1a29980291ea", "sighting--ebe6416c-50d2-4c2b-bf9f-0065b705d84f", "sighting--8ab317a7-7140-4096-b487-e8c2f2f0a388", "sighting--b96152ac-b721-4fdf-adcf-230e75c9c189", "sighting--7e9d2d42-f649-4e60-8e68-804b54032aae", "sighting--b09f6e81-1855-44de-9963-a793d2d718d6", "sighting--769e81ca-7556-45e9-b7ac-e55c1e6a32cc", "sighting--244fd01a-3c06-4cc2-916f-236a752b33c5", "sighting--1a995ddc-5e6d-4476-99fc-bdab81a7887f", "sighting--ac27fbb3-ef36-448e-b0dd-87d03b9f23af", "sighting--3ecb7fee-9016-4892-b244-574b52da1b67", "sighting--58ff8533-cdcf-4a55-a1ce-cfe97a589268", "sighting--11aa02c1-9570-4297-b843-6648af364017", "sighting--777358ed-1589-481e-8f9b-6f56acf82c00", "sighting--abaa202a-f62a-4049-9be6-1afe983130df", "sighting--f07f4a06-c45e-44e7-88f2-77914498765d", "sighting--097a4333-30ba-4875-ad33-33c8fca3d23e", "sighting--9d03adfe-069e-44fa-b000-0ef3b3faa032", "sighting--3380afbd-5a1d-4eb1-90ae-f2661b772ecc", "sighting--8f176eb7-728f-4b96-8bd8-7065049d15c9", "sighting--be184f56-c005-4ef4-a35f-6a3963bdefe7", "sighting--76a45e81-6382-4e74-bd2a-a228725c6786", "sighting--2a31b708-ac16-4d84-8848-71bebedb3835", "sighting--a556ea94-c9b0-48b6-bfec-938946a15ee7", "sighting--ee472e8a-048f-41eb-87ea-852b3f76d15b", "sighting--c218ea68-f585-4d1e-b3dd-89d82361e6e0", "sighting--34f398fb-5c33-4874-8973-1175c25049d7", "sighting--2ad09ea3-119e-40b9-a722-d55da1adece7", "sighting--25f9c2eb-0e0b-4da4-b07e-daf4693e4e55", "sighting--d3c60ab4-ce01-4420-8a1f-363a5185f3bc", "sighting--18ac45ae-a9fa-4ba2-b020-0ee35ef371ed", "sighting--76619ba2-8d7b-4b43-8efb-2d0db908a462", "sighting--b223f95b-288f-4895-9971-b0eb5fa9712c", "sighting--7057aa3b-8d45-4c3f-b36b-ce6118f25fbd", "sighting--5aa0627e-b162-487f-9045-25e3639b1ebb", "sighting--1409416b-9fb1-4bc7-9c5d-e1a38414091d", "sighting--c805cc0a-ed76-498e-a0b1-a87530f46d6d", "sighting--2964d47a-9972-453c-8d72-e47ae12e0a88", "sighting--4b45a2bd-cf0d-46b6-ad4d-1d75691c0da2", "sighting--96c49ee6-739a-439c-8539-83cd07675c79", "sighting--5a7e6612-580d-461a-bcfd-8bbcc0ee7d62", "sighting--e87170fe-67e1-45d4-98f4-3fee96cbb44e", "sighting--01c37636-205d-45b2-b9a5-fe2d7c27bf43", "sighting--341b0d3a-7447-403e-8b69-ca399336b8db", "sighting--a736b791-f4e2-4610-90bf-dc19a364f239", "sighting--3d3ee46e-d051-4c72-9afa-4807cf82fd08", "sighting--08d67e4c-2760-41ed-b1a8-53094ff593be", "sighting--29b776bc-84e3-408a-9e80-480b746c5b52", "sighting--e6b4f430-5f41-43aa-8a4d-32236b3d2b89", "sighting--feaad389-7340-4726-827a-f49fa818b4b4", "sighting--407d2c6c-4138-4521-bab5-d4b578e8df95", "sighting--a31c9ac3-76a6-47d5-a2b9-611c445ec81c", "sighting--710b84e4-83ac-400f-b457-15b9a027adbe", "sighting--23855659-3ebd-4a8c-bdbe-5cccacd731f6", "sighting--9de54331-0bbe-4e43-be05-953ccf51ac64", "sighting--9c4b1778-1f57-4e56-a7fd-0d044a697e84", "sighting--0723a8a3-97b7-43cf-9c8d-6b5be884f501", "sighting--61d6d84c-dfbc-4b4a-8efb-3d15c39b2a06", "sighting--09ec9501-3b77-4d26-9d5e-1ef3fe04b762", "sighting--c332ae05-34ed-4c0a-ac76-91b36bf684f6", "sighting--08a11088-04e1-4cec-95c9-c497d4acfed5", "sighting--e8c19f71-cac6-491c-bc41-96cfa37a6388", "sighting--3cf4164c-ac20-4555-b762-45bbedfeceed", "sighting--2406085f-00f1-4011-9801-643faa74f931", "sighting--5bdb1e7b-abd9-4f72-b366-2a151688c652", "sighting--7b204390-8054-4278-b469-700ad9f9d767", "sighting--fc412d40-f82d-4bc8-9b58-9847fb23d5ae", "sighting--6b83d705-6efd-424a-9f8a-52c9087b0c37", "sighting--c64bb319-478d-4973-afa6-2b3d772cbaf7", "sighting--5285b519-410c-4697-aa9e-2900c0c08bdb", "sighting--3c67ce06-eaa8-41e5-aba4-70f673fae1a3", "sighting--60b13440-4ee6-4760-971a-acbbbfddb3c1", "sighting--a268a467-23df-447a-8448-7a0b1309a4e4", "sighting--a5fb1cab-79be-4bca-83a5-4b3a48c66718", "sighting--41b28861-7a29-4b8c-9f65-d422d34410ce", "sighting--8109928f-9289-48e1-a46d-9f7735776ee5", "sighting--fb6bb188-f63f-4ade-9d0d-84719a0bb0e1", "sighting--00b3aa0c-4446-405f-9032-7d6605789e20", "sighting--6fa451c2-a271-477c-96cc-0ab430dc9127", "sighting--0650726f-cef9-40ae-957c-244ca0ddff0f", "sighting--db16d8d0-3f46-4b83-a170-ee43d7856fe2", "sighting--b16a4a07-7a15-4c5a-b0cb-a3d8e8d7c521", "sighting--eb86818f-f96e-435a-9b3f-a335cadb03fe", "sighting--905a096d-9e18-436e-8a02-0de45b839087", "sighting--c182a681-3e50-46b9-82ba-06021dca31e8", "sighting--b8c50aa7-4204-4027-836b-991aecb01e2b", "sighting--ba043450-b21c-446f-861e-af4fec3a51ef", "sighting--ca33d950-8ca4-4e6d-8665-a794e8ea71d2", "sighting--b4e2f375-c150-48d9-8477-c3d7f7e0a3d9", "sighting--44044076-a9d4-45c2-98b9-1e79252b3509", "sighting--e6266db6-7124-4f86-a6a8-b883a2a0f623", "sighting--58f556a8-7058-444e-83ac-7aac2786020d", "sighting--d33a4f49-1f5e-47df-9550-0f159f8357d4", "sighting--fd79312e-346e-456b-870a-66075b850879", "sighting--00168753-249c-4814-99bd-2860ee860723", "sighting--854d1a38-04d6-41d3-8edd-a7e5a01a67a0", "sighting--083e29f2-c900-4f3a-8512-5776c79aa94b", "sighting--af046492-168a-4da9-8007-b15fa13cbd48", "sighting--1ffff6b0-9ced-425f-9799-59b592f99742", "sighting--ee0ad8a5-b734-4b83-9a62-b775151e4254", "sighting--cfcadfc4-9208-49d4-8d67-5acda4a9133a", "sighting--15af8f8b-6f8d-48b8-858a-2a7b4f9aea98", "sighting--a99f66be-8c53-46ab-906d-0cc84bc8f3aa", "sighting--560efb48-71af-470d-9c2a-431afaa5c13e", "sighting--c5e50abb-94ce-4101-b62c-57db35f577a7", "sighting--7d11d310-b58a-4ec2-ba83-97ff90aeff5b", "sighting--2029c012-5155-4e3a-9ee4-4005a9c8722b", "sighting--a5ef3fd0-2bfb-4465-8f85-06f359108d26", "sighting--5968cabd-89bf-4fd6-8c01-fea9380c9385", "sighting--88a0b242-32b6-497f-b87a-a1c071f9f1f8", "sighting--f7fb40b6-9bb6-4b2a-97f3-9afc35d30038", "sighting--76149308-c467-482a-9c4a-05a0c84ce495", "sighting--963b956b-aff1-49e1-a6ce-206dc298f89c", "sighting--f96da26c-5842-4d38-898e-5670d6cf44ba", "sighting--d6ec5216-c029-40c8-95d7-2b67ba2d6ed0", "sighting--8501b585-8a69-43ee-93ae-4107bdab10da", "sighting--8b3eee4e-9272-4f38-ba68-8274d62989b7", "sighting--8453e8eb-943c-4103-ae04-799d74b7a584", "sighting--15df2057-f0b0-4726-83b9-2e691975e220", "sighting--c00aacff-e8dd-43ac-ad3c-10d86426704c", "sighting--52cc7c3c-e236-42de-833b-c751a894b8d7", "sighting--14d17b2f-c202-4108-a81b-4421e56362bd", "sighting--14fb2a4b-1513-40d0-8304-2e34c0656956", "sighting--a5152171-d722-49e0-ac47-184e4cf345a3", "sighting--582c1880-fe51-40c5-b06e-944f52c56f8d", "sighting--4c70c514-4676-4f98-9953-4977e5aa9171", "sighting--c23562c5-432d-4807-a67d-a24433fc2bc0", "sighting--2f01fb36-a466-43fe-964d-07e90c327901", "sighting--d4461260-fe56-4493-bc46-7ab6fb498cd2", "sighting--3d2abe87-8b24-41c9-8182-49c5b9440bc6", "sighting--a1c6875a-6471-4914-aa8f-5c777e1b888c", "sighting--6b0262b6-f800-4db5-b6bd-7e0dfdcc3097", "sighting--2c6405f2-bcce-47ae-9329-e453edc1e9f8", "sighting--440f67a4-d699-4f7d-a7f0-3ed75ee760b1", "sighting--fc178d14-58e3-4f04-b978-cc9130b20899", "sighting--dacf13bd-5020-4d64-a9d0-fd5157d094c7", "sighting--0002c787-cd64-45cd-9114-0ddb2fc4b5f0", "sighting--8ad89843-b7bd-42cf-962e-a77588411bdc", "sighting--6e592492-0d2e-4c5b-99ed-74d22808db62", "sighting--e985672a-06b8-4f0c-a270-ab98a85968dd", "sighting--a48334b6-8d81-4c08-b79c-c882b813a153", "sighting--14f527eb-6b63-4123-a820-af354cb56718", "sighting--6f819226-9100-4720-9e32-577b30ba4d53", "sighting--0f8d51a2-5252-48d4-806c-76c00b89594b", "sighting--ec1b6080-8989-4ec8-b0f3-57b45ad11059", "sighting--43c5dd0c-b08a-43a3-aa64-a4db2c556dfd", "sighting--0d1ca003-34e4-4069-82f3-a076647b74c5", "sighting--8cfed72b-c59b-4e08-8058-2ceebbccc9b3", "sighting--86ead815-910a-4c2e-824b-e9886304c866", "sighting--58d43fb1-fc48-463a-9b9b-2a69ef5051c9", "sighting--c8b2e6c4-73a1-45fe-99c3-eaaa0fb797cc", "sighting--879d3b0b-e324-4886-9879-857b5adc5353", "sighting--1c2176e3-ec2a-4897-baba-80733d4dce8a", "sighting--7510b9fa-d51f-470e-89c7-7c62fb321264", "sighting--dbbef1e2-db9a-4f0d-a5e8-5ef514340e14", "sighting--f215a248-b570-4b90-98e5-9d23d3c36898", "sighting--e58ff723-1b83-44f1-82e6-8748d89a8a8e", "sighting--d6e679c9-3134-4422-86e0-f3867008de8a", "sighting--1e826d3f-cf4c-464a-9d16-990e58f29aca", "sighting--29248493-480c-4cba-9813-929816ba9029", "sighting--dfad3d7b-2abd-4e2c-9558-e1fb9e25596e", "sighting--741344fd-6d51-4b83-aa35-fab0875d390f", "sighting--e77dca60-9ba7-46c7-b440-e418d132cd2c", "sighting--33494b12-7838-477c-a761-862788acea87", "sighting--e07ba0fc-ef5d-41e4-b1f6-abaff0dc6dcb", "sighting--8209011c-6ced-40be-8a00-c50387d6533e", "sighting--6f37e395-c841-45b8-82b0-ee6614efa0a5", "sighting--ed118dd3-6d81-4c3f-a634-a9622eff26ee", "sighting--4d51f197-e22a-4db1-9e75-cadfd1447921", "sighting--4d3b35a2-bb55-4866-8991-8ec55275c2d6", "sighting--d35c4aa8-5531-436b-a57d-c85bc9405abb", "sighting--a48f4749-b310-4f1a-9e5f-432dddb7d4ce", "sighting--29aa998e-7644-438b-81fc-0733fbd32959", "sighting--0211fb2e-f1d1-403e-9a58-2ae085f675a2", "sighting--95224b26-0eba-4653-8cc1-8043cc9503f1", "sighting--9408e453-7d2f-46b0-8602-622a2b5d0fbf", "sighting--b0722ee1-e19f-4eda-bc52-b7f74b2f37a2", "sighting--52015e1f-3c85-4cf3-9955-f9a7308f544a", "sighting--8366e2a8-e4ef-4984-9b9e-8c569b0067e4", "sighting--424c5cc7-dec2-46ae-880e-1a5eca28623e", "sighting--ef1e4d6c-37fb-4ebe-be5e-0f65e2d04c03", "sighting--2e3fc17f-5fb9-4496-aa67-4657b7ceb045", "sighting--e55c1b40-35a3-4008-a027-ca1195a6fa49", "sighting--62ca586e-127c-451c-9b4a-ae858d90ecb7", "sighting--d183d7c5-5665-4300-9e7c-e08989fb2a9a", "sighting--b16dd522-2afc-41ec-b962-ef97630ebf06", "sighting--e88863de-4025-458d-b413-3ee3a9dac7f7", "sighting--e154365e-4515-4d84-9181-b96b44f98139", "sighting--4f91a598-de07-4470-935c-317d1a055598", "sighting--0de43fc4-c2d8-4a45-939e-31f734401ff4", "sighting--3693f2c4-110b-4675-ac03-c7636edaf825", "sighting--0d9423fd-c586-4121-9487-346c6ce17b2e", "sighting--f7a4eb58-1e41-48ae-8efa-8c7f133ba0ef", "sighting--542f39bc-d66b-4a56-9ce3-ab53357317e8", "sighting--51b7a5f5-e49b-4a43-a5e2-5b3273e0533e", "sighting--6af78670-5645-43a6-bcde-e9367bc2c09b", "sighting--a44b9bb6-eae8-4b41-9677-d2c91628b14d", "sighting--bcac2d65-7029-49ea-b970-6e18aef5d316", "sighting--6f66c912-1332-4aab-81da-308e09271edd", "sighting--8c59e4db-a1fc-4feb-8049-916ef8bdf8cc", "sighting--ef5e9471-49ec-45a5-8afa-d3180f53e1d2", "sighting--68091880-596f-487b-a241-14764af25bf7", "sighting--717cf2a9-4d1d-4e50-bbdc-a9e3ce93d95d", "sighting--ea9853d8-4f95-47e3-b797-105bd5bffa6b", "sighting--54130e67-8bfe-40f6-9029-a551e9820b40", "sighting--7e189f41-5b40-48a9-b5ad-2e003771ef52", "sighting--aed1dbe5-7e49-413d-8cdd-84c9577c6179", "sighting--8a29c374-b867-4a47-a14f-507da02a38f9", "sighting--855ed2c1-3d92-4ce7-b7a3-7cf7a1ec4c4d", "sighting--7c8431ce-13b4-4d5c-87c5-d04b749839c0", "sighting--009bc73e-67ae-40cf-8481-f14e21a77571", "sighting--80201147-903e-4ede-afba-960c45ed9589", "sighting--68537d73-829c-4e8e-98d8-60ffc587ac28", "sighting--be75e4b6-3c81-455f-8937-3158936d2c6e", "sighting--2835a0aa-a948-408b-b8bb-da8a07289b90", "sighting--fdf6f8be-e79c-4411-8883-d4d47c6e760c", "sighting--9c5a524f-43dc-417b-891a-2931cef2ddea", "sighting--e1525873-9410-4677-bc5a-bf5820779ef8", "sighting--2834687b-0761-4b43-ba1f-9501e3053af9", "sighting--0b3cd3f3-ca60-4a54-91c7-e1d2a1ec0f38", "sighting--ff983082-e6fb-4a58-9412-fc31e5f4ba4b", "sighting--ca0ceff8-a672-4412-adb9-81ac01ad5de1", "sighting--a27b3e2d-6d77-4462-a6b9-57c172bdbd66", "sighting--28818a40-34ff-408e-a519-d70991785acf", "sighting--c6737b2e-915b-47d9-aeae-fefedde5bf0d", "sighting--f98cc19d-f199-4c7b-8319-1bc82f782c73", "sighting--39582b2d-f3b2-4a14-bc5c-bfebcfb78523", "sighting--ca978e87-9b14-4448-984f-c1aba2951a28", "sighting--d84bc428-1a1f-4b08-95d4-608600bd01f9", "sighting--a6c888cf-d56d-4428-929b-7089c180f2de", "sighting--4851c0ed-8159-46ad-8c8e-e706357c6322", "sighting--7944bfcc-613c-450c-9d32-9f9a68ea16d7", "sighting--361ca0d1-9f81-4be2-8a54-58a936a99ae5", "sighting--ea42064f-7889-4371-924e-2ecc828dad40", "sighting--8d77d94e-412b-4bab-8520-d48a3ba457b9", "sighting--81bcdac9-df1b-489c-8cd7-e5fed283604a", "sighting--f795ad6a-4567-499b-b18e-5c4ff6dff953", "sighting--f2f30479-b8da-4c16-9a93-cd6b4b4e3853", "sighting--27429826-eb92-415a-820e-42812174cad7", "sighting--62df57da-360c-4701-87a0-5e4d5b5ef14b", "sighting--d24ffec9-ea30-4814-8cd9-fc8b40b3da50", "sighting--d73827b7-2536-4b59-80a3-607bf041b8a1", "sighting--b3b3bbb8-1b1e-43db-b44a-cb2288a1a97b", "sighting--a768be8d-170a-49f4-8ce7-5c9b38b350f2", "sighting--189ee431-543e-4749-8210-122aff4bc576", "sighting--f2982ace-9b23-448f-8a63-3c65f31cb7b2", "sighting--6d7e3690-0c34-4bdc-b8e7-3a427de62dcf", "sighting--28446fc0-cd16-4adc-8ae6-1536b818bbdb", "sighting--5cb7f99e-416c-427f-b2ff-7a046d9488d7", "sighting--4e6043cb-b283-4fd7-9ed0-4ead40935f9e", "sighting--43585b3b-a8ea-43ea-98f8-845697081eb0", "sighting--a5679aed-aefe-4c00-96c1-eb9144e40f2d", "sighting--fecf9b8e-6fd0-4e9e-9966-1970521b02c4", "sighting--e4701e17-3a0c-46e7-9efc-18e602d436fd", "sighting--3e959f36-137e-4b93-bfb0-0f8b4901d24d", "sighting--b1bd160d-48d6-4588-b4bb-f6ea3483a287", "sighting--73a57870-39f6-49b6-9624-01a2960f5172", "sighting--d3f456b8-a82e-4173-b2d7-1d94d3a432c0", "sighting--cf4554e4-e131-403a-891e-f5b51c366172", "sighting--62c151b7-67a8-4197-b611-2461533f5610", "sighting--59eeacb6-0a78-43a9-9761-fc6226a622d8", "sighting--884ead1c-6350-4b12-ad57-4df7795db3b7", "sighting--af98cab3-dd70-4ce9-ae2b-00525f2e988b", "sighting--48045239-94df-42f6-8a52-15bb2837473b", "sighting--4147f14d-f062-4640-b2fb-f1a900359aea", "sighting--a5e02bbd-4140-4f24-a081-1bec4ff36338", "sighting--b8e44531-9cef-4482-b862-843e749206c7", "sighting--808fa2f4-09e2-40b3-88b9-7e8ca2cf7ab1", "sighting--6325e12a-660e-465e-a021-5e8439ae187c", "sighting--2595b664-2eb1-4472-a4cb-6b44462bdfbf", "sighting--54128162-addf-429d-a394-3c0385f09b64", "sighting--b580ed99-d976-4d10-9eb3-2d4e253136c7", "sighting--4c5d0f08-7b5d-410a-8621-63d8a26ff94f", "sighting--e75259ac-8920-488e-b1c7-9a03afd6d040", "sighting--ad6a2e5b-8912-44c5-87c2-1e8fda96672d", "sighting--b5bfc948-a3b2-432d-ae0c-7f282f8270d6", "sighting--dea61503-6289-48ee-94da-aae7eda1ff15", "sighting--46dd17c7-9d69-4250-8f15-a21efc71c687", "sighting--144f836f-0848-4cd3-8277-fea358de2c20", "sighting--8ab80b48-86a6-4240-99f2-88f64112958f", "sighting--63f6c4a8-6b0a-40c1-9860-28fbfd0ae5ad", "sighting--2b8728a2-5bfc-4e45-827c-1e2f756d380a", "sighting--6d971f57-19f4-4935-86b7-f8985f488adc", "sighting--80c32a47-afaa-44c1-a228-5c5a4873e071", "sighting--e627df3f-d98c-44ae-bc76-a73a8f2c31e0", "sighting--c061439a-2e6c-4048-9a2d-23104a76a0d0", "sighting--2d9849a7-9a7e-44a3-a9ab-823e3c9bbb24", "sighting--911de6e4-7bb2-4184-ae90-48f361224654", "sighting--9e9adb25-0f97-4c59-aefd-262e27950752", "sighting--6a907738-e25a-4778-8f99-fe950e3421ef", "sighting--6f50c8ca-27fa-4152-94e2-de3b77eefbde", "sighting--0cc39268-4d3e-474d-9e62-91efd652ca29", "sighting--9b93e6aa-39df-47a3-b7ef-a88f45b813f0", "sighting--536e14ba-bd9a-4ef4-add0-15907f42c0f9", "sighting--0846b8a2-9c59-4eb0-b5ca-73b6ba867e23", "sighting--0b3095ca-232a-4aa5-b05a-e4f99075dfa8", "sighting--09189694-eebc-45ec-8541-753b5276e362", "sighting--74cee197-0d03-453a-a09d-aa90f7bb9b8f", "sighting--018567e2-0427-48e6-b5fe-61e07768f7cc", "sighting--b19d3cea-2e06-4927-a644-952ef41c8263", "sighting--2ef79b81-ffca-407b-abfa-2c46cc51155f", "sighting--ed950036-f408-46bb-99c6-142a7b1a1942", "sighting--9f033de5-44e4-478b-ab7d-171a21a2c8ec", "sighting--c7257823-aa8b-4cdd-8b68-19ac60e9991e", "sighting--6db57a4b-f0dd-429a-827b-016276bebd81", "sighting--2903af72-f95d-4d54-8c4a-f76978696995", "sighting--80a46142-f331-4edd-9120-c2824afbf4df", "sighting--b75af26b-6559-4a33-8d7b-0e5a12458261", "sighting--e16ee167-6679-4cd6-a18b-abcb7cd9ddcb", "sighting--2d7a48bf-b033-4e0f-bf8f-daae2d7330bc", "sighting--aca5f8c0-71f5-4f62-8d69-fdf324138733", "sighting--b0cbc49b-c73f-430d-a47a-afe6d83bae1d", "sighting--389a87c1-b018-4b7f-85dd-d39b4e23cc6b", "sighting--a8172b6b-44f0-4c87-be1f-843e6d3ae5ee", "sighting--bc036a11-99ae-46f4-97bd-e42dc6a7b256", "sighting--2021c6a1-e3eb-4ec5-97d4-fa0ce49aee5e", "sighting--6de7ccec-4541-4193-b95c-014e363d1179", "sighting--c2319a10-cbc1-4bb1-b269-8053fcaa09b5", "sighting--a54bc7dc-4650-49d2-aad6-7e8f30952eb2", "sighting--13a3e73d-e67c-455d-8326-507c962344f8", "sighting--ff3e39cc-fd20-4a65-9606-98a1a3b273a4", "sighting--a1c6d732-01e1-4a4f-bcb5-2ec23c5a9390", "sighting--8633d5d0-6e4f-4285-a0a5-85b721587478", "sighting--03b627bc-a3bb-4a21-abf0-18ff10fce50d", "sighting--91a55f5d-310f-472b-9f35-b68236ea3ea1", "sighting--8755170d-b054-44ee-b0e3-70fd01aa7397", "sighting--f641f54d-d724-4f57-8aed-2932ecb3be05", "sighting--8545e144-dba2-4106-a229-0cc7a5afc84b", "sighting--a8af7151-b7c8-47c8-bd58-16de1ed6afc2", "sighting--3fa10459-2dc7-4932-80ad-90b2e5020579", "sighting--3d1166be-1ad8-4582-b5f7-dcdb2a57348f", "sighting--bc1050be-eba5-46de-839e-5067cb3a9054", "sighting--4872aa86-e9e5-4dd0-b0bf-bcce2f2f82ed", "sighting--b3f77b3a-b47e-4e8c-b70a-93c1042be438", "sighting--3bc91dbb-8338-47d7-9109-7457c21b4922", "sighting--889e201d-83b1-42bd-8a90-bcdefd460d44", "sighting--5b29f59a-434e-4421-9db4-862d1941ecc8", "sighting--516cd461-fcdc-4429-af16-b2887d2396af", "sighting--22b55ebe-b11b-4cf6-89bc-3c2c5b348225", "sighting--1c933fa5-d627-436c-84d1-21a933db1dd3", "sighting--0943c89f-8af7-4fbe-b81b-a75fcdeaae98", "sighting--a95dad4d-c4e4-454e-a40b-bff67b5baeae", "sighting--203fe911-9ec0-43fd-a6c4-a985f79cddbb", "sighting--cc586378-3ba0-40b9-b345-68ad19b10f5d", "sighting--c68ef343-98c6-47b2-a68d-64f5b0dcbba1", "sighting--a9180b5e-6263-4217-b3ed-6985359a3737", "sighting--c1c6fb4e-fd78-436a-9638-a1b8f2b4820b", "sighting--d08ba54c-5f3e-4977-a4c7-716a96b03758", "sighting--4f75540f-29f3-4a7e-8c6b-3c090f15029f", "sighting--07977049-4055-4ef5-8e77-4689f2133df6", "sighting--9cc34609-1ae8-49fd-903e-63bf57e1519f", "sighting--13eba52a-120c-4b71-b718-f673bdacf850", "sighting--0fac8189-ce26-4b89-bfa4-bd6a4154bf4c", "sighting--05a0c573-9aeb-4e87-bc1e-6091d3fb611a", "sighting--4b091fd1-7242-4ce0-9062-dcba894a68ed", "sighting--e841819b-ea48-42dd-8873-b8b5557fe9b3", "sighting--8e512ded-2e1a-4a0b-9f82-096d66f361ac", "sighting--6c7f4993-d1e2-4b05-b2f0-1d56402986cd", "sighting--81aec2a6-8567-485f-a0c9-4fe9a0d82bfe", "sighting--36f5c439-e355-4334-8a86-bed64bbc8636", "sighting--7a2a1da8-08e9-4953-a587-b75e0d245b7a", "sighting--3de35741-519d-43d4-ac02-f7f13c749c74", "sighting--bdad09ed-c3e3-4001-9444-86dd6cad7cf7", "sighting--54a4f441-e962-4df3-8e49-c67bf6feedf4", "sighting--d23a9c98-19d2-4f34-a1d1-f1c2893b7b9b", "sighting--75a2ee8e-5b34-4828-8cbc-c5f4f42f0c26", "sighting--f1bf15a2-2437-44f0-a648-95679a42d1e9", "sighting--5cc7179a-f251-432b-8cc3-40aa69d6ae12", "sighting--66e77539-06cc-4eac-afe9-23097a7822b3", "sighting--3441c048-fc8d-4f08-88e1-8dd87555edb9", "sighting--2546e519-b81a-4555-847b-4a744da4fb1b", "sighting--5e25f63a-fde8-449a-9a4a-86e19ca62160", "sighting--bcb7a84f-0325-4231-8a38-6ce26d2c4851", "sighting--c67642e0-e9d1-4368-8dd4-9d547d2b34a7", "sighting--092b3d7e-b905-46da-8e64-81909e8640a9", "sighting--0dac8c26-24c5-4d9d-b4a8-34cb46637901", "sighting--5c4ff1df-23a2-4062-ab2c-891c2dea18a5", "sighting--60765419-4bce-4bab-9e2c-ea1e7694ae04", "sighting--019e6fd4-75ab-4543-b48f-4016ec28ffa3", "sighting--f261f047-9389-4435-be80-d2a8778539d2", "sighting--88b4c24b-31ec-47bf-8da3-24660c823eb1", "sighting--917ae456-e0f3-462a-b3f9-5cf0eba566c9", "sighting--301587e3-1b8d-4aab-b1df-c3367b5f60b0", "sighting--2d0ab230-fec0-4255-8f58-942f1904d22a", "sighting--cb71826a-97fb-4a5e-91d6-8cc009235595", "sighting--aebf76f5-9ba6-4e60-bcd7-8d5ad1731cbc", "sighting--f3d45b75-7098-440f-a200-9e7ce7a71102", "sighting--9cf3fc23-4413-494d-ab7a-e343ee4ec9d9", "sighting--24c9d5f1-9fbb-4643-8f11-72387e1d3bd8", "sighting--1dce820c-c188-4dfa-93c3-6ce00c0e2c3f", "sighting--4d11b6fd-eeaf-40a6-87a5-4e8b6b6c0460", "sighting--0131b9f5-6a8f-47e6-84d7-7b30e08a1302", "sighting--76b37dbf-cda8-42d6-a783-66d813d09f56", "sighting--d470264a-aec5-4096-888e-c9e113135e11", "sighting--0a074675-340b-4857-8b1b-59f20f8ca5e7", "sighting--193f16fb-5a52-4b6f-bbc1-b9d09acc9a63", "sighting--c7832837-dce0-4af6-8597-2c36c89a3277", "sighting--5d0d1273-346a-46c1-b409-55faa7eaef8f", "sighting--9320fbc6-59cc-45d7-bca8-28a2edfc57bb", "sighting--465d246c-2d30-4640-a861-852e5b912fd7", "sighting--d7ea9bd5-9093-4237-84cf-667e7df441d6", "sighting--741d6002-6a70-4a54-9225-4808b2d032a7", "sighting--653d416d-b9c1-4ec2-b146-bd0b92325e06", "sighting--db06c23f-2a88-49b0-8bf6-7f4e85659593", "sighting--4885d785-59df-41e5-bfed-c32324efb737", "sighting--c8d2cc43-8574-4d35-be35-2e9f0490edf7", "sighting--95c8b3ea-84fd-4139-bdc5-38caaac5adda", "sighting--e203c1d3-2f41-4c91-b3c4-17129c132ac8", "sighting--ac135f84-8160-47b0-b803-569ca3522619", "sighting--bc1ca547-c5a1-40f7-a9dc-1343b069faf7", "sighting--71cbeb6e-0366-4a52-a261-082bdb5fe663", "sighting--6ec97931-2904-411e-93cd-5922208c9deb", "sighting--39ef21c5-b429-4c70-85ce-b5b28c08e47e", "sighting--3b35b080-89a2-48ec-8bac-f0ce85e67315", "sighting--42117d76-0873-4421-9ab6-a0950efc9844", "sighting--787c1837-5e0c-46fb-9a33-f52db735b73e", "sighting--f86956e2-5871-49c0-ba39-2d048a842878", "sighting--706ef96f-5849-4775-bfee-11804bb701c5", "sighting--17439f59-52ba-4fde-8dc5-0f2bdb209b31", "sighting--414bcdc1-2225-43d5-baf4-2bcc1429689a", "sighting--93157937-ead0-4413-9597-85f63434c7f3", "sighting--b5819946-9eb6-4433-949d-995417fb8972", "sighting--341471ba-f084-4671-8c32-d30cfd857523", "sighting--10a5448f-2a2e-408b-a04c-14f30c351e38", "sighting--bd0f0b91-f63d-45f8-997f-7ac5ae858229", "sighting--de992b76-3db3-48d9-b37f-b8425ee03e24", "sighting--feb5ed5d-4df9-46b4-a980-a3a1dd48eeb5", "sighting--328785a8-f8ff-47a3-9b06-9ec87ff315d5", "sighting--88b90933-4ae0-46be-b5be-5f7e12ec3f34", "sighting--9ef3e8df-7981-4996-a578-ff61284962de", "sighting--1d2f005d-7f85-4b0d-aa4a-9f27620824c1", "sighting--df982395-c907-49f7-af7f-a0e99abc56ae", "sighting--820cc2c7-ad6a-4ce6-8444-8ee47829c5b8", "sighting--7fae9356-50f8-476c-9cbe-abe62cf1dbbb", "sighting--0c5d9eb1-d0ff-4551-8db7-7ba1f6f89ec8", "sighting--5fb10a31-0de2-4f4e-9b8b-6247ba6ef716", "sighting--38fbb659-cc8b-479f-afb6-08011f942909", "sighting--556f6b3e-9be8-4475-aa84-f21eae88e7dc", "sighting--952ba29f-628a-4618-84e1-3bdd32cab48f", "sighting--c0af4f53-f8a1-4328-82bf-7f75b82d0ec8", "sighting--2d1ef8d2-7681-42cb-b1b4-9ef5f4a1e3cb", "sighting--74186d70-ac1f-4831-950e-65416b3b1628", "sighting--cc088355-c85d-4b6a-bd4f-8bd16bf8d4ba", "sighting--3e197208-6ab3-432e-a578-fe8394673f12", "sighting--cba2d7dc-31e6-4da5-9ff7-8ae130be0ad7", "sighting--f1ea6480-5377-4b1e-adda-c4a5f431b7da", "sighting--2f173afe-4810-4c95-8303-118b67d5a264", "sighting--c1fb66a6-3362-4181-83ec-5419cf0a1ffd", "sighting--032bf9b7-dcee-4c6c-9233-ab548e81d64c", "sighting--f0eded21-02ad-41f7-9b3c-f03100e2a993", "sighting--ba401d66-46b4-408c-ab24-b9d89aa49d8c", "sighting--c06c5c7f-59a3-4c8f-bf93-bac9df5904a8", "sighting--9df92224-4da0-4fbc-832e-7a60cb58f75d", "sighting--829fed59-c857-4619-b5e0-dd27cf2b8335", "sighting--48c61975-2c27-44cf-a67e-3961cbbad858", "sighting--14b49220-a17a-4593-9ed2-15a17802957e", "sighting--b84e1b1b-fdce-41f5-bce2-5fa52809c006", "sighting--d592f218-b955-436e-b9dc-b046c6294e57", "sighting--83d01df0-9b74-4f48-a941-84a056b8e5f7", "sighting--b8f2b824-3401-4ba5-bf94-e8938af14bd3", "sighting--b345433c-1208-4af5-84a3-f862cfdb212c", "sighting--064440fa-aa20-421a-90d9-a8275bb54133", "sighting--34426039-0109-4ae1-b76f-7fdf14bf74b8", "sighting--bebf5602-4a0a-4ede-bc52-fb4384f8e867", "sighting--fa2201d8-78ad-4afd-8fb7-06a705fdae4f", "sighting--48daaf34-dbb8-4c8a-9eb2-e689482123e6", "sighting--f3f6a5b7-27c6-496b-8a2d-fde512773000", "sighting--4a393183-0c6c-4f88-80fd-da7f76593990", "sighting--4ef0f972-ebec-486d-b9fa-c13b3718479f", "sighting--b44f2e01-d35a-415e-a50e-5cc22549f9fc", "sighting--4e551741-d082-41c4-8c08-5cde15f0f9fe", "sighting--5de01f10-e686-44ce-bcbc-0902afea7f1f", "sighting--0e3b464f-475b-402e-9061-e2ad1bf73f2d", "sighting--7d8f837f-835d-4a1d-b02c-d13472bb8059", "sighting--1f926529-28e4-4193-b51d-89ea2871f228", "sighting--0f54c9ed-3534-4c03-96c4-0673d987fc95", "sighting--5f02085a-f011-45d6-870b-b1df8ab18548", "sighting--57a0fac4-96c4-42c2-b5b0-bb00c6f29945", "sighting--0d2adfce-82e0-46e2-98ad-9a52507f45c1", "sighting--1be864cd-3c88-4b17-9ec4-1be0223e400e", "sighting--f110aae7-cb40-4876-a4a1-85033315307e", "sighting--1eff95a7-f9e6-4f01-b83a-ac61d9862ced", "sighting--95248e58-fcb3-4bc9-a25d-31d802ed211a", "sighting--d42e87f5-e569-48b0-a0bf-dde9a5b081eb", "sighting--6d0b69a2-ffe3-4159-896e-35e5e723bc96", "sighting--7d6e7510-ccb7-491f-813d-8f31b4bbe1e9", "sighting--eb4a8c90-8529-403e-abf1-bca92e17076e", "sighting--b37c2c6d-991a-449c-ad1b-792168c5f306", "sighting--e13f04c9-36dc-487a-b59a-84f7c51a4795", "sighting--f60c7158-6e76-41c5-809f-505fce7fff68", "sighting--8eb63091-d365-41c8-a0f6-fef508677361", "sighting--106170f6-db3c-406b-aca0-ada2faddd487", "sighting--ddc402c7-4283-4afd-ad40-0f481fa5df01", "sighting--9ac1e8ca-f162-433f-a008-df54bb90449c", "sighting--3de89aea-06e4-4130-887b-70c9957a8b40", "sighting--8880b389-5703-4c86-bfd7-c37e553dc8e2", "sighting--bc3ada93-64c8-4185-90a6-8475a9ff3feb", "sighting--70f5d3d5-10cd-42c6-9cb4-5ca56cfd684b", "sighting--bdd1e61f-0810-4cd4-8879-6ca419f6443c", "sighting--081d8359-ee6c-40c4-815d-5e21febe13af", "sighting--283e3298-2f26-4f98-88ea-53d445cb1c0b", "sighting--453a400c-56b5-4a89-8508-ececa7c56901", "sighting--b702244a-03ea-45ae-bd26-921f02a67ecb", "sighting--2a2eadb7-fa07-456f-bdbb-c2fe120203db", "sighting--a7156c93-2050-4b16-8ac9-3f3d8e12f34e", "sighting--57751840-38b0-4ca8-9e18-128539378e07", "sighting--8dbaefae-e305-4e65-ac7a-2a828951f8b8", "sighting--9942503a-c313-4d19-ab96-7ea989438733", "sighting--3868d865-0914-47f8-aab5-f1e76ac5ec44", "sighting--ecea4566-917d-44e2-8a15-c17853dc7623", "sighting--73c59fb7-36f5-4c25-862b-0243712e1531", "sighting--4648a43c-bb9c-49d6-964b-1f68a9c7538f", "sighting--1494406c-a4ec-4242-b6b8-5d97504b8dd4", "sighting--534101da-488d-4334-b94a-1227d8fd2b05", "sighting--93c6b29f-20f7-4714-9da0-d8a32185bdf0", "sighting--343cfd7b-f063-446a-ab8f-b451b27c2753", "sighting--42c59930-38d3-4161-8ba0-77c027a21540", "sighting--f93af21f-78d6-4d0c-a66a-b874358d3798", "sighting--7a869b48-fac3-42d1-8826-7668d6ee5ff8", "sighting--f4e20743-7ce3-4b85-a3ea-f45796bb4964", "sighting--938cd24d-3a69-4984-aa0d-b1b3d3b20b7b", "sighting--cb21f050-e0f8-44e4-b80f-76d78a17970e", "sighting--b26dba09-2969-48ad-b89b-a4f481bf6cae", "sighting--0f6bb45e-e4d4-4839-8a24-aadc6694e835", "sighting--9be791a1-9f97-4fb7-a82e-0c408db23fc8", "sighting--02099d2a-f0f3-4d8b-9b65-e7c5391f58e3", "sighting--e4e8bdab-1f41-4f97-b720-0a25c80d56b6", "sighting--50b56909-a17c-4335-92eb-842fe2b49b97", "sighting--eba5d9ac-edbf-4141-b974-f21e12a16ff5", "sighting--4e367d23-0cd6-4877-bc42-20b37eb3555f", "sighting--24539971-e690-4a7c-876b-a6348e752dfb", "sighting--0092e6ca-14ab-483a-925f-20ff8e0c5d83", "sighting--4f54764c-b331-4af3-a042-d701de7c250e", "sighting--6c431922-bb25-4b15-a715-6f48ab2bfcc4", "sighting--1da9a21f-9185-4fed-b353-59bec919c5d0", "sighting--f2b269b2-09de-4bd9-8604-42b1e8352c92", "sighting--1cd672af-6dc6-479f-98bc-9f78f644d02e", "sighting--ce7c45ba-abf3-4fc3-8ef7-2570b75cc578", "sighting--88594e83-c600-4f2e-a06b-aa165af09759", "sighting--0bcfa410-9d18-4c17-b2f5-c8967257f489", "sighting--6b69faa3-b84b-4a3d-bd37-092883f0ea3f", "sighting--3675876d-5882-495d-8f9f-9c4d5819ea00", "sighting--033ab61b-bc27-4565-9d72-31575b2bb9bb", "sighting--85179c64-20d9-4b4a-82e1-75253a4aecec", "sighting--ba3e66cf-e46b-4053-964a-04a48aa394d9", "sighting--1dc72c54-6dd0-4f0b-bc98-5d8d2ba35ad9", "sighting--3ba00894-f0de-4a53-a5d0-3f2d5956ee69", "sighting--2b9e2981-27c6-4205-82fe-d71004502501", "sighting--b2c095c4-6235-4b8a-a172-6da17a563f1f", "sighting--d310f0a4-4e6c-466b-92ce-c43813b87b0c", "sighting--3eae9101-e724-4d06-a871-3b99ef1c69a1", "sighting--1989c230-1383-4aa6-878b-9f9cbe4cd679", "sighting--e799f210-6134-464b-82d2-b6a04280cec9", "sighting--ce1b79c7-221c-43a8-8e3d-67a5b8515ecb", "sighting--d34d89bf-60dd-4336-94d3-3f55c8a91907", "sighting--2c9dc9e9-5b5a-4c15-bce5-3d094554d3c6", "sighting--d1787a38-d991-44fe-b914-b0bf9ce43f58", "sighting--773b7ada-f209-4f83-af2a-ed31298b8e05", "sighting--69e21b50-5ad4-467b-87d6-ecd2ab400776", "sighting--b1684592-59c9-4b53-a080-8c37b4eb22e3", "sighting--674a4b0f-28b9-46c8-94ca-2a322a1b8d07", "sighting--f9665c45-663d-4b99-91df-c1f635c29521", "sighting--2f7535dd-0e89-43a3-b18e-81a223ac736a", "sighting--2de3c553-3f47-43fe-886e-0ba589034822", "sighting--e2079c79-b891-4c60-bf09-1f7f13190e0c", "sighting--43f77378-8a36-4c64-8b86-4a8ccaabe41e", "sighting--6c3de840-090e-4087-a0f7-a124300da81c", "sighting--f2a79b52-0904-4b6b-b871-9ac4c7c444fb", "sighting--f3a4065d-a1a7-47d8-a2ec-0f559a1da4a6", "sighting--c964893c-956e-4f67-99b1-37a1d130dffd", "sighting--4daa00d5-9324-4ccd-a164-6f978f3cba04", "sighting--3e34ef86-e74e-42e5-b0c4-0cb0987f5905", "sighting--10977294-e221-4c20-b1cf-fcd3f0c260b4", "sighting--b8676b15-ef6e-49af-aa96-b349d39f134b", "sighting--2898207b-80fa-4ed9-8d26-86c2b9db122d", "sighting--f6f95dec-1722-4422-9b87-fbbe0c74c23f", "sighting--465ca432-23b3-40cf-81ba-fd4cc2fbe304", "sighting--87693bda-dd6d-41c0-ad45-5c9492e5b950", "sighting--a4c6e14f-c5ed-499a-9af4-335a053ac25b", "sighting--d46d78da-49b7-4027-83cd-662fda2eb6a6", "sighting--cdb1ba86-ffa6-4466-b4fd-0caaa68c2209", "sighting--68ff9dd0-45b1-4bfc-9637-cf6ccf88204f", "sighting--2341ef37-6024-44c2-9dd0-62809cae8393", "sighting--f09b190a-21fb-4bdb-9edd-1d25a8a8512c", "sighting--4b23e9d2-75ba-47a1-b5d1-67c4acb958c3", "sighting--6dd5ba0c-ad02-49c0-be3c-a1c0c3d5d232", "sighting--4577763c-2067-4127-88eb-bd52afcfae40", "sighting--517d06dd-3d0c-46fc-9758-7fb9b0c870c2", "sighting--c5bbc96a-bb6b-4a10-8d67-27db78093c4d", "sighting--a8ab73bd-997b-461e-ba63-4e92d153cbc9", "sighting--e7607a28-311a-4216-9841-2b16f9ec2463", "sighting--a779af2a-9dd5-492d-adfa-e4e8b3cf0239", "sighting--f6932cb3-0246-4fcd-bc0c-90d46bb3df94", "sighting--776a8906-f526-4cfa-84eb-0c7f33f023e1", "sighting--b3fca78b-45f4-4f88-a723-4daa130e1ef0", "sighting--04a5c8ff-c6d3-4b24-b42d-92ca80166b21", "sighting--3b9562ea-58ab-40d9-8b13-5b442a5b82e7", "sighting--a5744275-13ed-45ac-b75f-4bbf450d51ec", "sighting--0f5a9ac1-3866-46ee-9942-0d9dbc090a30", "sighting--9b00679f-3c6a-413b-9f2b-a95b2226e18a", "sighting--afc06c69-8fb1-4dc1-892d-6e9558ad838b", "sighting--229c50db-9bdb-499a-87e2-ee840ae9d582", "sighting--de6f3861-12eb-47e4-8455-2c1cd57bc104", "sighting--a047e5ba-a994-4317-bf96-3dc0f5bd0048", "sighting--7f741bb8-29f1-474e-b7c3-9332bebe8088", "sighting--ef7a76a9-7162-4200-9f61-bb85f6ac3b3a", "sighting--a3bd00b1-0abd-4066-86de-e5b744a828e4", "sighting--ab37b14b-90ea-4e6f-8d83-2088632c2ddf", "sighting--bd1191b4-ab0c-494e-800e-1eed4026efde", "sighting--cdda553a-e2f0-4766-b6de-d4e2a9b3833f", "sighting--4149d848-38ad-41d5-909e-512a1caa36f0", "sighting--8ee0b6e1-dc50-4225-a0dc-365dc0f943c6", "sighting--d4d4023e-8e9e-4b1a-b507-33532e60e3da", "sighting--8b793305-0a42-4652-9d47-71f796af403d", "sighting--01ca95eb-3bfc-426d-802e-3135cc576560", "sighting--26e91e88-b1f1-405f-be5f-9da4e7d3443d", "sighting--a4e4e861-8917-45ef-a2d1-6592422b5357", "sighting--6eb38e52-05b9-4428-810f-22f0341a8f6d", "sighting--7445e91d-fbed-455b-942c-c6db2bfde82c", "sighting--360e065f-e5f7-4934-88a0-03a6391682eb", "sighting--57cac7db-975c-4f0b-b5bf-dfcc622ed8b5", "sighting--3e2f86ff-a7ac-403b-8782-1865d9ae7835", "sighting--a7a05a6f-a545-4c98-a9fe-c503df205770", "sighting--c5c4be67-0d8e-41c3-aee9-8cffb9d8d20f", "sighting--cc43b7bd-d21d-44e8-9773-6ef532f9cf05", "sighting--e9795a19-fb97-444f-9f13-91abee4936cf", "sighting--a5469aab-1322-4c95-a5c2-ac67fd4d047a", "sighting--513cad66-d448-4944-aa02-717b931417af", "sighting--b63e9f5b-dbc1-4e93-88ec-5d15c993b26e", "sighting--31209b61-13cb-4f17-9d38-a55f78eb2fdc", "sighting--7b763cd7-fe0e-437f-9869-7431102d2752", "sighting--10a0324d-3878-4984-92b3-bf794ac4890a", "sighting--adb12646-7a3a-4e86-a005-70bf95498047", "sighting--13648497-d451-41eb-99e3-b8078a154931", "sighting--b6a06c3e-264b-4b41-8450-6371f595a2c5", "sighting--0d8d4226-3fcf-4bfb-9fae-04b7788c1228", "sighting--abf9d054-b47e-49e4-a441-c743a3023163", "sighting--7c8f96a8-fcc1-431a-a0eb-7fc722c66663", "sighting--58d778ac-2339-4981-9563-d4444afd0787", "sighting--c06d875a-825e-4a8b-8288-a722204cf90a", "sighting--3e993dba-79a0-4e55-bd08-82cc7588ab82", "sighting--a5077272-7ffc-4424-bf90-fc5132749f4f", "sighting--51110282-5e12-408a-abbc-f13cbcbb6c66", "sighting--0a03791c-5d37-4085-ab3f-fe386cda7569", "sighting--c65a995c-84b0-4b3a-a298-ebe45125f287", "sighting--d2ce37e1-d72e-4294-bd55-24a603e92d83", "sighting--b547d234-cb2a-49eb-9ed1-25e9e531126d", "sighting--f21f499b-20a3-461c-9fd7-1ae61abd418a", "sighting--b6252228-6a8d-4bb0-a1a1-ea880ded49ce", "sighting--832355d7-097e-4f31-89bd-42756b8b66f0", "sighting--d2b7be7a-e4f7-4b9f-b2bd-1a79a0168646", "sighting--39f84094-5089-4083-816a-c809a44d6d02", "sighting--f9602428-37eb-4835-a616-740af030dda3", "sighting--15bb0d6d-e46c-4a30-ba23-911b43fcfe22", "sighting--bf37ad7b-ef25-49fd-ae75-1329b6c28d64", "sighting--684a4b25-f179-48a4-a76b-98f20e0cc170", "sighting--d4b885eb-0878-4060-abce-c8b8d50c452a", "sighting--2098ed3c-4c77-47b9-92f5-7ce60c0ec62c", "sighting--7d4ddd29-54d5-41b8-bfe8-9ac6f0472aa4", "sighting--275854e6-8768-43a5-90d4-c4acf2b14e73", "sighting--5d3a9267-8702-4c57-9c56-c7a7270b547b", "sighting--b0afd944-67ca-470b-8a51-969d69c18ba8", "sighting--803b264c-ab97-4433-8b08-c65f6fe266ce", "sighting--88f0627e-a73c-4dd7-a7b5-8585a7ab1f89", "sighting--c3858375-0bac-430e-b0e8-646052d77de2", "sighting--874fe5a0-54fb-4af4-b80b-7133ca305953", "sighting--0cd4305d-5ce5-477c-bb3c-756c3bbd2b28", "sighting--f7ca3c4e-3ffc-476f-8ca5-6cf767749c00", "sighting--a95bd74a-a6fe-4f57-b8de-9733697adc23", "sighting--0dbf629f-3a94-4faf-b7ad-2d71d412f8e3", "sighting--cbc9dc35-b7e9-43a3-a4f9-a1998d6495f1", "sighting--d22d6432-7f33-4dd6-ab5d-8feee1ac5008", "sighting--241b74b9-4a3d-477a-8550-21a51a3af4ce", "sighting--66c8c1b6-452f-4f9c-b778-965343e0b378", "sighting--0fffa9c6-302c-49df-890a-66504006c6f5", "sighting--517a460a-ee3f-4b6d-956a-619e6dca1522", "sighting--6b6e8a5b-94b8-40c5-b937-0918ae093141", "sighting--945a3b9f-77c4-4450-a1d1-82c6a7262127", "sighting--99cd6233-5b65-4452-bff5-bb2750f7a2c9", "sighting--ce902247-5226-453a-9ab9-61ed85096be7", "sighting--7a47557a-a9bb-491b-88fb-c1ee9bcec33b", "sighting--18f5166a-e218-41e9-955d-efd47960ab26", "sighting--4f809c39-540e-4fc2-9e27-8b34a6fa9c5a", "sighting--b4f0258a-1979-45c3-accc-13d57ae181af", "sighting--dabf2686-42d8-49a9-960a-eb783aca37bc", "sighting--0da65166-6546-436b-bf67-c6db979529fd", "sighting--0ba5cd9a-e955-44fe-b8f4-f845b8d7c0cc", "sighting--77e11328-7f1d-4339-80d3-c18a209c038e", "sighting--fa3fb809-75fa-48f6-8726-1c6eef335ad8", "sighting--a2e32900-4be7-4243-9abf-762623d90733", "sighting--b710c421-dc01-404b-acd2-0727b9136484", "sighting--7f67fc07-75b6-4c7c-85fa-eea452df8ba4", "sighting--5ce7b243-1481-4274-b0e0-8b3eedb7c3b5", "sighting--d93dd0c4-d273-4dee-98e7-ea71711632d2", "sighting--06d70b19-3eb7-407e-9d66-3960a3b8a611", "sighting--47c1e01a-758e-4a40-a79a-677377f6b1ba", "sighting--a2d16073-7573-4f6d-8851-a27bc8684630", "sighting--de8f1dde-6116-41bd-90bd-6480ca22c3e5", "sighting--cc110e79-40af-48b0-8ddf-8b2bf9750279", "sighting--ab303688-ed4a-409f-b183-23aaa40715ec", "sighting--4f8e18ab-3d58-41c9-a9b1-9ec42987f77b", "sighting--204fb301-71c5-451b-ad5e-6c6a0d682e73", "sighting--ee83fbb3-9ab3-4442-a3a9-0a4c618d133b", "sighting--8bfe0158-b521-4f56-b23d-8e9bcc2820d2", "sighting--78f6eee7-66f3-4144-bca8-f7bb560c4397", "sighting--eb19bb0b-20dc-4a46-890f-d04ffbd342be", "sighting--0cfbf8f6-2231-4903-9926-697d2eda4b2e", "sighting--d211f594-080f-48dd-9a8b-e5c4fee0ea67", "sighting--6ba25ff2-9015-438c-9a5a-a38d7916ac2a", "sighting--46a88914-08cf-4474-9720-2627538bb4d0", "sighting--e125036c-44a2-4d18-a7d2-e1d2c8765080", "sighting--ea96ddb1-824d-4fea-9049-5725ae03c29f", "sighting--ce7c61fc-7bde-40a8-937f-4ab6f2bec386", "sighting--88d693b4-6d9c-45d4-95c5-68398f876800", "sighting--c2db4fb2-688b-4f09-9eb1-ce70e2130252", "sighting--ed13eb7d-abd8-4ddc-b2b5-3831167919f4", "sighting--0a9d013f-fe73-4cb1-b83d-38953a26574f", "sighting--d221593f-577a-4f48-89d6-6ed070779ee2", "sighting--0d406773-2986-49dc-9988-e5e502b3739f", "sighting--6403cf40-e743-4041-b8e9-d8727aaf77fc", "sighting--10da3708-3eb6-42d2-b231-a975b7b40072", "sighting--5e3fb844-b75c-42e4-a8fe-11af70ff526a", "sighting--4a585257-1ce5-4850-91d3-f4fe3fccbad8", "sighting--57485e4d-ee70-4e21-801e-eb89edcc2e18", "sighting--a96a7c22-e6eb-4ef0-a7c4-38abf75d025e", "sighting--80abd41b-5afe-4447-86f0-2fb737c215c8", "sighting--8f513c65-fa7f-4c8d-af5d-5245833545a6", "sighting--5ca50a44-8d34-4d3b-b9a6-bdc504de9ba5", "sighting--ee28dea3-a595-4144-aa7a-ea2dcbeab833", "sighting--bcb33402-c621-4fe9-9d2c-b87c9ba32628", "sighting--5c2c1c1b-032f-4668-9b07-d63d850ebdb7", "sighting--4999f2c4-07a7-4438-87fb-f63acdcc8915", "sighting--e4547a29-e28c-4496-90d0-71832a43802d", "sighting--cbc005fb-6a5a-4afd-b3ba-a6c55ac529d6", "sighting--5a4a4def-079a-43c0-b603-e430850bca16", "sighting--98320504-0da4-49dd-823b-fa5d86ec0417", "sighting--1a2eb037-3461-42bf-aa1d-bcd0e5a86eb7", "sighting--8ff250bb-3a34-4331-a613-e007ba90ae9f", "sighting--55ca015b-4c99-40a7-84be-4b28663c7c59", "sighting--57edf51d-8d70-4b23-8153-5513321d0ec5", "sighting--ea50094b-97d3-4362-8d98-f338de4957de", "sighting--15a41459-91a0-409d-8c1f-9667b3e4245c", "sighting--80f6ba70-5610-4bb9-80ac-a3c7876848f8", "sighting--c2b0e96f-3e2d-471a-a4fb-44f1fcda0145", "sighting--92d3d133-72e6-48b7-8162-56415a8ae6a0", "sighting--c3841318-170e-468d-86e4-2b235185a051", "sighting--41ca2440-9d2a-4fff-a3fc-0da58cad3b45", "sighting--9a3b269d-2899-4bee-837b-0b77f6e3d554", "sighting--4a604eda-d7fe-4ee4-9ba8-2e2849ed11d7", "sighting--b9675f97-8e5b-4c3c-8012-59ea27f8027b", "sighting--eb173eff-82a5-475c-8ffb-b2d4240da481", "sighting--e4981b73-d34f-4c77-abcc-092acb8605b1", "sighting--c5e8d414-4aaf-4c01-ac25-ba926831067f", "sighting--70741a58-1991-43ae-8872-ebed68e35047", "sighting--c0569b27-989b-4efc-97fc-b6faa5190eb5", "sighting--db108db4-94f1-44c0-b087-7e63bf0c6f97", "sighting--9bfc0716-70f6-4c75-ab91-6cb468674865", "sighting--13263764-fd18-41ae-9688-fc7533068938", "sighting--ef5b37b2-793c-474c-8a64-e45011be4093", "sighting--52fa11d7-02b8-4641-9eb3-d430e4746f57", "sighting--bd46631f-1ff1-447c-9619-8dff78e3ee0e", "sighting--316d7c77-ad03-4b37-a509-a652b52d03bc", "sighting--a9b87926-e9b9-4f0e-a9e2-1f08c7e6ba84", "sighting--daddcc48-558f-49dd-bf94-8d645aaa9e1d", "sighting--73d35750-8535-4727-89de-6f4945170edf", "sighting--df73d8be-8bd1-4ad6-a8c3-7a523ffa5780", "sighting--c9c2a273-0bf0-4d04-ae70-9a1c4376d82d", "sighting--c6e36414-37b3-47ff-969e-7788e9335ff0", "sighting--4cc31051-7034-476c-a641-67fb88a218ef", "sighting--faf28bc8-7368-4ad7-b9eb-e9f9efa433cb", "sighting--008514f3-24c3-4f6e-96bc-df2b08600e12", "sighting--e1e0f0c2-150e-4eca-92ab-cabc3a7a6b75", "sighting--c7ca4d91-a7a6-4d9d-82ca-b1e9b58a4306", "sighting--d4ce8698-1e90-41ce-9439-aba07bdd09d1", "sighting--c48180da-6ffd-444b-b791-05fcf065a11f", "sighting--33dcfa86-31e5-410d-809b-5f141f63d01b", "sighting--61cb352d-048c-4ebf-950b-ba777a9911f2", "sighting--ef3d00b7-bc33-4644-8579-c7401e18e7ea", "sighting--d97c5831-edc0-4206-918b-4e42c89f6715", "sighting--9d58446b-c355-4ab2-a3f8-71a1c8deb044", "sighting--8df9a637-48f0-4554-929d-fdebe7fbcd3c", "sighting--6d9b90bc-f1a0-493f-8458-f2e4d5ff7324", "sighting--2522ab64-3ed5-47a5-ad4d-291a00e13c88", "sighting--6044c2e4-3c4e-410b-bfbd-5384f3d47fd9", "sighting--11430ca3-fa82-45eb-9dd0-23d4e2d73657", "sighting--a8472fb1-6478-4aaa-bc80-42a70469aefb", "sighting--6c79d958-dbe0-4635-bb18-6a9529653e51", "sighting--9ce31cfe-4784-401a-a0bd-65e1b28e26dd", "sighting--d7974a31-eb02-4ed7-93a3-e432e6585417", "sighting--72808a27-baac-4198-b344-dbcf6384e138", "sighting--c1f8a143-bb10-4123-af59-e2af52b3d24b", "sighting--51e3610b-741e-4de3-b7db-10138de9c4ff", "sighting--035119da-20b3-4218-b3ea-6db8738ebd1d", "sighting--17c3c960-e456-4be6-9456-6629d2b9540d", "sighting--f0b90ce1-5ee0-4bf1-b1de-7ed5a66bac59", "sighting--25eda881-516a-4b6c-8d29-dcd8671c497b", "sighting--0ed75046-7fd0-4ef5-b142-f9ed1d988c8d", "sighting--e7596601-24d6-4d2f-8040-c62ef20df6f3", "sighting--58649189-8c06-44df-a66f-c0ce5592b40f", "sighting--16b06e28-5fc8-404a-80fc-80a149e2c915", "sighting--33010976-0603-49f0-9bc3-6ea54d62d922", "sighting--22589003-127e-48af-9165-2f99906e082d", "sighting--d5b1f71a-ad84-42dc-97ed-f4e18b89fad6", "sighting--bb45a818-0a30-46b7-99b2-4356e87b3e6f", "sighting--b8e35fdf-a4c8-4e80-ba16-143be635a7f2", "sighting--36754b19-61e1-48fd-a317-77a11a693590", "sighting--bdeb8cb9-792d-4675-94f6-3de7b739d890", "sighting--8af88b5b-cebb-4a6f-8059-dc7273dfa3f0", "sighting--0fbd2cef-fc12-4e06-b874-be6295ed7ec4", "sighting--a2e3abbe-e137-40bc-8690-c26c944b6cec", "sighting--891bd15b-cf80-4811-9428-9744559d30c1", "sighting--821f9bcc-46df-4ae1-8c76-f12c79f295e9", "sighting--54df9351-ee21-486c-8162-5c9327f6de4a", "sighting--1984d489-83ac-42f5-853d-a92081b00aec", "sighting--f6b1bbbd-6ba8-4db4-9ba4-02642c930ceb", "sighting--ae5fca5d-d50a-4024-bf11-85dac24b8442", "sighting--0924f076-9641-4c7e-b49e-803854defd27", "sighting--0422658e-ae23-4a26-af62-82e13bb07c7a", "sighting--2c50563c-f493-4e15-af99-0cf10f62e7c6", "sighting--4069d43d-fefa-4364-989b-eeeebb27d6f5", "sighting--64b6dc43-06df-4e12-bf12-1a8ada2e8761", "sighting--968daac1-641a-4781-bdc3-e11eb00beb45", "sighting--5bb101f2-c693-48f5-b777-b58c07964d8a", "sighting--b485376f-4577-4661-820a-2fd66535c226", "sighting--53a5ac52-1517-456f-b567-bf3e0401dfb6", "sighting--87ac12ac-1f3e-4b50-8b58-3426042f1eb0", "sighting--641ed3e3-5702-4ff8-adfc-d6a72c698403", "sighting--f1637ae7-615b-4ad3-9e8b-1eb16966e3a4", "sighting--c3cafdc2-bb18-4f6a-a2aa-56b6b7baf745", "sighting--9ba3d645-6746-4f1c-a5af-c6bb05d3c98c", "sighting--a84c05b2-ce47-4a40-a131-a818290843d9", "sighting--d53cb95d-2584-4782-a5af-54e8bc113527", "sighting--fa35ea74-9047-4ba0-8879-40e8fdfe96a4", "sighting--e2eeb6de-de24-406c-ae58-871bd4bad94e", "sighting--01e8188a-b105-44a8-aa59-646cfe0a737d", "sighting--9cd8c293-205c-45a6-abbe-48ccf5554f17", "sighting--7430ab12-54d7-4d9c-a52e-736e82ac3ffc", "sighting--66a33295-03a2-4048-bf64-7789b9155f62", "sighting--8238b15d-a4ea-4728-863b-1476d4adc1de", "sighting--2b54b29b-abd7-4e7e-84d0-b91855f9cfe7", "sighting--7dda78ce-3cfb-4f37-a5a4-0d75e89c2ce5", "sighting--2200a3f4-0e0d-4c97-b9bd-47b6320d0ead", "sighting--78a71799-591c-4f60-91ed-cfd455351d83", "sighting--48d4f8c3-e76c-47b4-b506-5eca476a3dd8", "sighting--46a9a449-3978-4016-99c6-d1e7daa52f0f", "sighting--9fc3a8c0-102b-4455-be29-b3e04778f494", "sighting--2a1ea2d1-cf24-4cb0-b463-ba92a5fcd4fe", "sighting--5b419033-d758-4ffe-b0a3-ab889529d1da", "sighting--229cd628-3a0d-4678-bf1a-277779dd1099", "sighting--5cfa08fc-078a-4507-9e3d-e6a337c952f5", "sighting--9013bd9f-ac0b-4a02-81f0-708930145809", "sighting--67eda838-412a-4a6b-b01e-7350b0dddc26", "sighting--e6f1dd4d-6377-440d-adeb-50296ee8b645", "sighting--5bba487d-a889-4ad3-8727-0c923221ab69", "sighting--807cfe21-6a30-49b4-a838-8de219328a27", "sighting--19b87c5c-c3c2-4c60-ab71-bdbe3aa7ae48", "sighting--5f5ce4ee-b18e-457a-a1fe-b31b55181796", "sighting--68fc8c41-2ce3-4e9a-8c40-36c1443698f2", "sighting--e1422e0e-02e3-4c6d-bc4a-de3848a04713", "sighting--af61559d-34e5-4389-a393-232024da749d", "sighting--723c1e36-8548-44b8-b116-106a2e0aa9c3", "sighting--eb518768-6283-429d-84f3-ec840bc5f177", "sighting--f750700d-fb1a-446a-a009-80687f74adec", "sighting--d4b693aa-b008-4f47-9662-c30ab11091da", "sighting--fd6c995e-43ab-4d06-bd31-31c0b922fbef", "sighting--e1021cd5-c587-4eb1-aa1f-edfbea288f37", "sighting--344a7abd-1af4-47af-b592-716c6b496091", "sighting--c724b481-c374-4735-b3d1-e349c1930acc", "sighting--e98f356a-279c-48a8-8ee1-842539e68318", "sighting--8697c20d-c159-4be2-8563-55a65e832b64", "sighting--7bd52b44-cbe6-4611-90b3-d6d28c8eb216", "sighting--70834841-b541-4ead-9b97-9ffd2a107142", "sighting--1fb79f90-1460-4e18-a9f6-47fddb30b5ee", "sighting--439c3094-01f4-42a8-9358-a6e8adcfce42", "sighting--e4412c6a-c869-4a2f-a913-4e86cf680c93", "sighting--1e635154-ca10-446c-a6a3-20055a6a13d6", "sighting--12b16fa4-4224-4c74-89bc-1b2ebab373b1", "sighting--b031fb2c-ff86-41c8-a956-6a3cba04e72b", "sighting--55719df7-9ec9-4cb7-a214-967ebe399866", "sighting--13040150-fc01-435e-8dac-63e8c7ef38fc", "sighting--47125848-1be9-4218-b0ca-8bc0bb141289", "sighting--2518eefa-09ef-465c-9dea-35a9738621d1", "sighting--17a98677-663b-4baf-a519-178ff9d1fc30", "sighting--baff89fd-e770-42c1-abfc-a2fd2a9e9d36", "sighting--61ce4d4a-5ffd-4bf1-80e5-11c25fb1d2b3", "sighting--e7c048ae-3334-4043-8e90-f5a0a7365462", "sighting--6622dcba-ca30-4d83-9284-699c82a6c75e", "sighting--0d7c1ad1-dd16-439d-8721-2a4542c02959", "sighting--5100d70c-2543-4819-993d-9cf39a1bb3de", "sighting--17b2724c-3d6c-4c5d-9daa-74977b946542", "sighting--1e16dd4d-a71f-48ec-a3cc-2782f8d57845", "sighting--3476f394-a905-4955-a9e4-5d76cbb6ba7b", "sighting--5e1593dd-aa92-412e-9474-e836d8578070", "sighting--9aee1173-8209-44ee-89a7-e14954c9c605", "sighting--b067df94-9aab-482b-9010-b4d280fa6030", "sighting--8f96ad31-ed7e-428a-b73a-9b04a7c2bcd0", "sighting--1c3a2951-af80-40f3-8f9a-6bb0a8bf8f38", "sighting--72448727-d694-48c6-adc2-fc13f8978c74", "sighting--59e295c2-c529-4bba-974f-fddda577b1fd", "sighting--35637a20-1e13-450f-bcf6-d05bd2f2640a", "sighting--c600a00e-3dfb-4d82-8645-5b4b8f0b5f31", "sighting--fbdc1f6d-1152-4185-a5e3-48b0f8bc926e", "sighting--3dd247c7-05ed-48c0-b810-99993e46f5e1", "sighting--f3441284-fc85-45c9-9b10-491b7151a718", "sighting--6342ab31-57a2-413f-996a-14ab9599f105", "sighting--e9184a87-5205-4794-aa36-d392d3de0f0e", "sighting--357efcec-f29c-4648-8f06-12ad040e9ba0", "sighting--14a42856-c5cd-4762-8322-ec003ca50273", "sighting--0bd2ef99-1bcf-477d-9402-7c795c622068", "sighting--28e426cf-278f-4ca5-bb50-e8df53a67442", "sighting--2aea0756-6f59-4528-9fd1-e90fafa3b1d8", "sighting--8708c292-17a3-42ca-bdfd-2de8c6d3ceaf", "sighting--1de7915b-4b87-4f6d-b20a-f56965995267", "sighting--82faec57-7bcf-427d-b894-f980c2d08d30", "sighting--d343fa3e-9401-4d39-97f3-b79ff390f0f2", "sighting--99f5d174-a06c-463e-8a4c-08b348084860", "sighting--ff9210b2-de9b-4cc5-a1dc-c1ef911cf753", "sighting--ec53885a-91fc-4664-8c46-32acb4d9e368", "sighting--9e93a735-3095-4dbe-88c1-c7dcd8ed86db", "sighting--b1ba3047-8a66-457b-b735-beab93a0b189", "sighting--501e0df8-0f03-4115-a9ee-004edbcb9291", "sighting--a59a8b61-7126-48d5-93ff-e367fecdd011", "sighting--1caa464d-2559-4566-84a3-924e5cbb3915", "sighting--e40fc52f-3b7f-4147-a82d-07b60ded9807", "sighting--0d26c411-e1b4-4a0b-b884-17266272f8c4", "sighting--00b34c95-df53-49f9-9190-3d50d6215912", "sighting--a6b72f43-e54b-4c05-8d3d-da8a45246a43", "sighting--9a196abe-3377-4d42-89c3-dbfaabf7abdc", "sighting--c98ad9e3-bd62-4bb4-8a4d-dca02efa7156", "sighting--67d91372-3304-4f0f-a11a-8cea6039c4b1", "sighting--48117ca2-feb6-4293-bd49-1549dc08f19f", "sighting--881300ac-8a11-4b28-9069-2b4299b97ffb", "sighting--b17177aa-0038-427e-90d2-49cb1c06878a", "sighting--2f21bdbe-d8c6-4c04-a160-bd68aeb6da83", "sighting--01f550d6-e270-46fa-9ba2-e2bac10a5191", "sighting--f3d2140f-e5dd-4bad-bbe6-cb1ceec8453e", "sighting--b1cbc9cb-7615-4f49-ac97-a7d053392362", "sighting--29396c02-4025-4c11-b11e-e7050842174e", "sighting--a549b25a-a565-4873-8c01-9cfac0bcf25a", "sighting--06eebd49-01da-42fd-98cf-0eeb220c16e2", "sighting--02c8b18e-9e14-44fa-ae84-417bb8ddb368", "sighting--338475fd-b758-4800-8bb3-d24cff921fe3", "sighting--311dd809-313d-4242-8808-d8a7d9d34cbc", "sighting--5d810500-f729-4e89-b388-781e01f74be8", "sighting--efd3fd5f-18af-4e90-9d90-e3e4a3e77bad", "sighting--f1095850-21bc-4a87-9aa5-0bfbc084595e", "sighting--d1545848-b127-4c06-8a52-a886720bb2c6", "sighting--9caa47ca-d96f-4d7e-a96e-636cb3343380", "sighting--7527ed7e-b8c8-4d9a-97d1-d9d28f7e0944", "sighting--61df20a7-59e8-42c5-8cf1-db8178903089", "sighting--63bd919b-221d-4aa1-b1f2-61d05f8acdba", "sighting--c8144cff-ee86-4425-8eef-e25217d29891", "sighting--6a581477-6805-470f-b15d-05d1a0a7d561", "sighting--3b249e6b-a37f-4bb3-9f0b-f0229da4e194", "sighting--53931f6b-e2c4-494a-bc12-0c1633f3fa14", "sighting--31e59207-509a-46bc-b3ce-bc91ca125efa", "sighting--8139a13c-fbd6-4633-9e3b-da578401d3f9", "sighting--9d7e4da6-4cde-4fa7-b035-0647561c376b", "sighting--fecf4b0a-40ed-485d-be43-b72c2e564465", "sighting--ad84f0bc-562d-4ef9-a048-60252e68ab6f", "sighting--cf7404bd-06a2-4b4a-8433-d174ace9d571", "sighting--58410fe3-2631-414a-b99a-e08da71c9b5a", "sighting--8ea59aee-1350-4f22-855b-1768d3c2f05d", "sighting--166336ae-d71a-48af-97a9-c4fe47a301df", "sighting--34aa58f3-8624-4ab8-9760-976e1e1d5d1c", "sighting--89c4a20d-c6ab-48e8-b295-00dc10083e63", "sighting--e0a3e63d-3b2c-435c-b3c5-dc3b45b918ed", "sighting--5c54ab16-bebd-4e0d-b69f-57c6075769b0", "sighting--a84da85a-9862-4f81-8e4b-c0f8cf2a0d4a", "sighting--244b69ae-cab0-46c8-9c46-de38ac8b0497", "sighting--aa95f32f-9ea4-417b-b86f-33dca51a7e84", "sighting--77a9eefb-ce1b-48b4-be84-6a1d2ee3a580", "sighting--770a203a-197f-4583-95bf-285bbc1f3dc6", "sighting--b2078c34-12ec-4007-96e6-632bdfa4eeee", "sighting--d41dd0d3-28a9-4370-86da-af937259f2b9", "sighting--163c33e2-2c57-4aa0-8220-0efb2d3921ae", "sighting--368341a1-d181-4311-849f-c55c1f17737f", "sighting--447fe3ae-71ab-4bc6-ac92-7eddbcddad84", "sighting--edc95da0-6607-430b-8e99-19787fbe367a", "sighting--b4cc9e0f-ea1a-4d5b-8e4d-5dc344ade3bc", "sighting--e79c8e5e-0fec-4586-94e7-c2f92607f5df", "sighting--cdc94331-5da5-4b26-a293-74b64db6d41b", "sighting--51583f32-dfd1-4032-87d8-863d756a4146", "sighting--e934458a-2821-46dd-801c-88fecbf14316", "sighting--31cbc892-0cb7-425e-bac1-9042b3fa65f3", "sighting--f56b7470-8816-4146-b475-3ec331be0c84", "sighting--7f9ac0aa-0c9e-462c-9172-8dc5f9d9c319", "sighting--e54ad4bb-e05e-4575-a7ef-d692ca894cd0", "sighting--980f0412-6229-4e42-8008-9e0f009ecfb4", "sighting--a18cb712-5bfd-4267-8b12-41f17e53345c", "sighting--059b8388-aaf4-4ca6-96fb-802028eb8b8b", "sighting--3900b1f9-57b7-4452-8ad6-37b76e3964de", "sighting--7557619d-cd07-4b70-98df-cebc65ab3e35", "sighting--80439c17-6344-409f-90d8-ac33bed78feb", "sighting--b5743f45-e55d-4d45-b5de-3901b6cfc2af", "sighting--be04ca20-c6f9-482d-823b-ac7c53124ce2", "sighting--75a0c114-c5f1-44b5-a3f3-f273e404409b", "sighting--0c601192-f4a6-41b0-840e-a68960d32798", "sighting--2b82c69d-4757-4f0e-ba13-d0fa7f23c288", "sighting--6f99f1ce-1940-4382-9a5a-0ff355e0d355", "sighting--d416800f-7cbc-4531-9a74-0e61cf804d33", "sighting--caa6bb63-af9e-4dfe-8ae7-eaefa68a249c", "sighting--306da619-a5e0-4cc1-9ac1-65d899cb4a22", "sighting--dd2b138a-9743-46a7-99bf-fdcbf48dd57b", "sighting--280aa0d3-1770-4020-b2da-ac2b239e9ee9", "sighting--8f33644c-b19f-4839-8785-644fbc4bf848", "sighting--683831ef-5e22-4c38-ad3a-92c6448306a8", "sighting--22c54dee-3801-4531-8367-63ab55d5926e", "sighting--3e66e6a7-dc4f-479c-8daf-9626b8e04939", "sighting--2fdff833-16e7-4cc1-8e87-3e7683ecc90f", "sighting--2a8a83d7-40ce-4dca-ad13-303eed6c5e00", "sighting--4e86f994-97cb-41b4-96ff-634d19f3477d", "sighting--826716ad-a248-4911-b912-22f536085f6a", "sighting--5c214385-030e-434b-9328-6440030278ab", "sighting--c9846c9b-ff83-46b9-b3c6-fbeb0dc3faa6", "sighting--c4878e4e-229c-40e4-ac32-78d49ee11345", "sighting--0888735c-e54d-4633-b35c-6bb740a0276f", "sighting--66148866-47e3-4878-be2d-8962ef43d9b8", "sighting--d347c38b-34e9-44e8-9fd9-0e7059f3b1e2", "sighting--c754b21d-3dd9-4fc6-9a94-64cd22667fdd", "sighting--55d997f6-3784-405d-8dfa-a453e6848365", "sighting--e6824ce8-12c6-492e-a463-56711e87bb79", "sighting--4097adef-3ce3-446d-acd0-08bc618494b7", "sighting--bb8bb242-7e40-4092-801c-97a2c6cd03e3", "sighting--e390dda6-8512-4262-8ed0-f69e41f39b29", "sighting--1926e52d-9f06-4d25-bb6e-b69d73c6cfd6", "sighting--54453784-c136-4bbd-8863-3cc5bc523c5a", "sighting--1a2fb204-dea8-49b8-826b-e228148602c3", "sighting--066dade3-5485-4e5b-9269-2d1e4be1d23b", "sighting--c708a9a7-7747-4a11-bb8f-0af8142794d4", "sighting--5b719847-aa68-4f00-a19b-7bf6cf0b82c6", "sighting--a8a8b742-ec4f-462b-9c23-e1d7b8bdb4ab", "sighting--c497ccf3-9c6f-4685-a954-7783119a660a", "sighting--5f171da6-1505-45d1-85c2-5c4a8366df28", "sighting--b3764721-bda1-4e86-9acc-80937a7ddf12", "sighting--ea1a40dd-89e5-425b-8a8b-464d40b77baf", "sighting--35471cad-e842-4558-aef7-60847098f050", "sighting--57f39f53-6110-4eb9-a48f-9515fc962f9b", "sighting--7da0cde9-3a66-40dd-bad1-6800d9a8adf1", "sighting--eba3a557-4f79-4b9b-b0eb-bce11120c1b9", "sighting--bc2bd516-72fc-4481-a71e-941248845d12", "sighting--1170449b-d549-46bf-ade1-54bc84b94233", "sighting--5178c03e-fc76-49d2-bf48-0fb503f7a701", "sighting--c30dd1ec-3edc-4ebb-bad8-1e8f55f6b6e6", "sighting--faae5431-296d-4141-8321-efc3664f19c5", "sighting--a450bb9a-0a78-4228-9a0c-bcc2e13bad05", "sighting--bed43391-a164-4004-a50c-30f62bc79239", "sighting--67dd102f-a8d8-4ce4-b5d9-280bbeb0ff93", "sighting--9fe32de0-f528-4759-81aa-08fbdc0fb0a2", "sighting--bc684092-b294-4b04-a33b-6e28172cee2a", "sighting--8b3a2711-7bac-442f-9489-ee80ffa28b84", "sighting--e6655e66-9893-4fa6-a4ac-bcf4641cea34", "sighting--1705aaa8-a13e-4ff7-a0ed-584683a92e4d", "sighting--73e8802e-0c9a-4c4a-8db5-25dd362e81e8", "sighting--a7129233-73e8-45c8-8b34-a090c3fe0d27", "sighting--59816447-654d-47c5-b352-04763deb9292", "sighting--04ab8403-c3f6-4e34-adde-66f1ab3f0004", "sighting--5c9cc887-5383-4e81-8c60-5aab3f01f6d6", "sighting--d073d1c6-9ecb-48b0-a33e-f3dabd3af866", "sighting--75045449-2bb0-4aee-abf3-fc25d7e1652b", "sighting--52b68738-92dd-4fe4-9311-779ccb588bd8", "sighting--f0f518e0-8bb0-4cb4-98d6-8bf9c92b2458", "sighting--4e61060f-3feb-460f-a91a-9de80cd5f485", "sighting--5ada7744-e7a8-4d20-8bef-857202d710e5", "sighting--fb7b909f-ffcc-4963-9266-ab4fe9669b2f", "sighting--ea0ea3b8-6473-4694-a4c5-a0e4209bc223", "sighting--19a4cdc3-5249-4116-bea9-030d98a1354d", "sighting--bcfd8315-1423-48b7-93ac-aeaed66ce4ce", "sighting--8e73ee7f-06ea-4707-815a-61cc79945344", "sighting--9fd41a80-260f-4f1e-a9ae-493345b1275e", "sighting--e2226a8b-3227-4ed8-9338-5f5d420194e3", "sighting--e6813b3e-732b-42f3-8384-67a8008266d2", "sighting--7d5aec7e-72b0-424c-87ac-423fa911cf03", "sighting--0c746040-865b-4786-b3e3-5a7224c1b267", "sighting--429ccb62-be5d-4822-8573-505d5553cc11", "sighting--34fd7d3a-b49e-49a6-a799-ae02676bcd11", "sighting--f8f8ccd2-cfee-4482-81c9-2dfb68f680cf", "sighting--9ac62d8b-da2d-445d-ba0a-56c10609c39e", "sighting--f0d892dd-e0c4-46a4-8922-761271ef9250", "sighting--7e37ed1e-050e-4384-81a8-a2beec7e4b03", "sighting--f8c8fe43-84c7-4a08-b261-1cccf646e6a2", "sighting--67d3412a-44c5-4314-b2ed-b4456a6bf454", "sighting--2a6906f8-7244-4768-bda1-3fbe14fd61ec", "sighting--30b52dd3-18fd-4236-861f-a23be31e4efe", "sighting--d47f86b6-e0df-4145-ad50-ae252a91c11c", "sighting--09c3f393-6f77-4117-a29e-9a03d6a6cf00", "sighting--1e0ec7a2-46a3-472c-826b-f5717358cea7", "sighting--17710822-2994-4bbc-8112-4974b4967a8e", "sighting--e4dac07c-0616-43a4-a060-c229031c3ae6", "sighting--53495c18-1aff-4eca-ae57-c1805fa4c212", "sighting--6c8aac46-7ba8-4773-a1cf-83ccea1e965f", "sighting--411e8d01-5fc7-488d-9438-df8c5eb0e5b9", "sighting--10bd0799-515d-414e-a8c3-73feccd87362", "sighting--0c2e2b4c-8f1a-4e0e-8e32-a92ea6e58241", "sighting--3469583e-4b44-402b-8c99-5b599470719f", "sighting--7f4f9919-a36b-44f9-bd4e-dddf5d9717d3", "sighting--837ea042-afbb-4a8f-b35e-79134cc892e4", "sighting--b5f53bb3-30f9-4c4a-b0c1-dfc068a6a3bb", "sighting--be868f07-3e32-4547-8bdc-b81ae446f0ad", "sighting--9bcbb902-bada-4654-9ef0-3cbb6581a650", "sighting--cb501659-6b8c-448d-bc09-5c2afc85d6ab", "sighting--0144f950-6e0b-4dc2-b29c-21e344f45e9b", "sighting--452f537d-eda4-4cad-8d40-29767f078d9d", "sighting--fb1f107d-ed94-4b3e-b419-2c00620be2a7", "sighting--6dda74fc-e7c0-4e1e-aac8-a1cc29b0e542", "sighting--60ddbba8-8358-4575-bbc5-12d72e377429", "sighting--4de2c793-e6cc-4b8a-ac10-6793d9104dd6", "sighting--a81f1a80-9350-4b54-802c-1facfe41e215", "sighting--282be4d5-8db2-4ea8-9e10-849c0139de80", "sighting--fcbae1dc-c0d0-489f-a3b2-810a51b40b17", "sighting--fe148157-3bb2-406b-8db4-ca2202a56620", "sighting--1aafd07e-2d5d-4e09-bc64-d83d54d7caee", "sighting--e42a153d-96b1-4c99-ae62-4cf9d27912c0", "sighting--d73c6076-f3f9-4ffb-9f71-331dcb7572d9", "sighting--c0610d24-3b76-4024-9e56-1be4b4f3315e", "sighting--8651fbae-9f4e-419f-ae6c-2950d8519ae8", "sighting--1d9a2e21-6571-4aa8-a392-acb4a0a14166", "sighting--b7c69c23-b280-4a99-be25-47064795288d", "sighting--e2951062-617b-488e-be08-8c699ef55c3f", "sighting--276a8bec-9fd6-4027-ad50-7b5e930a7664", "sighting--511d17a8-939e-4087-a784-1bf4c894b0cb", "sighting--8e387c54-abeb-476a-9f89-83455e17c864", "sighting--deb71d5d-4afa-465e-aecc-ddbd56306e2c", "sighting--033b4841-da10-45bb-83ab-036a332a307e", "sighting--c9bc7afa-fc53-40a3-b4dc-dff0fbfb29b1", "sighting--c487dcf6-2b21-4743-98f6-a7c5719f2ed3", "sighting--701229c6-4b08-4162-8d19-bd7585f99a52", "sighting--8253df6e-b0e4-4e82-be34-7e4993032824", "sighting--95680434-e14b-4cd3-908b-176af280d1f8", "sighting--cbc0951f-08cc-4b45-9040-e22f70e3bf73", "sighting--29cc2918-810a-4df5-963f-f63e20649b18", "sighting--96229b6c-03df-46c1-9c8e-3ebd7cf6776e", "sighting--a7ad3d57-d7b5-4856-b680-e2ea7059257e", "sighting--8020cab0-83c2-4d1a-bbf3-419d99eaad03", "sighting--151ffb26-baec-4949-ba0b-3de47020021d", "sighting--24a5cfaf-26dc-4ddc-8ca2-2b13e2432a91", "sighting--82ded9f5-3a25-4a67-a219-29e176f85ce3", "sighting--b63da5a3-16a0-4f07-abd7-03c84f13c397", "sighting--9eb6b683-be59-4c27-b139-a7ae97ff8985", "sighting--e9dac22e-e7fa-4a35-a104-42f6003cdb87", "sighting--9ab29a72-adfe-4706-86eb-957213b314a2", "sighting--3318dd93-674e-43ce-ba15-cf96ef2e7706", "sighting--bd18f1b5-a6ed-4635-9b27-0e30c10d69b8", "sighting--ec996998-5af6-4e97-ab98-f1e0235f12f0", "sighting--b71bfa94-5265-48c5-aa5c-45b9dc54a0a9", "sighting--62773f3f-3bde-4283-925b-e9d6ced962ae", "sighting--b21d6c50-71da-4838-a965-f8d5b968ae68", "sighting--bd60136f-3a7a-4e6a-a2d8-7807336254a9", "sighting--b13fee7c-6271-4a40-87fa-bcc4bc83b19f", "sighting--609a82a2-92c6-449b-a139-52d8d742fd0c", "sighting--51eb07a1-bc12-4446-bab1-a638aa107053", "sighting--57ebbb16-c52a-445a-94eb-94f79154eb58", "sighting--27df27f7-cbcc-4a2c-a44e-0497655e5baa", "sighting--109c4895-9289-490c-a5ab-bd633c2cc327", "sighting--737a0a4d-a676-4787-b55f-c207ab084256", "sighting--4713f4ff-03ff-4ab6-be78-14867a5edd3e", "sighting--2f1f987c-3fc5-440a-82ee-9d89052500ea", "sighting--50488c20-6dda-4b4f-a61e-3e5a27563d14", "sighting--aebdf492-4b31-424c-b46a-6deb80715ab5", "sighting--a59460b4-19e0-498b-a6fd-638584358403", "sighting--798a0d49-b857-4063-afc2-3adeba0ac53d", "sighting--81c0c560-4b47-4628-87a9-0c9325f5b88f", "sighting--4022e62e-ac9f-4f9b-82c6-86129ff99a6c", "sighting--abfd16c5-f775-4f18-afd0-bfe839eecb5d", "sighting--228dfb0b-e590-4a6e-bc86-64a7d9a96aba", "sighting--027dbbe0-2162-4117-bce4-8483f224e8e0", "sighting--3790728a-ca90-4020-a970-491ff31c72a5", "sighting--df5907b5-1ea6-4f17-8c03-f559bba3d71a", "sighting--227245be-ff1d-4d50-bb30-4e24a5862630", "sighting--8b73b207-0508-4cda-acaa-e59fc086ac49", "sighting--e7da42b4-eff7-456c-bc03-83dc254d455d", "sighting--4956b733-74ae-440b-a151-09a84aa2415a", "sighting--9b6efa93-9cd1-4915-aec7-906426ee2cd7", "sighting--0addab72-107c-4a15-a5ce-05d2e3f2afee", "sighting--66fd7009-f319-4ff5-ac11-ee4a2d37e7f3", "sighting--440d9b09-56f9-4afe-a578-64e4bfba30db", "sighting--b7461621-c390-481a-9739-e4f8d2b58911", "sighting--c4b7d5ee-5b56-4c06-875f-349676237d6c", "sighting--42499095-7cd8-430f-bc33-509cfd179c4a", "sighting--06e1c48a-e1cd-4b3a-ade9-46f8a1c139e0", "sighting--8422dc60-2f24-46b7-a67f-ae2bdd8ce5cc", "sighting--c3890462-d752-4ad3-af6b-5beb59aa081a", "sighting--57927d9c-9439-4715-80b9-a6738f9c7089", "sighting--77a183f9-8fc8-4333-95c8-33da602d91b8", "sighting--84972987-2b95-40a6-81d2-88cbdb731625", "sighting--f1defe48-55ea-488b-bbbd-bab2b357543d", "sighting--3c461caa-2865-458c-b91f-3be87353f794", "sighting--569be850-9011-41ef-89db-1bc7a3bd7662", "sighting--f18ea675-06fe-46b1-b014-6c71819653bd", "sighting--f732c000-e50a-41e2-9112-d20f89bb9b81", "sighting--807c4e0e-c9c2-457b-b393-f7d72dfe948d", "sighting--0e6ab5ae-378c-47c9-893e-8d10a2e5b8b6", "sighting--1b115297-25eb-4a54-8a27-72bb38cfa623", "sighting--f2b1b086-a27b-4977-9cc4-4a4167f9720d", "sighting--4d23a066-1ae9-4848-8249-6098af06506e", "sighting--f88e5c52-a2da-4a47-9c17-b22ed17dd9f7", "sighting--162d472b-abd1-4e51-8fca-a5896c6438ab", "sighting--65d4a04c-418b-4778-ba87-48ddbad021aa", "sighting--e563dea1-b661-435b-9211-6718f07975d3", "sighting--eed38754-4b74-41a2-a54a-f76cce47d59e", "sighting--68ebf4e4-2c7a-4472-b01a-ae255f6c74c5", "sighting--7396f6f8-e6a2-4da0-9646-9c8a307a9945", "sighting--b9f135e0-720f-4768-801b-2dddd7cbe386", "sighting--c41b0c52-a378-4f4b-a653-85bbd677417d", "sighting--b83ded67-d250-463c-8d76-77f92fff06f8", "sighting--9777e476-e3ce-46b5-8ee2-2f179a244ea3", "sighting--6fdf324f-9db1-474d-8ca3-11840ce1a890", "sighting--51fc87bf-4ad9-4dd6-8f04-f8d87c432cfd", "sighting--e284e4ce-e749-424f-9bce-2f66d34c0572", "sighting--82687c9d-a3a5-47f7-b129-f9fcfed65587", "sighting--b767d513-180f-4547-8415-e37875a3da8a", "sighting--68c1dfc6-6fe8-4286-b870-b8317b85a0bc", "sighting--ccac8470-94a7-42a0-bad0-a641a51c45df", "sighting--faee947b-32c9-4d9f-bc95-39d9ff4a566c", "sighting--88e5704c-46db-464c-a455-c1861f2b7829", "sighting--36bdb92e-4f9b-4efe-8c3d-b37e45bb0344", "sighting--b50b8835-6df2-4bfe-a110-871579394ee9", "sighting--f0a9600e-f30f-4eca-a07d-af1220e01d71", "sighting--4c31725c-a358-4c49-bc98-825aceb87f7d", "sighting--338ab097-495a-4342-857a-ca8c6f226b99", "sighting--933f68a2-376a-4dcc-9050-0af9b03c8b04", "sighting--1f5ca150-6728-4244-92f3-e8da7aff80b5", "sighting--ac02c74b-38be-4a4f-a8b0-df0302564f09", "sighting--81d96221-6ed1-4acd-bd8a-077f47ba2080", "sighting--71cdd3e7-c271-4e3b-a280-7a200a44a1ea", "sighting--c197c1e4-1da2-4e6d-af67-1bc5add97c17", "sighting--fef0197e-2dec-4cca-8334-d45b89d40f54", "sighting--6438987e-6e3e-4d13-a44b-34293591b5fc", "sighting--f2a330d3-34e3-4279-9c67-3754f20cb5de", "sighting--ec54d6ce-3b6e-4905-9f22-4f62e7299197", "sighting--e0c2ec94-66ce-4257-8fb2-b2d360f2cdf7", "sighting--8ba0f911-d068-4a6c-8b58-5dbcffbe4b77", "sighting--f179cebe-d454-4ef1-86b2-afacbaf35073", "sighting--0acf8910-61bd-4099-8a18-8649d2ad647a", "sighting--bc7e7003-821e-4dc3-975e-87cfde468121", "sighting--0fc49a13-8f7b-42f4-9658-133b28897313", "sighting--2464f704-36da-4946-9cf4-3c84e46f5fe3", "sighting--c4b3cbd7-31c4-4f83-98e6-37a52ce5ce23", "sighting--af5475f8-fe3e-49d9-b0f9-19a1ddc1d0c8", "sighting--c2ba7116-ff7e-439d-91ff-ed74bb485688", "sighting--a4d283cc-ee7e-49cd-80cf-904720e5057d", "sighting--7e5632c5-9d66-41c3-8359-1296906fd8bf", "sighting--b32fb5ae-82be-4dd1-ac9d-c1963ba30a4a", "sighting--8592d977-cfc7-4b08-bf3f-b8b162789820", "sighting--def7c4ae-1103-4152-b46e-086319d7e661", "sighting--5036783e-bce1-42d4-bb7d-737f83f09e1b", "sighting--47dccf7d-27f5-42c5-99d1-89a76a1d9004", "sighting--d1d80e49-121d-4986-9ca3-631564d97ecd", "sighting--219262bd-cc24-423f-a265-dba7077317d0", "sighting--a25adeeb-b4a5-4d0e-92d1-71ab0950f6db", "sighting--3f2022e6-93dc-4ad5-9a4c-0309a89c0fce", "sighting--53da2b0f-5615-4993-bb79-a08e2ec23ab0", "sighting--7b8c0f2d-91dd-411e-ad6d-e7f822cbf6fc", "sighting--99517b24-0808-4bd0-996b-f67600c6b6d2", "sighting--540ba5f4-bf9c-41ae-9fc1-6e04b562a573", "sighting--00b89d25-db4b-4193-9169-d1cae7111086", "sighting--ffcaa0a6-46d5-4a58-9a7a-b36a739d8b75", "sighting--98c74df0-81f8-4390-b322-a08b69ab50f8", "sighting--d846fa92-52c3-4ce3-ad2d-6d445bdfe5e2", "sighting--23808c19-5e59-4627-89d7-bf78ae912f0e", "sighting--1bdc21bd-0cf2-4b4b-911c-9dfd8888ce73", "sighting--06449c3c-f750-403a-9f87-aeb5d76d6f34", "sighting--c879baf3-174f-4b66-9941-7336f300240f", "sighting--dcf0299c-b08a-4dfa-9587-fb49209a564f", "sighting--db15f3bd-49b1-47fa-aa31-216333f552dc", "sighting--75959473-8257-45f9-ac50-8bd731973de1", "sighting--775e3260-71f8-4d4a-a71a-af414b5ddbfd", "sighting--48ee0704-877a-430d-b04b-a4a425aab7d3", "sighting--a2978e2b-e83b-4c96-a505-bda7ae6e32aa", "sighting--9508b04d-3668-4208-9364-9cbd56ea52c5", "sighting--c717f6d6-4996-4aa8-b104-9ddac72b816b", "sighting--e8e0da42-647f-4028-b8cc-f927f75817c5", "sighting--d077754c-d2d8-4ea6-8691-218e9786f1be", "sighting--58f30d00-0da9-4cee-9398-302a518d6dda", "sighting--8369d6d5-1127-448c-84d1-13b46b2897c2", "sighting--9aa73d90-1584-4179-bc05-10f642cc8618", "sighting--40f282a9-df38-43e1-926d-607716344646", "sighting--e4abe6c0-b77c-465b-94ec-490dde66a5ca", "sighting--1424c4c0-06d8-42ba-8054-197469cb7843", "sighting--2561976b-d2cf-4167-a658-449d3da3cace", "sighting--cb2fff59-57eb-4989-8d99-1e9fdc31c24c", "sighting--a1c0bce3-8bad-4f94-8134-c31a8bc27d4e", "sighting--4cf269e5-ebd3-4a59-bc63-87d9048ec613", "sighting--ddb14c2a-e795-408b-b252-324c86d23d1c", "sighting--b942af17-2619-4661-bad8-d7127fa4b22d", "sighting--13d56d02-f67e-4a25-a109-ceb195d9af01", "sighting--249972cf-31a6-49d3-a937-83ad5a3c99cc", "sighting--92827897-0855-42a0-9324-112552395952", "sighting--6b1e7547-eb52-4752-a361-af507a2dc17b", "sighting--6bf9a66b-dbb5-41ea-b58f-b738f1081c96", "sighting--8fd8df04-7171-480a-ad7a-b5814d65161b", "sighting--84cb3594-ac43-49b8-9a81-4359b5fb4615", "sighting--54ee34dd-a726-46c8-ad42-610030d2dd5d", "sighting--1bec883b-95e6-48c1-8f03-a72fc61b9ab0", "sighting--f2fd249f-e371-48f3-bad0-cf977df42e6b", "sighting--ad6c8347-e6cf-4f2b-9ad4-86dd6e80b36b", "sighting--1a6195fb-aae4-4821-8b7c-9c8326ca6d4a", "sighting--418c964d-8902-4b55-8a3f-78e1e7f47a24", "sighting--6ffe17cc-530b-4ce5-b164-f623780dd068", "sighting--737f5d3e-e94a-4863-8617-67f5871a76ac", "sighting--9b4cecab-c63d-4668-9ba5-51f294ebbeb2", "sighting--4f09b6c7-8c68-4bd4-83bb-fd53507e6ffe", "sighting--4fc8a760-3af9-41cd-9d4e-b6011ba4f153", "sighting--30490b49-a12b-4896-be0d-42a6720d167e", "sighting--721dd967-8bb1-4c77-9bd1-067fb5e9a818", "sighting--22164f63-1b82-457c-acdc-e5586c843bca", "sighting--f1b97577-f5b6-4941-b7a3-8c8113e8def4", "sighting--613cadee-21e9-4957-9a5e-87937267119a", "sighting--03a376b3-b9bf-40b3-a689-98969f5553df", "sighting--6c2ffde6-147b-4f5e-9bf7-5b4bff8c4665", "sighting--179b125f-5a30-45e7-912e-86d8b0b43837", "sighting--147549a4-1bc5-4d61-b0ac-bbe8c22ace2c", "sighting--1460edf8-95cc-4717-b381-1a32023dbb27", "sighting--e5a6ba43-fb69-4f42-9b3b-321273721348", "sighting--7254cb4c-ffd3-4b7f-af6e-cc025023397b", "sighting--8111bb1a-26e0-4b66-a99f-becae8ffa5c8", "sighting--6c92fd18-82e1-45ed-b4d3-16b2176daf7c", "sighting--e9187384-8ba9-48d1-ac13-deeb843402a7", "sighting--e1316513-2be1-43ef-8639-1279f7d8ade2", "sighting--d3044e17-3729-4bb3-8318-6e34289c2725", "sighting--5046ffd5-7e96-4039-8e02-62058b742dcd", "sighting--96ac8ea2-9b08-480f-9865-833b30a43169", "sighting--52039678-28c8-499f-9d16-244dbbcb93ee", "sighting--9879660b-164e-4c44-bd14-1e6be62c6861", "sighting--59dde387-2b75-4c7d-ae11-0b77f2b23f8d", "sighting--5d2a9447-a9f3-4832-a134-a81792e9dcca", "sighting--61a5e108-52e5-48bb-b9c7-9d5931f6d278", "sighting--1014d496-55b9-4505-be27-899ffb1e7f5e", "sighting--ddb6d43e-e9ca-48b9-afa0-32a03915f2be", "sighting--8119f1bf-1961-4998-83a3-ad81bb1f4180", "sighting--f5276c69-2172-4aa8-98c0-cc95dca3dc70", "sighting--281be4ce-37e3-4a60-af06-80ea003f70f3", "sighting--a3a262aa-0ea4-4445-ba3c-d3aa8048d204", "sighting--fa074456-78df-4510-bebe-8c22b4c4c7a7", "sighting--dbbde721-f00b-4dfe-9cf2-ba10166fd885", "sighting--88a15a84-f5e7-4b4c-a270-b967a906ef72", "sighting--a9016765-b806-44c8-a032-2ca7906ef6e3", "sighting--da246ec9-9c16-42af-9582-bf56d446c41a", "sighting--9bd38675-7e1e-4ded-8639-fb16936a1973", "sighting--c3b477c3-94fd-4cf7-b15c-26c3d48b681d", "sighting--6e6737ac-02ad-4f88-bffc-0647977b5acf", "sighting--1ee8d4fc-59bf-4810-8c44-6668511d7cea", "sighting--4a2fa266-95e2-40d8-a7d1-bea57384853a", "sighting--1dbe3c2e-eebf-4218-8c1b-ebce6c72f059", "sighting--de3893c0-034f-462c-9744-e689871a7362", "sighting--6746035b-d925-43dd-b283-d8a3b56d9c78", "sighting--9b9eb1e6-c754-4d63-a3f5-ab2503d46ecd", "sighting--c76ad2af-8812-44cc-9820-afd2d41fa25a", "sighting--24b87e8d-8802-450b-8efa-9dc36bc209fa", "sighting--9af1708d-d8db-4377-9cea-f4bd9a22a02c", "sighting--f5b708e2-c52d-44d4-88d0-fd7cb251d301", "sighting--b254a3f7-615d-4b3b-abf3-7e790391155e", "sighting--3d688652-5d64-4071-8eba-9152d8321fb4", "sighting--db9c7c9d-6bea-485c-aab5-4dfd6f921998", "sighting--28d56bde-9075-46ca-a84f-1a5db7d42e86", "sighting--8de27845-25cb-4f76-af3e-0c3952e26159", "sighting--1395f45b-a3da-46be-9569-7bffb73bb45f", "sighting--0f8ea05c-2ee4-4c3c-ba69-3e7f1560c619", "sighting--7aa67941-783e-49bf-8e24-3d7cd563d149", "sighting--1f434e60-4d66-4ad1-86e2-1e995d5abe2f", "sighting--5c087aea-6dfa-4bbd-ac6d-2f56d42c8a21", "sighting--5311200b-9572-47d6-988d-2706e9cbdb54", "sighting--0b55d395-366c-4256-8b2e-764d4fa21e7e", "sighting--374a0e41-ae4b-4d47-b201-d545c1f05505", "sighting--7845fc83-4760-453a-86bb-1f545ff7b54b", "sighting--de9c18bc-8e25-41df-8aa9-a998c49c2628", "sighting--041b88cf-78ee-4cba-974e-5ec297b5c1ca", "sighting--326f0df0-1d81-45c4-99d3-48ede8481244", "sighting--f2322848-7a78-4ca9-8f35-f91340051cc6", "sighting--df937fd8-f0e3-4c9a-a466-de3982e3f166", "sighting--6c659ca9-92dc-45f6-aac4-34cf67854626", "sighting--59046674-e692-47f9-8292-5366462539a4", "sighting--9f852e80-b71b-414e-ac25-7acdae439059", "sighting--db2077f4-2186-4d31-a5fe-db67fce5e89d", "sighting--ee93140b-17f9-41ad-a178-13c00944e805", "sighting--883eabcf-7ff4-43b0-bc1b-03f5a3614510", "sighting--14e17816-4063-41bf-ad31-72c386dbc599", "sighting--b7ebb360-703f-4a49-9d6f-e7869fb3bb85", "sighting--b8fe5fba-3a08-4353-9f2e-8fb6a95c7e2b", "sighting--6846f02a-9abf-4ade-9fbd-d84dec802f90", "sighting--7002111a-c63a-44da-b394-19dee1a6c459", "sighting--20ad32f5-0b29-48cc-9fdf-6b76a2e88ddb", "sighting--ae0ec221-a85d-41da-80c4-a4e9ecc2a36d", "sighting--85796c44-58bc-4386-9065-9eee39b86f16", "sighting--d4237c9b-118a-4efd-a5dd-315515ea2aae", "sighting--fad89807-017d-454e-88d0-86ef1b539b35", "sighting--392fce1d-964c-4818-9118-a23f5b1e0d0d", "sighting--1135639d-d5b4-4f07-adad-1cc1063d06c2", "sighting--b76a7bed-e4d8-46e0-ae83-ac51b9f64b15", "sighting--5c57d88e-bb25-4118-a577-7e9311ff3af0", "sighting--a812e4f4-f953-47eb-938b-a71faea3540d", "sighting--e5e9a1e4-bcd9-45da-ba0a-15c5048bab46", "sighting--70722886-13fc-4dc0-ab5b-a1a7cdc950fd", "sighting--45ac8e96-64fc-4f60-811a-012664e989fd", "sighting--156c2291-7011-450b-ba38-bc70aeef313d", "sighting--278f50e6-b089-4607-9c4e-6975f2943ac7", "sighting--7888ef35-d27a-4590-b52b-5c422aa86761", "sighting--67d423cb-0cdf-46d3-95e7-df1aedbb1f67", "sighting--07a64946-9d9f-488a-84cd-70755d499f8f", "sighting--be6cb6ef-671d-4db8-8af0-c478c1c57597", "sighting--6b44153d-bd7a-49de-b0c4-43d7c6418c14", "sighting--380d9ac9-f719-48ee-98a6-bb2eecfae1c9", "sighting--fcf037c5-0b17-4cc6-bf11-228206474d0a", "sighting--c8f330ad-ed55-4473-bd35-356819018c4d", "sighting--730b5035-1be4-49d3-af36-31aa92d2b4ae", "sighting--5eaf88e3-e832-4bf1-beb9-98bf462143c8", "sighting--6770e0bd-a2ee-46e3-99b8-e27af6287dae", "sighting--22a8639e-d44a-4d9f-9187-772928347a87", "sighting--d81de869-87e6-49a0-b05a-d7301d444797", "sighting--00127a3c-6546-4bcd-8fd7-43319ff5a97c", "sighting--423877f6-d4b3-444f-96bb-c43f6ef1a3f8", "sighting--4ec35bf0-63c4-4840-ae67-5ce722dca631", "sighting--0a59def7-321b-42ab-9f52-058b7d1a22d7", "sighting--99158fa5-1578-47a5-b694-9cbec293efb0", "sighting--20d8daf0-640d-4dbc-af41-ff085d9455dd", "sighting--1e3bd342-b414-472c-8685-b0acb1a6cc08", "sighting--38c7c846-5a88-4fd4-bb57-7a433eefe669", "sighting--b64942bc-4b67-47ab-b1c2-87d25627c38b", "sighting--72f98bc2-74ef-4d36-8635-31abecebb1e2", "sighting--796bf5aa-ce90-4000-84b9-3f33688e0b45", "sighting--f8162112-1fcc-481f-b10b-e6e590e47cfc", "sighting--3326b025-86ae-4718-a21f-9e39044efe3c", "sighting--dd120076-13a5-4101-811c-99954328018b", "sighting--66da6a7f-334b-434f-9a00-a51c09196d90", "sighting--41a3a39b-cfa6-4cc1-8717-2898c0379b26", "sighting--eae05d1e-dc07-44f8-8491-037a387dfab2", "sighting--742d44cb-0144-4fc7-a50b-674001be904b", "sighting--d38ac048-fa7e-4c2e-b624-d9bb5a392d4c", "sighting--6ffc46f1-b242-4e5d-a759-9bc6cb1d1b0c", "sighting--9cb1f922-8816-49a1-b635-5ca3c7284065", "sighting--8dff01e0-a9af-4749-b761-7e805f7832a1", "sighting--8efd71d2-26d2-4c6a-8eae-752442e2bd27", "sighting--2bd7b534-793b-4d81-b586-1fd0e3b33b89", "sighting--cdec09c4-434f-4199-8b89-380d574a64cc", "sighting--6848eed1-a04f-496b-92e7-022760841f14", "sighting--599619ba-fefc-4af2-baee-939f28f7e44d", "sighting--02148d2d-230c-4495-932b-b3df02fbc6af", "sighting--b52e6775-9bbb-4fbb-a26e-5e79193fb30e", "sighting--a8f6141a-9e77-4fcb-88ba-f7c52e3f6237", "sighting--b76efa77-2101-4f95-b0d2-b20d09b60acf", "sighting--7408f44e-c7ed-4f63-ad09-817ba045c89f", "sighting--f0d2f50b-369e-43f2-9d9e-64b76a61d0f7", "sighting--28bf48a0-b1cf-4e9b-96ef-700ae48027ab", "sighting--19b364b7-3cd5-4e08-8e77-cfbc78bf9894", "sighting--71fea862-c766-407e-8789-476f1df6500c", "sighting--bcd6f122-4153-4e41-b6ec-7d2a7fb26536", "sighting--81d7c74c-5dbf-4cf8-a54d-90c5dfc12fdd", "sighting--e36ad254-6f69-486d-bcc3-dbbda681008a", "sighting--70d6c52c-aee1-494b-8e5f-452747cda49d", "sighting--06987ee2-c3f1-4c4b-a058-a5cbbe36d6df", "sighting--22ba9eab-cb0b-4be0-bc10-94a9f0d11b60", "sighting--710bdd79-5c28-4dd2-a6cf-846d9bb0a7e4", "sighting--ad23efd7-65f8-48ab-a57c-4bc9fc98ef3e", "sighting--78de3a84-c418-4b6c-a029-c727143662b6", "sighting--7ea93f91-7277-41c8-8f83-2de7bb7894cd", "sighting--8cc1bb0e-d2e0-4523-8a2f-e99dc41ec1b1", "sighting--5cd98a1a-a8d4-4384-9b5a-088808b376e6", "sighting--e47b58b6-ae0d-402b-acb2-aa481fd8da38", "sighting--38329b85-732e-4732-b291-f0bb46ba59f5", "sighting--87d3166e-1d01-4273-9fc8-346f61546808", "sighting--12640f73-416c-42c9-81ee-0f625b223205", "sighting--bb31720d-2d3a-4252-a574-be3c90202a5c", "sighting--53a48ba5-af11-41c3-9deb-36f2253656dc", "sighting--c9550212-21d5-4895-b9ae-26e64dfd6dde", "sighting--c1891a69-eea8-48a6-928c-17c78b125b3e", "sighting--e9abd776-2a37-4d97-8334-e1c1baf98b8d", "sighting--3820dfee-18d3-444a-9cc7-ffd46254f5e9", "sighting--e031b196-2859-4364-b8ec-7415c82756cf", "sighting--1eb7dd4b-a4b9-476e-933e-4b761315caa6", "sighting--55220e8b-4735-4949-9f5b-80b63d599b35", "sighting--0f4ec509-177c-413b-92e6-27c48c393191", "sighting--d45ffd24-3077-4adc-ba80-bb54c3bb8802", "sighting--cbbc045c-d802-4cc6-a144-eecd14c1a886", "sighting--ff3eb1ee-c2e6-4fc1-9013-f02394caa0bf", "sighting--cb39819d-cc20-4762-bf37-7e94c5415f58", "sighting--bce78c89-9e76-40d9-8353-8112e05f6612", "sighting--948091de-3eec-4e92-877a-6a861bb9aa15", "sighting--a82724fb-9524-4293-b863-06ef2ecd8f55", "sighting--8122db1f-6ee0-4acf-909b-6b74f4b26ea5", "sighting--e0bee702-12fa-4137-96da-240287e1d238", "sighting--39d3215d-3170-4a47-89e2-cfd3aa9f7516", "sighting--895ec2cf-573c-4d8a-a3a3-0b372041834a", "sighting--726f16d9-0735-4d68-9fb7-3dcc2f981324", "sighting--d0b782c3-0433-475d-8197-06882c0035e3", "sighting--6614b8a4-ae01-4e62-8d01-3ada36c82e48", "sighting--eaf38f95-3107-42ad-8955-56e2d1c7a280", "sighting--f387bcb1-d1fa-400e-b2fd-2ed22d7be6be", "sighting--38e9a9b4-9a7c-47da-b2a5-68925ebb1152", "sighting--54ce9932-efc5-49e3-8283-41f6492d4274", "sighting--c747965c-2d89-414f-bafa-d1023e6abc9b", "sighting--0f4b7c23-fb85-4127-be8b-dab8e74ca139", "sighting--893eca7a-23ee-4b4e-82dc-200382446696", "sighting--c48808b9-f326-42b4-8be1-552926dc0c1d", "sighting--b98eef20-f1fd-4e47-98bc-b1f4def99bde", "sighting--58635882-db7a-4a9c-ae07-ebab35fbd421", "sighting--5ce81b8d-dd58-408a-b802-b224ecbfd909", "sighting--0185453f-8cd5-4a1e-8cb9-46bca4fbb212", "sighting--069da474-3391-4e0a-b2d5-d71e82ef0bf5", "sighting--acb10ae4-0273-4f90-b645-84b00fe82e61", "sighting--f1c0e04a-bedd-40aa-905c-b56c5c952f79", "sighting--6ae8073a-7d88-4ae4-9aea-94e22451e568", "sighting--86d4fed4-1a18-4a0a-9413-66225372755e", "sighting--6a825954-37b8-4e7c-904b-9f1b8920f48f", "sighting--b119a066-2e6a-413e-9fae-1658740beefe", "sighting--79b436aa-06d0-4d48-a4f5-0816e11e866f", "sighting--8a08a0fa-62c2-4110-801c-0ebf2e1dff9e", "sighting--0cd5f60d-c09b-444a-9622-fdbe93f272b4", "sighting--eb077f93-82b5-4157-acb0-e4eaa171b725", "sighting--768126ef-6c6c-4d3a-859b-6619ff40cd0b", "sighting--cc14bfa4-b4bb-45f1-a877-24df1394a4fb", "sighting--867749a7-afe7-406d-971c-639510f57522", "sighting--e033e809-22f2-43de-87e4-7f42423366dd", "sighting--09a5980d-320b-481d-89f7-4c8a336ef1b3", "sighting--e2cb7627-acb5-4d0f-a742-db10516eb7ee", "sighting--e41a106d-ea43-43b8-93b0-972f8cf7e452", "sighting--28cdd65d-2f9c-43fa-8554-fa87e64beeae", "sighting--81dfe7cc-8938-47a4-9e4a-e83b71379144", "sighting--f6eadf1b-4c44-4bec-8d06-37d0d1bc8734", "sighting--b4ce771d-a25e-4368-88f8-f7bc1002ef35", "sighting--8b0b4dd9-4408-471a-9f4d-b1e7229284ed", "sighting--cc2b0508-75e9-4a76-97c5-94a8e51a7630", "sighting--cb30a9b7-7996-4f2c-a6ef-bcd972de09a2", "sighting--7662fe3c-4cda-400f-b211-89fc12e2bfe1", "sighting--cb42dbd3-3376-4014-a374-82090a07c866", "sighting--04154122-7394-4940-924e-b3e7523b0d3d", "sighting--feb513cc-d70b-4438-978d-dae415beaeb9", "sighting--f9812a35-a851-419a-9b61-3057074feec4", "sighting--5e8934b6-1034-41f8-a510-804fa22ac0d4", "sighting--1180abc4-8e7c-4ca8-935d-307bf3752ad7", "sighting--2ecb69c2-349c-492c-8230-5043c6ade1ef", "sighting--10864183-01f0-4d3b-b358-64b316f72606", "sighting--11b81abe-5d37-49d7-8ef5-c38350948bfa", "sighting--9aab19da-65a5-4b4a-b4a4-7fa601b2283e", "sighting--4a0eca21-7923-45df-ae2c-9d9613f1e68d", "sighting--16257e7a-20da-4d0b-b05a-5dc1d862a063", "sighting--bed92a30-7769-4c39-813c-0cd60a65a8be", "sighting--a06d1bc0-3c03-4649-9eef-417f86aa4ab7", "sighting--09f89687-9854-4298-9476-1908f2b53a2b", "sighting--31c7a3bc-f130-4654-84a6-c927e31f9396", "sighting--3f3faf24-5efe-4d6e-a2e9-caf04f9ccc56", "sighting--a8e72281-e152-41fc-85b4-0426eee85a66", "sighting--013897e6-5d26-44ab-af76-1e48c35a45e5", "sighting--454b6f29-a1b3-4680-8ace-f9e2b88114a5", "sighting--e921a494-7dc4-42d5-a618-b039cd4563fa", "sighting--cc73270d-4d0f-42d4-9038-7aa35835982f", "sighting--161b4027-582f-4448-be8f-67d9d284cc52", "sighting--04d0d848-7d95-4beb-96a3-47c02abdff4e", "sighting--7018e517-0956-4144-81c8-3485af4a2462", "sighting--1fa037ac-e53d-4320-8fb9-318876d3b48e", "sighting--a57ba16f-8507-4730-957c-622051cacf54", "sighting--b6eacc13-0d05-4126-bdd0-0e55b3d13654", "sighting--9922b8a0-b24a-4505-bb98-b82441b90d56", "sighting--eca7ecd1-9be3-4ddb-8286-4ebce7871aaf", "sighting--7785ef29-00cf-4916-adc9-bef0d99679d9", "sighting--f80481b3-da0a-4948-a633-3a81ffe0abcf", "sighting--8ba88250-6251-423e-b204-7da696f38520", "sighting--18a16d3b-8016-40a8-9462-6519911d9c57", "sighting--80741da1-122a-4ccc-9537-b1db2b8d6d72", "sighting--7c0b3a3e-a2c5-4459-bc6a-9b8bb9b97809", "sighting--ca8ca158-d228-4c8e-ad3c-fae80871df1d", "sighting--595528d6-6934-487f-88f6-c5134c583cc3", "sighting--ddcbf470-26b6-4453-b4b7-78779664a0a7", "sighting--3ed75138-89df-4607-bb13-72875205fae3", "sighting--9eb03515-c75d-4ab4-9053-100cbc01025a", "sighting--aaaa9a21-ca95-4fe0-9c6f-1079c6520b15", "sighting--6e4c2181-e9a9-4870-bb99-efd06050fda6", "sighting--0d75836a-c47b-445c-ab41-54acf5f2b13a", "sighting--ce51bc6d-6ec5-4054-a04f-f73596229a9d", "sighting--b5ce18c9-5db0-4e4a-ae72-42e16e59a2b2", "sighting--90cc25a9-940a-44a8-b971-bb0a0bfa96c2", "sighting--f704b4fa-e4f2-448c-bb39-753fa9c4d3f4", "sighting--d7f83784-c8d2-436a-a80d-4cf5f652c652", "sighting--bef961df-ae4d-4615-895b-20a15f146d5f", "sighting--e5dfe47a-ef36-46e7-8069-ee08696a23d7", "sighting--605528ed-9726-4b93-9968-03ee858ee2db", "sighting--86e71f31-c47f-4d1f-a738-1f8a3c071e11", "sighting--ba8c1311-db17-4e44-ac1c-a0e52d29e155", "sighting--37deabff-74c1-4f9b-87f4-6d2b3f4ec662", "sighting--cebfc7e6-9ff6-461a-8fb2-81c1e4e2cfa1", "sighting--bb15212c-1806-444f-9bff-0221160e3215", "sighting--ef5b9841-ad81-4ab1-a49d-2495422a6a43", "sighting--48f4e816-7a80-4719-8e19-fbd2b81cee7d", "sighting--062aa47b-d7d6-4ee2-8392-a95fc9e8bf7c", "sighting--d31c00ba-e2eb-48b5-8b51-a12dff50788d", "sighting--ecc5cda4-7e85-4705-9893-7a16d034ba4e", "sighting--283f8a5e-1bd7-4c44-9dbe-f695c162d8f5", "sighting--8faeb7c6-ffe5-4e2a-b4d8-f2aa8135bcd3", "sighting--0e521297-803d-4a1e-9bbb-6814862b873d", "sighting--e3773f51-9713-46e3-8dff-cde3d945853e", "sighting--134d910e-f6ea-4022-b50b-330222bb6918", "sighting--679ebbbb-0446-46f6-b79e-1338cb51a95f", "sighting--86e5867e-1ba9-4945-a07b-10185a0eded4", "sighting--4f340a1f-8fc1-4673-bca8-0d63cce3bf44", "sighting--6d3cdd65-2b82-428e-a6d7-22ba6512bd7f", "sighting--405495d8-7f8f-497b-ad39-39aebe2151c5", "sighting--ffb6f7ad-afa4-481b-9fbe-76e785200f54", "sighting--7feb56de-775f-4a15-9c27-b728dcf29c33", "sighting--535ce5b2-1fef-43a0-aae9-2f7bbd26399f", "sighting--fb7193ef-d26f-4d52-a70e-79474ab34ad9", "sighting--5fdc100d-31cc-4b0d-be6e-43a3e8a92cf1", "sighting--5ee8ef17-b3dd-40c7-8e2a-d4bbc133cd2a", "sighting--b686f7d1-2d9c-4880-8d41-eed86119d491", "sighting--e65df588-7beb-4a6d-9eb4-592cc147264b", "sighting--5fb58b67-5a6a-4ab0-823e-55a960f99e49", "sighting--ac697107-569b-4685-a2fd-443e5492e8d4", "sighting--b88082c0-4d19-4586-a7f1-3fdd5157c370", "sighting--1c9aff39-663a-429c-b97f-8bf564653c4e", "sighting--c1e71070-a6df-4142-b923-bd70964b1d3a", "sighting--af2835f9-59ce-4214-8ae3-830b70a5a0b5", "sighting--c19f7bc0-9c09-4278-b1d5-5a23fa408182", "sighting--336210e7-1368-4587-8856-2e1fffe03e5d", "sighting--260364aa-ecb6-45c8-bc81-7bd51c983b8b", "sighting--43e62638-24ad-4914-995c-5bbc01dc8362", "sighting--89b1dcfe-666b-4538-882f-0da397bf787c", "sighting--fc5b62fd-8dcb-43fa-90b6-2a03eee68f6f", "sighting--8bec4713-fb34-4410-a30d-2ce0e4bb9bc8", "sighting--001c12fa-a731-411c-a220-d6073fd72084", "sighting--81332fc3-cf56-4b02-a667-2427e85e15be", "sighting--b02665ba-ace4-48f8-aff5-e084391241f3", "sighting--03a790ff-d29c-4ae9-b8e8-d72e91e81f9e", "sighting--ce1961a5-30b6-41eb-bd65-ddf028fc5847", "sighting--1135825a-0034-4ad2-8969-549fbac20727", "sighting--1ec7d43d-e159-4545-9130-3028aba0c6b9", "sighting--1a06146c-6048-4a2c-a7a1-e648d738735f", "sighting--f89c9408-4898-40b4-9275-0b50cf3f5294", "sighting--90efa304-9066-4d09-aabe-d585f6a8c165", "sighting--dd925464-6443-4975-9743-6ddbeca7b25c", "sighting--cca23067-5eed-4b43-be75-f7646abdbf82", "sighting--c0c2344f-3074-4f03-a767-76d1b62ef5c7", "sighting--6705fab0-13ed-4287-815f-bb5bb7b3aae8", "sighting--ad641c2d-5b98-40e0-b87e-76a0322e41dc", "sighting--bf7c42df-9254-458a-a490-6ca6afd5e5d8", "sighting--d416c7d2-7649-45a6-8424-410ff815fac7", "sighting--851d7b02-31d1-4366-b5bf-92215b266bb6", "sighting--2b6ea9b7-2131-4e7f-a39b-fb777883de2c", "sighting--1cecda5f-d355-429b-b332-67a38cea9401", "sighting--5f829ea2-d2e0-4e4b-8fa2-eaee43e188e3", "sighting--ac2dfc75-3b60-4c31-9983-3fec217c7bc1", "sighting--8073dc40-cb77-432c-97c1-89e49d8b8164", "sighting--52bb0cf7-0f08-416f-a032-1c02619eb8f3", "sighting--a530a639-0cc2-4751-b3c3-caa07413b839", "sighting--fe6f5cc2-9d18-4588-b7ac-9cc5c18e82b6", "sighting--b08fbeae-c412-4ef3-82fa-21d72b4e6e3f", "sighting--0ea3d8e1-9fb6-41e0-86f0-a71960297399", "sighting--7ae43746-e0a9-4c92-98b9-fdac862ba834", "sighting--0e00f71d-ff52-4c38-8a32-5e68f40503c4", "sighting--28b29c0c-7673-4c78-b337-cf4145e1a03b", "sighting--acaad24e-ca54-47b1-b0a0-97bc7e8d5f1f", "sighting--ff4dd5d4-29bf-4c24-afec-7178abe24d61", "sighting--135ddfba-e9f7-4eb7-8671-55d71558dc41", "sighting--aa9a7c1e-0132-4e44-98f2-cbb57400bbd5", "sighting--a60493a0-4a89-49cf-abbd-f0cf749f7334", "sighting--f2d24dd1-c4bf-4eca-b943-cb993e37abde", "sighting--51a9a13d-0245-442b-9184-9a721cf4a1ca", "sighting--678c8e28-1e39-4bb7-9e83-40c523611885", "sighting--416d4573-7616-4041-9ed7-db45502f135b", "sighting--53e06105-c001-4379-9008-7ee356b9ab56", "sighting--8e0002e8-b1f4-4c49-9d71-1ce32572fbe8", "sighting--05692f55-0f67-4976-8734-c6fc583b90bb", "sighting--bab696fd-3d63-4561-8907-efda90fbf981", "sighting--75c8998e-6fe1-4922-991f-286ae187b3d5", "sighting--8fb2abe7-c2f8-4ba2-b673-9ed57be46d6a", "sighting--d2fa3af7-275c-41af-a4d5-0ec57c5e0f41", "sighting--f0a968e3-53b8-47bb-8f90-ae238953e03c", "sighting--c29ffc96-79e8-4859-8a9d-69b265da2202", "sighting--2fb679dc-e6eb-4d07-8576-fdd5e7f73b88", "sighting--435e6e56-f3a3-48f1-bba4-7167b1a21008", "sighting--6080372d-49f5-444f-b54c-e9c6810d23ff", "sighting--d225372c-0fd6-41ca-a9db-bab35d71b20d"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-15T11:00:01.680Z", "modified": "2026-05-15T11:00:01.680Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": {"tlp": "white"}}]}